Dashboard › publish › Distillation
b022c591-485d-436c-8dc8-26c4fe679efd["lore_tm_v1_00nWHTTiUTMQ7DEmgWLUxVKVyN1KFQ-Qc422YRjM5l4","lore_tm_v1_xeiMYSQy_5zhD3wjk3GRkQqPQE_8BDoza7xg-60rDlc","lore_tm_v1_SfgecMb-zyRH2T8KQ-ZhHTTUoLiC8TtIqpxMy_4vGVM","lore_tm_v1_RE6U7-MphEr6gXyE7M6Czf4FQHv1qTH8sM7DbDEEY4g"]
src/publish/update-issue.js parses PUBLISH_ARGS only when present, catches malformed JSON and skips target restoration, then always calls updateIssue() so accepted is removed; cleanup must remain runnable after every failure or cancellation stage.ci-ready label after CI passes, even when the label is already present; no idempotence check may skip relabeling because re-adding emits a fresh label event that resolves the waiting-for-CI race and starts publishing for accepted releases.workflow_dispatch where operators need manual recovery.”main-only environment and a successful default-branch workflow_run handoff over direct secret-bearing dispatch, because a dispatcher selects workflow YAML before jobs, guards, or checkout execute.ci-poller.yml, rather than placeholders or numeric IDs.github-actions[bot] proof before sentry-internal-app[bot] adds accepted; generic app identity is insufficient.accepted event is replaced must never reach ci-ready; the captured event and request digest must be validated before CI, after CI, while recording CI-ready proof, immediately before adding ci-ready, and before Craft.actions/checkout, actions/setup-node, actions/cache, and actions/create-github-app-token—be pinned to its complete reviewed 40-character commit SHA; mutable version tags such as actions/checkout@v6 were rejected because privileged workflows expose Internal App and release tokens.production environment, arbitrary dispatched refs never receive repository secrets, manual dispatch use an unprivileged relay, and privileged processing require successful default-branch execution.ci-ready.accepted, moving an issue to ci-ready, or publishing, workflows validate the live canonical issue, current label events, actor provenance, and matching attestations, rejecting renamed, closed, changed, re-approved, self-approved, or unverifiable requests.write, maintain, or admin level and must not self-approve.auto-approve-repos.txt and a trusted attestation bound to the live request.src/modules/details-from-context.js adds PUBLISH_TITLE_REGEX = /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/ and parsePublishTitle(title), which returns the regex named groups or null; both are exported.src/libs/github.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js, including spaced destructuring, double-quoted imports, multiline formatting, and a final newline in src/modules/post-workflow-details.js.package.json identifies private package publish version 0.0.1, described as “Approval-based publishing system for Sentry,” with repository git@github.com:getsentry/publish.git, author Sentry Open Source <oss@sentry.io>, and license Apache-2.0.package.json pins Volta to Node 24.0.0 and Yarn 1.22.22, resolves undici to ^6.23.0, and defines scripts: test → vitest run, test:watch → vitest, lint → eslint src .github --ignore-pattern '!.github', and prettier → prettier --write src.package.json dev dependencies are eslint ^8.9.0, eslint-config-prettier ^8.3.0, eslint-plugin-yml ^0.13.0, prettier ^2.2.1, and vitest ^4.1.0; runtime dependencies are @actions/core ^2.0.0, @actions/github ^7.0.0, and @sentry/node ^10.0.0.AGENTS.md adds a lore-managed “Long-term Knowledge” section linking .lore.md in the project root and identifying lore as https://github.com/BYK/loreai.README.md documents that secret-bearing jobs use the protected production environment, which permits only main deployments and disallows administrator bypass.README.md documents that SENTRY_INTERNAL_APP_PRIVATE_KEY and SENTRY_RELEASE_BOT_PRIVATE_KEY are organization-level secrets whose availability to other repositories is an organization-wide boundary that Security must manage separately.