Dashboard › publish › Distillation
b6ae6813-34d6-4b78-84af-bc42a6ff4afe["lore_tm_v1_0oEwR8Ri82-0-NjjOyN4ZkG-N5-8ncYkM-ZFg7UGCIA","lore_tm_v1_wbQ2E3Kzf2gvt2tV3IZe6dztW6wiEOnWS3WejMQaplw","lore_tm_v1_oJV4ehbRn9Cu0D9WgqhLAA1_0YCyYxw2uUhL9_h7z_0","lore_tm_v1_yzmyX_ITi4iS1juThKFEM8kAbRZhIAHbQ7h1V1fh-lQ","lore_tm_v1_IF3FjBPiX2hm8rinCxMfyRMgQr51V_NfVfNhHYQqLd8","lore_tm_v1_5T1SlR3_qv9VqEHd6D-f1mBpJBBmFkL-Nl0qew0TQ7k","lore_tm_v1_XTEXt7sCwwNZcZVAHgmL8AfgOSfE9u4nB_U5TYgfnNU","lore_tm_v1_xXfkT3o6azbjy6QJMdQLHzW-O-dTV8w2b67h5-XhqV4"]
src/modules/approval-attestation.js defines approval comment formats using prefixes <!-- publish-approval , <!-- publish-auto-approval , and <!-- publish-ci-ready with suffix -->; createAttestation() serializes JSON as base64url.requestDigest({ body, labels, title }) in src/modules/approval-attestation.js rejects non-string body or non-array labels with Invalid publish request, then computes a SHA-256 hex digest over JSON.stringify({ body, dryRun, title }), where dryRun is true when any label has name === "dry-run".createApprovalAttestation() records actor, stringified eventId, requestDigest, and title; createAutoApprovalAttestation() records autoApprover, requestDigest, and title; createCiReadyAttestation() records acceptedActor, stringified acceptedEventId, ciReadyActor, requestDigest, and title.parseAttestation() locates the first matching prefix/suffix, decodes base64url, parses JSON, and returns null for missing or malformed data. parseApprovalAttestation(), parseAutoApprovalAttestation(), and parseCiReadyAttestation() each require all expected fields to be strings.compareEventIds() strips leading zeroes, validates decimal-only event IDs, compares by normalized length and then locale order, and throws Invalid issue event ID for invalid values. currentLabeledEvent() filters valid matching labeled events and selects the greatest event ID; malformed IDs or no candidates return null. currentAcceptedEvent() and currentCiReadyEvent() specialize this for accepted and ci-ready.hasApprovalAttestation(), hasAutoApprovalAttestation(), and hasCiReadyAttestation() only accept comments authored by attestationAuthor and require attestation fields—including the recomputed live requestDigest and exact issue.title—to match the relevant actor/event data.src/publish/resolve-ci-poller-input.js reads the issue body from PUBLISH_ISSUE_BODY_FILE via readFileSync(..., "utf8") when set, otherwise from PUBLISH_ISSUE_BODY or ""; it writes JSON from getCiPollerInput({ issueBody, title: PUBLISH_TITLE || "", revision: PUBLISH_REVISION || "" }) to stdout..github/workflows/ci-poller.yml must pass the canonical resolver’s digest into every approval validation. Both were expected to fail before production changes.src/publish/__tests__/validate-approval-attestation.js cover: accepting the current accepted event with a trusted github-actions[bot] attestation; rejecting after title change, body change, accepted removal, issue closure, or accepted re-addition; rejecting a later attested approval when expectedAcceptedEvent identifies an earlier event; and requiring CI-ready proof tied to the current approval and CI-ready label actor.dry-run label state as well as title and body because requestDigest() incorporates all three.src/publish/record-ci-ready-attestation.js function recordCiReadyAttestation() concurrently retrieves the live issue, all events, and authenticated login; it resolves currentAcceptedEvent(events) and throws The approval changed before CI could be marked ready unless the issue is open, title exactly matches issueTitle, the accepted label is present, a current accepted event exists, and any supplied expectedAcceptedEvent.actor and .eventId match. On success it returns createCiReadyAttestation({ acceptedEvent, ciReadyActor, issue }).getAuthenticatedLogin() in src/publish/record-ci-ready-attestation.js calls getGitHubResponse("user"), throws with the returned HTTP status when unsuccessful, requires a string login, and otherwise returns that login.record-ci-ready-attestation.js CLI requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and APPROVAL_ISSUE_TITLE; it optionally constructs expectedAcceptedEvent from both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID, retrieves paginated events through getAllPages(), and appends ci_ready_attestation=${attestation}\n to GITHUB_OUTPUT. Top-level failure logs the error and sets process.exitCode = 1.