Distillation

Current State

• As of Aug 29, 2026, 04:46, active work is the approved redesign of the Craft Action ↔ Publish controller workspace request contract. The original JSON-qualified implementation remains pushed in linked PRs but is being replaced locally by the compact single-trailing-segment contract:
  • Publish/controller PR #9339: https://github.com/getsentry/publish/pull/9339, feat: accept workspace publish requests, OPEN, non-draft, branch feat/workspace-acceptance, base main.
    • Pushed commits remain 33de3f1 feat: accept workspace publish requests (Aug 26, 14:16) and b658ffa fix: validate publish workspace JSON (Aug 27, 09:16).
    • Head remains b658ffa0299fedf78c9dd9a2121cd740691ca157; base 83d210b29553ea6f4d97508821724a834c43856e.
    • Local worktree at /home/byk/Code/getsentry/publish-workspace-acceptance now has uncommitted compact-controller implementation. Tracked modifications: .github/workflows/publish.yml, package.json, src/modules/details-from-context.js. Untracked: pnpm-lock.yaml, scripts/, src/modules/__tests__/publish-location.js, src/modules/__tests__/release-revision.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/publish-location.js, src/modules/release-revision.js, src/publish/resolve-location.js, src/publish/resolve-release-revision.js.
    • As of 04:37, tracked diff is 58 changed workflow lines; overall tracked changes are 39 insertions and 36 deletions across those three files. Do not discard or commit the untracked pnpm-lock.yaml; Publish requires Yarn Classic for intended lockfile updates.
  • Craft/action PR #872: https://github.com/getsentry/craft/pull/872, feat: propagate release workspaces, OPEN, draft, branch feat/workspace-action-propagation, base master.
    • Existing pushed commit remains 6dae341 feat: propagate release workspaces (Aug 26, 14:18), head 6dae341f9bc1378abde7a9022108caded2d22226, base 21270a1d12a60b461c51fba93bd076b90d9cf4af.
    • Local Craft compact-contract work is complete and fully verified through Aug 28, 12:49, but is not yet committed/pushed to #872. Modified/additional files are detailed under Technical Changes.
• Publish must deploy before Craft #872 is ready/lands because Craft-created compact requests must be understood by Publish. Additionally, the Publish controller needs an immutable Craft image containing craft workspace list.
  • ghcr.io/getsentry/craft:2.31.0 was determined not yet published on Aug 29, 02:13 and cannot currently be used in production/testing.
  • The local Publish workflow intentionally pins getsentry/craft:2.31.0, rejecting mutable latest; Craft release/image publication is a hard deployment prerequisite.
  • A Docker Hub bootstrap deadlock was established Aug 28, 19:57: Craft publishes npm → gcs → registry → docker → github → gh-pages; a GCS failure prevents Docker Hub getsentry/craft:latest publication, while master image workflow still pushes ghcr.io/getsentry/craft:latest and immutable SHA tags. Recovery options are manually mirroring a ghcr.io/getsentry/craft:<sha> image to Docker Hub or retrying after GCS is repaired. Reordering requires separate runs because npm was already published.
• Both existing PRs were blocked only on required review as of Aug 27, 16:07–16:21:
  • Publish #9339: mergeStateStatus: BLOCKED, reviewDecision: REVIEW_REQUIRED; listed CI/security checks green.
  • Craft #872: draft, mergeStateStatus: BLOCKED, reviewDecision: REVIEW_REQUIRED, no reviews/comments/threads; listed CI/security checks green.
  • Publish’s sole bot review was a sentry COMMENTED review at Aug 26, 14:25:34 UTC on superseded 33de3f1; its invalid JSON \q finding was fixed in b658ffa and resolved. No newer bot comments were recorded.
  • User directive remains: after every push/PR update, monitor bot reviews, review threads, issue comments, CI, and merge state before declaring readiness.
• Current agreed compact contract:
  1. New Craft requests encode an ASCII-safe workspace as one compact trailing title path segment: e.g. root publish: getsentry/toolkit@1.2.3; workspace publish: getsentry/toolkit/cli@1.2.3.
  2. Parser handles syntax only. For compact titles, Publish checks out the exact CI-approved revision first, discovers raw exact workspace keys with craft workspace list, then classifies one trailing segment workspace-first.
  3. Exact membership in checked-out root configuration means workspace; otherwise the suffix remains a checkout path. Names are never normalized.
  4. Missing root .craft.yml is path-only. If root .craft.yml exists, workspace discovery failures must fail closed rather than silently fall back to path behavior.
  5. Legacy JSON-qualified workspace titles remain controller-parser-compatible; explicit legacy workspace continues to take precedence in semantic location resolution.
  6. Field-less legacy issues must retain their legacy route/meaning and must not be converted into a new compact request.
  7. Craft enforces the ambiguity boundary: workspace names are ASCII title tokens; workspace plus non-root path is rejected before side effects; nonempty release-workspace configurations cannot use root or workspace-level github.projectPath; special __proto__ keys are rejected.
  8. One poller-approved revision must control checkout, compact classification, state path/CWD, CRAFT_WORKSPACE, and craft publish --rev; state filename parity remains mandatory.
• Publish’s local workflow restructuring is underway and substantially implemented:
  • Parse syntax using inputs.js.
  • Extract exact release SHA from the issue’s existing View check runs link.
  • Check out getsentry/<repo> into __repo__ at that exact SHA.
  • If root .craft.yml exists, run pinned getsentry/craft:2.31.0 workspace list; otherwise use [].
  • Resolve one canonical path/workspace location.
  • Feed only that resolved location into state creation and craft publish <version> --rev <approved SHA>.
  • The old mutable default/allowlisted protected-branch selection must be removed rather than retained as a competing revision source.
• Active plan as of Aug 29, 04:34–04:46:
  1. Completed: Craft compact input/configuration safeguards, raw workspace discovery command, focused/full source verification, and docs build.
  2. In progress: Complete/verify Publish compact title parser, exact release-revision resolution, post-checkout workspace discovery/location resolution, and workflow integration.
  3. Pending: Add/finish focused cross-repository and workflow regression coverage.
  4. Pending: Run Publish verification and an adversarial Craft/contract review.
  5. Pending: Commit/push both PR updates only after deployment-image prerequisite is resolvable, then monitor reviews, CI, comments, and merge state.
  6. Pending/low priority: Document workspace migration.
• Background tasks:
  • ses_fb83e8505ffeGclFS273c6OjTQ was reported running Aug 28, 09:46; instructions prohibit sleeping, polling, requesting status, duplicating work, or overlapping work.
  • ses_fb7953815fferhgAYqqquyoEu9 was reported running Aug 28, 12:51, likewise non-overlapping/no-poll.
• Worktrees:
  • Craft: /home/byk/Code/getsentry/craft-workspace-action-propagation, branch feat/workspace-action-propagation, based on 21270a1; original feature head 6dae341.
  • Publish: /home/byk/Code/getsentry/publish-workspace-acceptance, branch feat/workspace-acceptance, based on 83d210b; pushed feature head b658ffa.
• getsentry/publish default branch is main, not master.
• Historical context:
  • Craft PR #848 (feat/workspaces-schema) was admin-squash-merged Aug 25, 10:04:15Z as 21270a1d12a60b461c51fba93bd076b90d9cf4af.
  • Craft PR #844 closed superseded at 2026-08-25T10:05:27Z.
• Persistent user assertions/directives:
  • CI poller always adds ci-ready after passing CI; waiting-for-ci removes it first to emit a fresh labeled event (reiterated through Aug 29, 00:08).
  • workflow_dispatch must always remain enabled in ci-poller.yml for manual recovery (reaffirmed Aug 28, 18:18).
  • Always throw for unexpected values; a switch default must throw, e.g. new Error(\Unknown status: '${status}'`)` (reaffirmed Aug 28, 20:58).
  • Never normalize workspace names before lookup.
  • A separated option token such as --workspace --dry-run must never be treated as a workspace name.
  • Current-version prerelease relaxation applies only to current Craft version, never configured minVersion.
  • New Craft-created requests always include checkout repository identity.
  • CDN consumers must pin versions, not latest; this now directly affects Publish’s former docker://getsentry/craft:latest.
  • Peggy extra-options-file keys use long two-dash spelling without literal dashes; internally dashed options are camelCase.
  • Peggy Unicode matching never matches a lone surrogate.
  • Use pnpm, never npm/yarn, for Craft. Publish uses Yarn Classic, never npm.
  • Always restore the original lookup: renderTemplateSafe() must restore mustache.Context.prototype.lookup = originalLookup in finally.
  • User stated twice (Aug 28, 10:56 and 12:39) they never used @typescript-eslint/no-unused-vars; existing lint warning attribution should not imply their usage.

Key Decisions

• Merged Craft workspace hardening (#848)
  • #848 was held DO-NOT-MERGE after prototype workspace-selection and cross-workspace resume-state collisions; state isolation was included rather than deferred.
  • Admin squash merge was necessary because GitHub prevented self-approval.
• Workspace configuration is fail-closed
  • Object.hasOwn(workspaces, workspaceName) is required for selection, rejecting inherited constructor, toString, and __proto__ selectors while permitting explicitly configured own keys where valid.
  • New compact-workspace schema rejects special __proto__ at entry because Zod z.record silently dropped that key: otherwise YAML workspaces: { __proto__: {} } could validate but become invisible to Object.keys, bypassing selection and root github.projectPath guards.
  • Release workspace names must be safe ASCII /^[A-Za-z0-9_.-]+$/, excluding __proto__; the Action now uses Node’s regex rather than locale-sensitive Bash ranges.
  • Workspace config cannot set github.projectPath; when the workspace map is nonempty, base/root github.projectPath is also forbidden. This root-only release-workspace invariant eliminates compact suffix ambiguity.
  • Empty workspace maps remain legacy-compatible: workspace min-version and root-project-path compact restrictions apply only when the workspace map is nonempty.
• Action security decisions
  • First composite Action step remains workspace/path validation before all side effects.
  • It rejects Cc, Cf, Zl, Zp, unsafe/non-ASCII compact names, and non-root path with a nonempty workspace.
  • Bash matcher was rejected because [A-Za-z] ranges are locale-sensitive: under en_US.utf8, it accepted é, unlike schema validation. Node-based ASCII regex closes this pre-side-effect injection/contract gap.
  • Both Craft calls use inline --workspace=$WORKSPACE, preventing separate-token option injection.
• Workspace discovery
  • Existing src/utils/workspaces.ts handles package-manager workspaces and must not be used for named Craft release workspaces.
  • Final command contract is craft workspace list, not craft workspaces --json.
  • It reports Object.keys(parsed.workspaces || {}) as exact raw keys in JSON from raw validated .craft.yml, without applying active workspace selection and without normalizing.
  • Discovery validates config and mirrors workspace-selection version gating via centralized checkWorkspacesMinVersion(config).
• Compact title and legacy compatibility
  • New compact title grammar is a parser-level syntactic path suffix only; semantic workspace interpretation is deliberately post-checkout.
  • The direct reinterpretation of all legacy path titles was rejected because it changes legacy semantics.
  • Versioned/authenticated body metadata was rejected by the user (Aug 27, 14:59); no new request identity marker/body field is allowed.
  • Legacy JSON workspace syntax remains accepted by the controller parser for backward compatibility, including arbitrary safe Unicode legacy names; only new Action-created workspace requests use ASCII compact format.
  • An explicit legacy workspace takes precedence over discovery in resolvePublishLocation.
• CI/revision binding
  • Poller-approved revision is the exact 40-hex SHA in the existing issue-body View check runs link, not the mutable branch/default/allowlisted branch.
  • The poller may update that link when release branch head moves, and only then labels ci-ready; Publish must consume the precise linked commit.
  • Compact classification/state setup/CWD/Craft execution must all use the same exact approved revision.
  • Publish must call craft publish <version> --rev <revision> so Craft checks out and validates the same revision.
• Craft container deployment
  • Pin immutable getsentry/craft:2.31.0 for controller discovery and publishing; no fallback to latest.
  • At Aug 29, 02:13, ghcr.io/getsentry/craft:2.31.0 was unavailable. Registry/API constraints mean image publication is a prerequisite, not something to evade with mutable tags.
  • GitHub Packages API version lookup could not be used: current token lacks read:packages (403 You need at least read:packages scope to get a package's versions.); direct manifest lookup was used instead.
• Parser library decision: Peggy
  • Select Peggy 5.1.0, not Nearley 2.20.1 or PEG.js 0.10.0: maintained PEG.js successor, MIT, build-time CommonJS parser generation with no runtime dependency.
  • Canonical grammar is .peggy; generated CommonJS parser is committed/generated source; Peggy stays development-only.
  • Earlier research: Peggy latest npm release 5.1.0 dated 2026-03-01, repo default main, last pushed 2026-03-19; Nearley latest 2.20.1 dated 2020-12-06, last pushed 2024-11-14; PEG.js latest 0.10.0 dated 2016-08-19, last pushed 2021-11-08.
• Secure state identity
  • Workspace config can override GitHub owner/repo, so target/release identity may differ from Action checkout/title identity.
  • CRAFT_PUBLISH_STATE_GITHUB_REPO=getsentry/<title-repo> governs only Craft state filename identity through getPublishStateGitHubConfig, not publication target identity.
  • Publish passes exact secure state-file path as CRAFT_STATE_FILE_PATH on cancellation/failure; no repo-file fallback.
  • Active workspace state prefix is Base64URL: workspace-${Buffer.from(workspace).toString("base64url")}-; ordinary sanitization was rejected because it collapses legal names.
  • State is XDG-only, outside checkout, preventing PR-controlled state prepopulation.
• Deferred/unrelated
  • Cloudflare target and monorepo prefixed-tag work are future independent PRs.
  • CalVer Publish-issue changelog mentions must render bold to avoid pings; committed CHANGELOG.md keeps original mentions.
  • Other user branch facts: 3566840 fix: replace extract-zip with node-stream-zip to fix Node 24.16.0 hang; 8484cd8 security(commit-repo): replace execSync tar with node-tar.

Technical Changes

• Merged Craft #848 (feat/workspaces-schema)
  • 086a633 fix(config): address workspace review feedback, pushed Aug 25, 09:31.
  • ab63572 fix(publish): isolate workspace release state, pushed Aug 25, 09:44.
  • Squash merge: 21270a1d12a60b461c51fba93bd076b90d9cf4af.
  • Key files: src/config.ts, src/utils/helpers.ts, src/utils/publishState.ts, associated config/helper/publishState tests.
• Original Craft Action propagation commit 6dae341
  • Existing files: .github/workflows/release.yml, action.yml, src/__tests__/action.test.ts, src/commands/__tests__/publish.test.ts, src/commands/publish.ts.
  • release.yml forwards optional workspace through workflow_dispatch and typed workflow_call; call supports version, force, merge target, blocker label, publish repo, git identity, path default ., config-from-merge-target.
  • Original request title JSON form is superseded locally: publish: ${GITHUB_REPOSITORY}${SUBDIRECTORY} [workspace: ${workspace_json}] @${RESOLVED_VERSION}.
  • Request publish implementation resolves PUBLISH_REPO=="self" to $GITHUB_REPOSITORY, requires nonempty RESOLVED_VERSION, reads optional changelog, truncates at MAX_CHANGELOG_CHARS=60000, adding ---\n*Changelog truncated for issue body.*.
  • It exact-matches an open title with gh -R "$PUBLISH_REPO" issue list --json title,url,number,body/jq, preserves checked target states only within ### Targets through Checked targets will be skipped, edits if authorized, otherwise uses existing issue; creates otherwise.
• New local Craft compact-contract implementation (not yet committed/pushed)
  • Modified files as of Aug 28, 10:58–12:27:
    • action.yml
    • src/__tests__/action.test.ts
    • src/__tests__/config.test.ts
    • src/config.ts
    • src/index.ts
    • src/schemas/project_config.ts
    • docs/src/content/docs/targets/github.md
  • Added:
    • src/commands/workspace.ts — Manage release workspaces.
    • src/commands/workspace_cmds/list.ts — command ['list'], prints formatJson(getWorkspaceNames()), description List defined release workspaces as a JSON array.
    • src/commands/workspace_cmds/__tests__/list.test.ts.
  • Superseded/deleted intermediate naming:
    • src/commands/workspaces.ts
    • src/commands/__tests__/workspaces.test.ts.
  • src/index.ts continues to call setActiveWorkspace(extractWorkspaceSelection(argv)) before yargs command builders because builders can read config; it registers the new workspace command alongside prepare, publish, targets, config, artifacts, and changelog.
  • src/config.ts adds getWorkspaceNames():
    • reads root .craft.yml;
    • calls validateConfiguration(rawConfig);
    • calls checkMinimalConfigVersion(parsed) and centralized workspace min-version gating for nonempty workspace maps;
    • returns Object.keys(parsed.workspaces || {});
    • never applies active workspace selection, resolving the initial bug where normal config resolution required a workspace selection and made discovery unusable.
  • src/config.ts now centralizes checkWorkspacesMinVersion(config). Normal applyWorkspaceSelection() still:
    • errors if selection is given with no workspaces;
    • errors if workspaces exist but selection is absent;
    • requires minVersion >= WORKSPACES_MIN_VERSION;
    • resolves selected config only after passing gate.
  • src/schemas/project_config.ts:
    • workspace github.projectPath rejects with Workspace github.projectPath is not supported.;
    • nonempty workspaces with root GitHub project path rejects with Workspace configurations cannot use github.projectPath.;
    • special __proto__ workspace key now rejects at schema entry after adversarial review found Zod dropped it;
    • workspace key grammar is ASCII-safe compact grammar.
  • Workspace GitHub merge still permits workspace owner/repo overrides: shallow merge only produces a merged GitHub config if both owner and repo are present; otherwise it remains unset so getGlobalGitHubConfig() fallback applies.
  • action.yml:
    • passes PATH_INPUT: ${{ inputs.path }} and WORKSPACE: ${{ inputs.workspace }} into first validation step;
    • rejects a nonempty workspace with PATH_INPUT != '.' as The path and workspace inputs cannot be used together.;
    • rejects invalid compact names, Unicode control/format/line/paragraph separators, and non-ASCII locale-dependent cases before Git/Craft side effects;
    • uses a Node ASCII regex rather than Bash ^[A-Za-z0-9_.-]+$ to avoid en_US.utf8 range behavior;
    • Craft Prepare and Read Craft Targets retain inline --workspace=$WORKSPACE;
    • emits compact request title:

      publish: ${GITHUB_REPOSITORY}${SUBDIRECTORY}${WORKSPACE:+/$WORKSPACE}@${RESOLVED_VERSION}
      

      with SUBDIRECTORY=/${inputs.path} unless path is ..
  • src/__tests__/action.test.ts now has executable shell-path coverage for:
    • unsafe tab, bidi, U+2028, U+2029, non-ASCII cli-é, and cli-é under LC_ALL=en_US.utf8, all rejected before mock Git/Craft invocations;
    • safe empty and cli-v2 workspace inputs;
    • workspace plus packages/cli path rejected before side effects;
    • cli/v2 rejected as outside compact grammar;
    • option-looking workspace passed inline to both Craft invocations;
    • all Craft commands receive workspace input;
    • compact title generation: root publish: getsentry/toolkit@1.2.3; workspace publish: getsentry/toolkit/cli@1.2.3.
  • docs/src/content/docs/targets/github.md was updated Aug 28, 11:02–11:04 to replace stale “Coming soon” text with implemented release-workspace configuration and compact-title/root-only constraints.
• Craft verification
  • Focused verification progression:
    • Aug 28, 10:06: 3 files/49 tests passed.
    • 10:33: 3 files/52 tests passed.
    • 10:53: 3 files/53 tests passed after mock-environment correction.
    • 11:10: 3 files/54 tests passed after schema/docs changes.
    • 12:34: 3 files/57 tests passed after __proto__/locale fixes; typecheck passed.
  • Full source verification:
    • Aug 28, 10:56: 61 files, 1,146 passed / 1 skipped / 1,147 total; lint 0 errors/7 warnings; Prettier and node build.mjs passed.
    • 11:14: final-after-docs-edit source verification: 61 files, 1,147 passed / 1 skipped / 1,148 total; same lint/build result.
    • 12:39: post-adversarial-fix full source verification: 61 files, 1,150 passed / 1 skipped / 1,151 total, duration 29.31s; lint 0 errors/7 warnings; Prettier and build passed.
  • Existing warnings are _abortError in src/commands/publish.ts lines 482, 499, 527; _statusError line 515; _diffError line 521; _err in src/utils/git.ts lines 241, 249. Reported rule is @typescript-eslint/no-unused-vars; user specifically says they never used that rule.
  • Build lacks SENTRY_AUTH_TOKEN, so source-map upload is skipped. Existing non-failing diagnostics include release-state/cleanup cases, release-body truncation above GitHub 125,000 chars, floating-tag warning, local-ref fallback, and Vite SSR imported-binding warnings in src/targets/__tests__/symbolCollector.test.ts.
  • Initial docs build failed Aug 28, 12:39 because docs/node_modules was missing (astro: not found). Locked docs dependencies installed successfully 12:49 with pnpm 10.28.0: 370 packages, 369 reused, 0 downloaded. It warned esbuild@0.28.1 build script was ignored unless approved. astro build then passed: 29 pages / 29 HTML files, output docs/dist/, Pagefind and sitemap created; output included Entry docs → 404 was not found.
• Existing Craft publish mechanics
  • src/commands/publish.ts loads workspace-resolved config before checkout.
  • With argv.rev, it runs git name-rev --name-only --no-undefined <rev>, checks out resolved branch/revision, resolves HEAD, checks status/artifacts, expands targets, then derives state.
  • Without argv.rev, it checks out ${releaseBranchPrefix || DEFAULT_RELEASE_BRANCH_NAME}/${newVersion}; failure invokes findReleaseBranches and throws detailed ConfigurationError with remediation/match detail.
  • State remains getPublishStatePath(newVersion, getPublishStateGitHubConfig(...), process.cwd(), getActiveWorkspace()).
  • Invalid CRAFT_PUBLISH_STATE_GITHUB_REPO throws ConfigurationError("CRAFT_PUBLISH_STATE_GITHUB_REPO must be a GitHub owner/repository pair.").
  • No legacy repo-local .craft-publish-${version}.json read occurs.
• New local Publish parser/controller implementation (uncommitted)
  • package.json has local exact devDependency "peggy": "5.1.0". pnpm-lock.yaml is untracked and must not be committed; use Yarn Classic for lock updates.
  • Added scripts/generate-publish-issue-title-parser.js.
  • Added src/modules/publish-issue-title.peggy, canonical PEG:
    • PublishIssueTitle: "publish: ", optional "getsentry/", repository, optional syntactic path, optional legacy [workspace: <JsonString>], @, version, end-of-input.
    • Returns { repo, path: path || "", version, ...(workspace ? { workspace } : {}) }.
    • repository/path segment: [A-Za-z0-9_.-];
    • version: [A-Za-z0-9_.+-]+;
    • legacy JSON string grammar permits valid JSON escapes only and forbids unescaped U+0000–U+001F.
    • Comments explicitly say suffix semantics are resolved after CI-approved checkout.
  • Generated src/modules/publish-issue-title.js using:

    node_modules/.bin/peggy --format commonjs --output src/modules/publish-issue-title.js src/modules/publish-issue-title.peggy
    

    It is generated by Peggy 5.1.0, 861 lines, exporting StartRules, SyntaxError, and parse.
  • Modified src/modules/details-from-context.js to use parsePublishIssueTitle() rather than title regex. It retains:
    • Issue context is not defined;
    • Invalid publish issue title: '<title>';
    • controlled Invalid publish workspace JSON in title: '<title>';
    • legacy workspace nonempty/control/format/line/paragraph separator validation;
    • path normalization path = "." + parsedTitleDetails.path;
    • traversal rejection Invalid publish issue path: '${path}';
    • dry-run label, merge target, and checked-target extraction.
  • Added src/modules/publish-location.js and src/publish/resolve-location.js.
    • resolvePublishLocation({ path, workspace, workspaceNames }) returns explicit legacy workspace unchanged as { path, workspace }.
    • Validates every discovered workspace entry with isWorkspaceName: string, not __proto__, /^[A-Za-z0-9_.-]+$/; invalid lists throw Craft workspace discovery returned an invalid workspace list..
    • If no explicit workspace and path is exactly one ./<segment> whose exact spelling appears in discovered names, resolves to { path: ".", workspace: <segment> }; otherwise returns { path }.
    • resolve-location.js reads JSON PUBLISH_ARGS; reads CRAFT_WORKSPACE_NAMES, default "[]"; rejects non-array discovery JSON with the same error; outputs result.
  • Added src/modules/release-revision.js, src/publish/resolve-release-revision.js, tests.
    • CHECK_RUNS_LINK:

      /^- \[View check runs\]\(https:\/\/github\.com\/getsentry\/(?<repo>[A-Za-z0-9_.-]+)\/commit\/(?<revision>[0-9a-f]{40})\/checks\/?\)$/m
      

    • getReleaseRevision({ issueBody, repo }) requires exact matching repository and throws: Expected a View check runs link for getsentry/${repo} in the publish issue body.
    • Resolver reads PUBLISH_ARGS and PUBLISH_ISSUE_BODY, outputs revision.
• Local Publish workflow modifications as of Aug 29, 04:39
  • .github/workflows/publish.yml now:
    1. parses inputs with node .__publish__/src/publish/inputs.js;
    2. posts start details only after inputs success;
    3. runs resolve-release-revision.js with parsed args and issue body;
    4. obtains Release Bot token;
    5. checks out getsentry/<parsed repo> to __repo__ at ${{ steps.release-revision.outputs.revision }}, fetch-depth: 0;
    6. if __repo__/.craft.yml exists, Docker-runs getsentry/craft:2.31.0 workspace list with checkout mounted at /github/workspace/__repo__; otherwise passes [];
    7. runs resolve-location.js;
    8. uses resolved repo/path/workspace only for state creation and publishing;
    9. runs docker://getsentry/craft:2.31.0, changes to __repo__/<resolved path>, and executes craft publish <version> --rev <resolved CI SHA>;
    10. uses secure resolved state path for cancellation/failure update-issue.js, and posts cancellation/failure/success through post-result.js.
  • Set targets preserves state parity:
    • canonical container CWD via realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH";
    • rejects escaping CWD;
    • first 12 SHA-1 chars of CWD;
    • lowercases/sanitizes owner/repo/version with [a-z0-9._-];
    • Base64URL workspace prefix with omitted = padding;
    • external $GITHUB_WORKSPACE/.craft-state/craft/publish-state-...json;
    • target JSON generation: [{($source[]): true }] | add | {"published": (. // {}) }.
  • Craft publish environment has XDG_STATE_HOME=/github/workspace/.craft-state, resolved workspace, and CRAFT_PUBLISH_STATE_GITHUB_REPO=getsentry/<parsed repo> to ensure state identity follows title checkout identity, not workspace GitHub override.
  • Need verify YAML syntax, action Docker mount/path semantics, old branch-selection removal, workflow extraction tests, and end-to-end behavior before declaring this complete.
• Old Publish controller behavior being replaced
  • Existing pushed regex:

    /^publish: (?:getsentry\/)?(?<repo>[A-Za-z0-9_.-]+)(?<path>\/[\w./-]+)?(?: \[workspace: (?<workspace>"(?:[^"\\]|\\.)*")\] )?@(?<version>[\w.+-]+)$/
    

  • Current old workflow parsed title and built state before checkout; chose default or protected allowlisted branch: sentry-migr8/tmp-merge-target; sentry-javascript/v10, v9, v8, v7, master; sentry-python/alpha; sentry-wizard/1.x.
  • Old state fixtures remain mandatory:
    • root /github/workspace/__repo__ → c232c383e26f, expected .craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json;
    • /github/workspace/__repo__/cli → 21cf7beaeda4, expected .craft-state/craft/publish-state-getsentry-toolkit-21cf7beaeda4-workspace-Y2xp-1.2.3.json.
  • src/modules/__tests__/publish-workflow.js extracts/runs actual Set targets shell between the step and uses: docker://getsentry/craft:latest; update this extraction boundary and tests for pinned image/post-checkout resolved location.
• CI poller facts relevant to implementation
  • .github/workflows/ci-poller.yml: cron */5 * * * *; workflow_dispatch with optional attempt default "0"; ci-status-poller concurrency; 60 attempts; up to 200 open ci-pending + accepted issues.
  • Parses repo/version from title while intentionally excluding monorepo suffix; extracts SHA from https://github.com/{owner}/{repo}/commit/{SHA}/checks/ issue-body link.
  • Obtains first check suite head_branch, resolves branch head where possible, updates every issue-body SHA occurrence when branch moved; fallback remains original linked SHA.
  • Retrieves combined commit status and paginated check runs. success, neutral, skipped count as passing; no statuses/checks means not started. Failures remove pending/accepted, add ci-failed; retry requires accepted.
  • Pass removes ci-pending, adds ci-ready, comments CI checks passed for ${repo}@${version}. Publishing is starting now.
• Verification history of pushed JSON implementation
  • Craft focused Aug 26, 13:35: 45 tests; full 13:49: 1,138 passed / 1 skipped / 1,139 total; build/Prettier passed.
  • Publish full after b658ffa Aug 27, 08:57: 26 tests passed; lint 09:07, Prettier/diff-check 09:21 passed.
  • Original JSON title adversarial review ses_fc1a82a13ffeaFWq7hymm7uL2z returned MERGE Aug 26, 14:05.
  • Compact-design review Aug 27, 14:31 returned DO-NOT-MERGE. Craft compact-contract review Aug 28, 12:03 returned DO-NOT-MERGE over __proto__ and locale validation; both findings were fixed with regressions and full verification.
• Repository constraints
  • Publish: pure CommonJS JS, Node 24.0.0, Yarn Classic 1.22.22 via Volta; source CommonJS, tests ESM Vitest; files kebab-case, code camelCase, constants UPPER_SNAKE_CASE; double quotes/semicolons; mock before module import; descriptive guard-clause errors; external state files must use fs.existsSync(CRAFT_STATE_FILE_PATH) before reading.
  • Publish scripts: yarn install, yarn test, focused yarn test <file>, yarn test -t <pattern>, yarn lint, yarn prettier.
  • Craft: @sentry/craft 2.31.0-dev.0, TypeScript/Node, pnpm frozen lockfile. Docker build/runtime Node 24.18.0.
  • Craft Docker runtime installs release tooling and sets CRAFT_BUILD_SHA=$SOURCE_COMMIT; image workflow pushes ghcr.io/getsentry/craft:${GITHUB_SHA} and latest on non-PR master/release/test pushes.
• Administrative details
  • Four malformed reviewer replies caused by Markdown backticks were deleted; corrected replies/descriptions posted Aug 26, 14:26–14:27.
  • Staging checks found absent .lore.md on Aug 26, 14:15 and Aug 27, 09:14, no index change.
  • Dependabot reported two high-severity Craft-default-branch vulnerabilities Aug 25, 09:31 and 09:44.

Session Timeline

• Aug 25, 2026, 09:31–20:59
  • Fixed/merged Craft workspace schema/state hardening #848; mapped cross-repository propagation; built original JSON workspace-title contract; security reviews established XDG state, Unicode validation, inline argument safety, and checkout-state identity.
• Aug 26, 2026, 12:19–14:28
  • Completed original Action/controller hardening and executable tests; pushed Publish 33de3f1 and Craft 6dae341; opened Publish #9339 and dependent draft Craft #872.
• Aug 27, 2026, 08:36–23:59
  • Fixed invalid JSON escape handling in b658ffa; confirmed PRs green but review-blocked.
  • Approved compact redesign; selected Peggy 5.1.0; rejected body metadata; identified legacy collision risk and unsafe pre-checkout controller ordering.
  • Established workspace-first exact discovery at checked release revision, missing-root path-only behavior, root-only/no-projectPath constraint, and CI-pinned state/publish requirements.
  • Local Peggy package installation using pnpm left Publish package.json modified and pnpm-lock.yaml untracked; no complete parser implementation yet at that point.
• Aug 28, 2026, 00:03–09:36
  • Mapped parser, CI poller, state script, Action harness, Craft schema/checkout mechanics, and command patterns; confirmed Craft discovery/safeguards first, then Publish post-checkout resolver.
• Aug 28, 09:42–10:45
  • Inspected original Craft request behavior and began implementing compact Action/config guards.
  • Added then renamed discovery surface to craft workspace list; corrected raw discovery so it bypasses active workspace selection.
  • Added focused Action/config/workspace-list tests; initial safe Unicode test failed because approved compact grammar is ASCII-only, then updated expectation.
• Aug 28, 10:45–11:14
  • Added executable compact request-title regression; corrected a mock-environment defect after title capture initially remained empty.
  • Focused suite reached 53 then 54 tests. Full Craft verification passed at 1,146 then 1,147 tests plus one skipped.
  • Updated GitHub target docs from “Coming soon” to implemented constraints.
• Aug 28, 12:03–12:49
  • Independent Craft review found two DO-NOT-MERGE blockers: Zod-droppable YAML __proto__, and locale-sensitive Bash ASCII matching accepting é.
  • Rejected __proto__ schema keys and replaced Bash regex with Node ASCII validation; added actual YAML and en_US.utf8 Action regressions.
  • Focused 57-test suite and full 1,150-pass/1-skip suite passed. Docs initially lacked dependencies, then locked pnpm install and Astro build passed.
• Aug 28, 17:56–20:57
  • Resumed Publish tracing. Reconfirmed poller/ci-ready/manual dispatch constraints and observed controller’s old pre-checkout state logic.
  • Investigated Craft image publication deadlock and rejected latest fallback.
  • Created Peggy grammar/generated parser, initial location resolver and tests; decided to pin immutable Craft 2.31.0 and use checkout-time discovery.
• Aug 28, 22:26–23:01
  • Added parser generation script; confirmed PEG grammar and generated parser shape.
  • Defined fail-closed missing-config/discovery boundary; added release-revision implementation plan based on exact check-runs link.
  • Reaffirmed original Mustache lookup restoration requirement.
• Aug 29, 00:03–01:42
  • Added release-revision extractor/resolver/tests and wired local workflow direction: exact issue link SHA checkout, then discovery/location/state/publish.
  • Broad workflow patch failed 01:30 due to stale expected context; switched to narrow edits.
  • Reconfirmed old workflow branch selection/state ordering and Craft --rev checkout semantics.
• Aug 29, 01:45–02:13
  • Tried Packages API; failed due to absent read:packages.
  • Direct manifest investigation established ghcr.io/getsentry/craft:2.31.0 is not published. Immutable image availability is now an explicit deployment blocker.
• Aug 29, 04:23–04:46
  • Re-inspected Action mock harness and verified compact title/action guards.
  • Confirmed current local Publish workflow now resolves check-runs revision, checks out exact SHA, discovers workspaces only after checkout with pinned 2.31.0, resolves canonical location, uses resolved state/CWD, and invokes Craft with --rev.
  • Next work remains verification/regressions/adversarial review, deployment-image resolution, commit/push, and mandatory PR monitoring.