Dashboard › publish › Distillation
b5c122a6-7227-4504-80d9-4cfd73628d23["lore_tm_v1_dSIJkeF_G1kANtS0r-Xy2INFREQ23EYK1ROHyuGzAFs"]
.github/workflows/ci-poller-dispatch.yml is named Run CI Status Poller, is triggered only by workflow_dispatch:, declares permissions: {}, and has one dispatch job using environment: production, runs-on: ubuntu-latest, and a single no-op step run: ":"..github/workflows/ci-poller-dispatch.yml; the production protected environment permits deployments only from main and enforces that an arbitrary dispatched ref cannot add protected environment secrets.src/modules/approval-attestation.js defines attestation wrappers with prefixes <!-- publish-approval , <!-- publish-auto-approval , and <!-- publish-ci-ready and suffix -->; createAttestation(prefix, value) serializes JSON using base64url.requestDigest({ body, labels, title }) in src/modules/approval-attestation.js rejects unless body is a string and labels is an array, using Error("Invalid publish request"); it computes a hexadecimal SHA-256 digest over JSON containing body, dryRun derived from a dry-run label, and title.createApprovalAttestation({ actor, eventId, issue }) records actor, stringified eventId, requestDigest, and title; createAutoApprovalAttestation({ autoApprover, issue }) records autoApprover, requestDigest, and title; createCiReadyAttestation({ acceptedEvent, ciReadyActor, issue }) records acceptedActor, stringified acceptedEventId, ciReadyActor, requestDigest, and title.parseAttestation(body, prefix) in src/modules/approval-attestation.js finds the first matching prefix and suffix, decodes base64url, parses JSON, and returns null for missing delimiters or decoding/parsing failures. parseApprovalAttestation(), parseAutoApprovalAttestation(), and parseCiReadyAttestation() additionally require all fields in their respective schemas to be strings or return null.compareEventIds(left, right) in src/modules/approval-attestation.js stringifies IDs, removes leading zeroes while preserving zero as "0", throws Error("Invalid issue event ID") for non-decimal values, and compares arbitrary-length numeric IDs first by normalized length and then via localeCompare().currentLabeledEvent(events, labelName) filters for labeled events matching label.name, requiring a string/number id and actor.login; it selects the numerically greatest ID using compareEventIds() and returns { actor, eventId: String(id) }, or null if no valid event exists or ID comparison fails. currentAcceptedEvent() targets accepted; currentCiReadyEvent() targets ci-ready.hasApprovalAttestation() accepts only comments authored exactly by attestationAuthor and requires parsed actor, eventId, request digest, and title to match the current event and issue. hasAutoApprovalAttestation() similarly requires matching autoApprover, digest, and title. hasCiReadyAttestation() requires matching accepted actor/event ID, CI-ready actor, digest, and title.src/modules/approval-authorizer.js defines allowed collaborator roles as write, maintain, and admin; AUTO_APPROVAL_LABELER is sentry-internal-app[bot], and AUTO_APPROVERS contains getsantry[bot] and sentry-release-bot[bot].isAutoApprovedRepository({ actor, autoApprovedRepositories, issueTitle }) returns true only when actor is in AUTO_APPROVERS, parsePublishTitle(issueTitle) succeeds, and autoApprovedRepositories contains the exact path getsentry/${title.repo}${title.path || ""}.authorizeApproval({ actor, issueTitle, getPermission }) returns { authorized: false, repository: null } for an invalid publish title. For a valid title it resolves the repository as getsentry/${title.repo}, denies both AUTO_APPROVERS and AUTO_APPROVAL_LABELER without a permission lookup, and otherwise authorizes only GitHub role_name values in write, maintain, or admin after calling getPermission({ owner: "getsentry", repository: title.repo, username: actor }).src/publish/authorize-approval.js loads auto-approved repository entries from auto-approve-repos.txt as a newline-split, nonempty Set via getAutoApprovedRepositories().getGitHubResponse(path) in src/publish/authorize-approval.js requests https://api.github.com/${path} with Accept: application/vnd.github+json, Authorization: Bearer ${process.env.APPROVAL_TOKEN}, and X-GitHub-Api-Version: 2026-03-10.getPermission() in src/publish/authorize-approval.js calls repos/{owner}/{repository}/collaborators/{username}/permission with each path component URL-encoded and throws Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ${response.status} on a non-OK response. getIssue() similarly retrieves repos/${repository}/issues/${issueNumber} and throws Could not retrieve issue #${issueNumber}: GitHub returned ${response.status} on failure.getIssueEvents() and getIssueComments() in src/publish/authorize-approval.js paginate GitHub issue resources with per_page=100&page=${page}, accumulating records until a page has fewer than 100 entries; their non-OK errors respectively mention failure to retrieve events or comments for the issue number and include the HTTP status.main() in src/publish/authorize-approval.js requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; each missing value raises No "<name>" environment variable found. It reads APPROVAL_ACTOR and APPROVAL_ISSUE_TITLE without an explicit presence check.APPROVAL_ACTOR === "sentry-internal-app[bot]", src/publish/authorize-approval.js concurrently loads the live issue, all issue events, and all comments. Authorization requires: an open issue; unchanged title; string requester in AUTO_APPROVERS; requester/title path accepted by isAutoApprovedRepository(); the current accepted event authored by sentry-internal-app[bot]; and a matching auto-approval attestation authored by github-actions[bot].sentry-internal-app[bot], src/publish/authorize-approval.js delegates authorization to authorizeApproval({ actor, issueTitle, getPermission, autoApprovedRepositories }); unauthorized outcomes append authorized=false\n to GITHUB_OUTPUT.src/publish/authorize-approval.js fetches the live issue and events if not already loaded, then rejects if the issue is not open, its title differs from APPROVAL_ISSUE_TITLE, the requester is not a string, a non-auto-labeler actor case-insensitively equals the requester, no current accepted event exists, or that event’s actor differs from the approving actor. A successful result creates createApprovalAttestation({ actor: event.actor, eventId: event.eventId, issue }) and appends authorized=true\napproval_attestation=${attestation}\n to GITHUB_OUTPUT.src/publish/authorize-approval.js catches errors, writes them through console.error(error), and sets process.exitCode = 1; exports are getAutoApprovedRepositories, getGitHubResponse, getIssue, getIssueComments, getIssueEvents, getPermission, and main.src/publish/current-accepted-event.js defines getCurrentAcceptedEvent({ getIssueEvents, issueNumber, repository }); it obtains the latest accepted event via currentAcceptedEvent() and throws Error("The issue has no current accepted label event") if none exists.main() in src/publish/current-accepted-event.js requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY, retrieves all events through getAllPages(), and writes the selected event as JSON to stdout. Direct-execution errors are logged and set process.exitCode = 1; exports are { getCurrentAcceptedEvent, main }.src/publish/record-ci-ready-attestation.js defines getAuthenticatedLogin(), which requests GitHub resource user, throws Could not retrieve the authenticated user: GitHub returned ${response.status} on a non-OK response, throws GitHub returned no authenticated user login if login is not a string, and otherwise returns the login.recordCiReadyAttestation() concurrently retrieves the live issue, issue events, and authenticated login. It requires an open issue with unchanged title, a current accepted label, a current accepted event, and—when supplied—an exact actor and event-ID match with expectedAcceptedEvent; otherwise it throws Error("The approval changed before CI could be marked ready"). Success returns createCiReadyAttestation({ acceptedEvent, ciReadyActor, issue }).main() in src/publish/record-ci-ready-attestation.js requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and APPROVAL_ISSUE_TITLE. It supplies expectedAcceptedEvent only when both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID exist, retrieves all issue events through getAllPages(), and appends ci_ready_attestation=${attestation}\n to GITHUB_OUTPUT.src/publish/record-ci-ready-attestation.js logs errors and sets process.exitCode = 1; exports are getAuthenticatedLogin, main, and recordCiReadyAttestation.src/publish/validate-approval-attestation.js defines GitHub API access with the same Accept, bearer APPROVAL_TOKEN, and X-GitHub-Api-Version: 2026-03-10 headers. getIssue() retrieves the issue, while getAllPages({ repository, issueNumber, resource }) paginates any issue resource in 100-record pages until a page has fewer than 100 records; non-OK responses raise resource-specific errors containing the issue number and status.validateApprovalAttestation() concurrently retrieves the issue, all events, and all comments. Basic approval validity requires: open issue; exact title match; current accepted label; non-null latest accepted event; optional exact match to expectedAcceptedEvent; and a matching approval attestation from attestationAuthor.requireCiReadyAttestation is false, validateApprovalAttestation() returns the basic approval result. When true, it additionally requires a non-null latest ci-ready event, a current ci-ready label, and a matching CI-ready attestation binding the current accepted event, current CI-ready actor, issue digest, and title.main() in src/publish/validate-approval-attestation.js requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and APPROVAL_ATTESTATION_AUTHOR; it constructs an expected accepted event only if both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID are present, and enables CI-ready validation only when REQUIRE_CI_READY_ATTESTATION === "true".src/publish/validate-approval-attestation.js throws Error("The current accepted label has no matching approval attestation"). Direct execution logs errors and sets process.exitCode = 1; exports are getAllPages, getGitHubResponse, getIssue, main, and validateApprovalAttestation.