Dashboard › publish › Distillation
b5de49eb-9beb-4709-9484-8a71c1b7f65b["lore_tm_v1__PI63VO-7mMjX7R9NHcqIKm986gSA5bIX_IIBimt_JM","lore_tm_v1_LSW8oUX-poZBQ0aKwA98yhPmRXDUELwBjvrTXf4E03o","lore_tm_v1_7810X3ALqyxOeKeZvIyZMWjToCkxAcUesHIapHXKrBw","lore_tm_v1_rmSKmW6BjPhMCyTAiOnw-b_H2nmcADLf2y5-YaGzaCA","lore_tm_v1_DlY4UytgqHxogkLKeZTkjci9yhzpyBFs9Apjxi-HKVg","lore_tm_v1_X1VDlPPkIi08l2mFXdLV8reP91hG6Fm4RV_rFaOU_dI"]
Date: Aug 29, 2026
.github/workflows/ci-poller.yml:361-370 handles failed commit-status checks by swapping ci-pending to ci-failed, removing accepted, and posting a comment identifying failed contexts, target URLs when available, ${repo}@${version}, short SHA ${sha:0:8}, check-runs URL, and retry instruction to re-add accepted..github/workflows/ci-poller.yml:374-415 always checks for up to 1 open issue bearing both ci-pending and accepted using github.token; it then best-effort creates a CI Poller App token using vars.CI_POLLER_APP_CLIENT_ID and secrets.CI_POLLER_APP_PRIVATE_KEY, and, if successful, syncs repository variable CI_POLLER_HAS_PENDING to "false" when none remain or "true" otherwise..github/workflows/ci-poller.yml:417-440 self-dispatches ci-poller.yml through gh workflow run using steps.token.outputs.token when pending issues remain; ATTEMPT derives from github.event.inputs.attempt || '0', increments each run, and stops self-dispatch at attempt 60, relying on cron fallback. Comments state expected recheck latency is approximately 30–60 seconds, cron */5 can drift to 30–40 minutes, and concurrency allows 1 running plus 1 queued workflow.src/modules/approval-attestation.js:1-80 serializes approval and CI-ready attestations as base64url-encoded JSON inside HTML comments: <!-- publish-approval ${payload} --> and <!-- publish-ci-ready ${payload} -->. Approval payload fields are actor, stringified eventId, and title; CI-ready payload fields are acceptedActor, stringified acceptedEventId, ciReadyActor, and title. Parsing returns null for missing/malformed/nonconforming data.src/modules/approval-attestation.js:83-128 normalizes leading zeros before numeric-string issue-event ID comparison, throws Error("Invalid issue event ID") for nonnumeric IDs, and identifies a current label event as the largest valid event ID among labeled events with the specified label and an actor login. currentAcceptedEvent() selects accepted; currentCiReadyEvent() selects ci-ready.src/modules/approval-attestation.js:130-167 treats an approval or CI-ready attestation as valid only if the comment author login equals the supplied attestationAuthor and the decoded fields exactly bind to the selected accepted/CI-ready events and current issue title.src/modules/approval-authorizer.js:1-35 authorizes manual approval only for GitHub collaborator roles write, maintain, or admin on parsed target repository getsentry/${title.repo}. It special-cases AUTO_APPROVER = "getsantry[bot]": authorized only when autoApprovedRepositories includes ${repository}${title.path || ""}; all other auto-approver cases are denied. Invalid publish titles are denied with repository: null.src/publish/authorize-approval.js:8-15 loads auto-approval allowlist entries from checked-out auto-approve-repos.txt, splitting on line endings and excluding empty lines.src/publish/authorize-approval.js:17-77 calls GitHub REST API with Authorization: Bearer ${process.env.APPROVAL_TOKEN}, Accept: application/vnd.github+json, and API version 2026-03-10; it URL-encodes collaborator permission API path parameters, throws on failed permission/issue/event responses, and paginates issue events at per_page=100 until a partial page.src/publish/authorize-approval.js:80-140 requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; it authorizes APPROVAL_ACTOR against APPROVAL_ISSUE_TITLE, then concurrently rereads the issue title and all events. It writes authorized=false if the actor is unauthorized, the reread title differs, no current accepted event exists, or the current accepted-event actor differs from APPROVAL_ACTOR; otherwise it writes authorized=true plus an approval_attestation bound to that event and title.src/publish/current-accepted-event.js:4-38 retrieves all issue-event pages through getAllPages({ repository, issueNumber, resource: "events" }), derives the current accepted event, throws Error("The issue has no current accepted label event") when absent, and outputs the event as JSON. It requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY.src/publish/record-ci-ready-attestation.js:12-28 authenticates the approval token identity via GET /user; it throws on a non-success response or a missing/non-string login.src/publish/record-ci-ready-attestation.js:30-58 concurrently fetches issue labels/title, all issue events, and authenticated token login before creating a CI-ready attestation. It throws Error("The approval changed before CI could be marked ready") if the title differs from issueTitle, accepted is absent, no accepted event is found, or the current accepted actor/event ID differs from supplied expectedAcceptedEvent; otherwise the attestation binds accepted event, authenticated CI-ready actor, and title.src/publish/record-ci-ready-attestation.js:60-94 requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and APPROVAL_ISSUE_TITLE. It supplies expectedAcceptedEvent only when both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID exist, and appends ci_ready_attestation=${attestation} to GITHUB_OUTPUT.