Dashboard › craft › Distillation
ab958cad-c5e2-4873-8855-d81a5c122b62["lore_tm_v1_sgpOaP7WVnX0WfVOSqA9XVqlS0qPeuphpsFopvsK7Rw","lore_tm_v1_DqJOQJmBSdnTlzHlh3sq-JMQ9t14EkX2NmytWVPieFY","lore_tm_v1_H-vyfQ6n6PkWUmS-VMtbh7p2-_bf3MB0kdqtimRNWsQ"]
Date: Sep 4, 2026
/home/byk/Code/getsentry/craft-workspace-action-propagation (33 entries), including .craft.yml, action.yml, AGENTS.md, README.md, src/, docs/, dist/, package.json, pnpm-lock.yaml, tsconfig.json, and vitest.config.mts.craft-workspace-action-propagation: modified action.yml, docs/src/content/docs/targets/github.md, src/__tests__/action.test.ts, src/__tests__/config.test.ts, src/commands/prepare.ts, src/config.ts, src/schemas/project_config.ts, src/utils/__tests__/publishState.test.ts, and src/utils/publishState.ts; diff totals 636 insertions and 44 deletions across 9 files.action.yml validation now sets LC_ALL: C; validates PATH_INPUT as either . or slash-delimited safe ASCII segments matching [A-Za-z0-9_.-]+, rejecting empty segments, ., .., __proto__, and segments beginning -; validates WORKSPACE with the same safe path-segment rules; error messages now refer to path inputs/workspace paths rather than compact workspace names.action.yml now runs unset CRAFT_WORKSPACE before root-level Craft Prepare and Read Craft Targets commands, preventing inherited CRAFT_WORKSPACE from affecting root commands.docs/src/content/docs/targets/github.md changed workspace semantics: top-level workspaces: keys may be literal paths or glob patterns, expanded relative to .craft.yml; users select one concrete path via --workspace <path> or CRAFT_WORKSPACE; configured-glob-matched files are ignored, overlapping workspace keys are rejected, github.projectPath remains prohibited in workspaces, and workflows cannot provide both path and a workspace. craft workspace list now returns concrete paths as JSON; action publish titles carry the full concrete path.cli/mcp to packages/*/tools/mcp, retaining release/cli and release/mcp branch prefixes and cli@/mcp@ GitHub tag prefixes.src/__tests__/action.test.ts test harness now fails if CRAFT_WORKSPACE is inherited. Action tests accept workspace inputs '', cli-v2, packages/cli, and packages/CLI; reject unsafe checkout paths ../outside, /tmp, ./packages/cli, packages//cli, and packages/../cli before Git/Craft side effects; reject workspace cli\nnext, packages/*, ./packages/cli, packages//cli, packages/./cli, packages/../cli, packages/__proto__/cli, and packages/-cli.src/__tests__/action.test.ts publish-title expectation changed from publish: getsentry/toolkit/cli@1.2.3 to publish: getsentry/toolkit/packages/cli@1.2.3; added regression test confirming inherited CRAFT_WORKSPACE='packages/cli' is cleared and root commands invoke exactly prepare then targets.src/config.ts now imports realpathSync and globSync/hasMagic from glob; supports resolving workspace configuration by concrete workspace path against literal keys or glob keys, rejects selecting a glob as a workspace, and throws ConfigurationError when a concrete path matches multiple patterns.src/config.ts glob expansion uses globSync(workspaceGlob, { absolute: false, cwd: root, dot: true, ignore: ['**/node_modules/**'], posix: true }); only retains safe directory matches inside both lexical repository root and realpath repository root, preventing traversal through symlinked directories; output is sorted.src/config.ts permits workspace glob constructs including braces, ?, *, character classes, negated classes, and **; rejects absolute paths, backslashes, empty/./../__proto__ segments, leading -, and unsafe glob characters. Helper functions added: getWorkspaceConfig, workspaceKeyMatches, getWorkspaceNamesFromConfig, getWorkspaceGlobMatches, isWorkspacePattern, isSafeWorkspacePath, isSafeWorkspaceGlob, isSafeWorkspaceGlobSegment, isSafeWorkspaceGlobPattern, expandBraceAlternatives, and splitBraceAlternatives.src/config.ts cache invalidation now also clears _configPathCache in setActiveWorkspace; findConfigFile() discards a cached config path if it no longer exists. applyWorkspaceSelection() and resolveWorkspaceConfig() now receive a workspace directory; loadConfigurationFromString() accepts optional workspaceDirectory = process.cwd(); getWorkspaceNames() returns concrete expanded workspace paths relative to the config file.src/commands/prepare.ts now obtains repository root with git revparse ['--show-toplevel'] and passes repositoryRoot.trim() to loadConfigurationFromString(configContent, ...) when loading .craft.yml from argv.remote/argv.configFrom, so remote configuration globs resolve from repository root.src/__tests__/config.test.ts adds coverage for glob expansion: packages/* expands directories packages/cli and packages/mcp but ignores packages/README.md; remote configuration globs resolve from repository root despite nested CWD; negated classes packages/[!a]* and packages/[^a]* select packages/cli; supported patterns packages/{cli,mcp}, packages/?li, packages/[cm]*, and packages/**/cli expand expected concrete directories.src/__tests__/config.test.ts verifies packages/**/release does not traverse symlink packages/external to an outside directory, retaining only packages/internal/release; rejects unsafe brace alternatives {../outside/*,packages/*} and {/tmp/*,packages/*}; rejects unsafe literal workspace paths packages/./cli, packages/../cli, packages/__proto__/cli, packages/foo], packages/foo!, and packages/foo^; rejects concrete packages/cli matching both packages/* and packages/cli*.src/schemas/project_config.ts now imports hasMagic from glob and extends WorkspaceNameSchema with isSafeWorkspaceGlob, producing Workspace paths must use safe ASCII segments. for unsafe keys; duplicated brace-alternative and safe-segment validation helpers support glob key validation.src/utils/publishState.ts added encodeVersionForFilename(version): retains sanitiseForFilename(version) only if unchanged; otherwise prefixes version- and Base64URL-encodes the original version. getPublishStateFilename() now uses this encoding to avoid filename collisions.src/utils/__tests__/publishState.test.ts adds regression test verifying release versions 4.2.6+sentry1 and 4.2.6+Sentry1 produce distinct filenames containing respectively -version-NC4yLjYrc2VudHJ5MQ.json and -version-NC4yLjYrU2VudHJ5MQ.json.