Dashboard › publish › Distillation
b8d1492e-3f8d-4852-b944-b04ad16c87af["lore_tm_v1_fKyK6tsK9n6f9viDWqwOxAjNAPsnvrrDqaYaTj71pGg","lore_tm_v1_MaYvtGwjFx1FxKR7E2T-_oLiXRcbSL2rV9kBuTA2fII","lore_tm_v1_hGysF26YyFXgCba9DNzLpba7xXSJU2zvnN40uxprgXU","lore_tm_v1_WsaPjOJj8oVDYcbnql_-ob4BdetGGCdn-sg1yxVlbzw","lore_tm_v1_mEQrtR5hR6ltEBpqPExa73hBCdcYas00QYLkc5bsKNg","lore_tm_v1__Wq3AlBsCNNBneGar9Z2IHgCJMA_tUTMq-uZvY3y_Zw","lore_tm_v1_uTgL-b2V5i2YmeLAhzdciF5PRnz9sxnR9hknVhzi4IE","lore_tm_v1_reNvVQxkTq61Wb0hB9DsCpqVcwi25kp_e01m-nXks0M","lore_tm_v1_H1ETxy9eFo0gyLhF1lbdqBksvjJO_xSiP5lpUTJzPs0","lore_tm_v1_F_vPjxdK8U5Jy16Kf4snBSTpwIKy5rioYYJeq2r4yxo","lore_tm_v1_gS_Ea0cFNsLX04YSFAux6eIZlcowdtdKqnJoS7_hpLA","lore_tm_v1_WusCQQAok_oNWABBoEmUBZBFTXDhtPZvmBLzNsklCcw"]
.github/workflows/publish.yml lines 67, 91, 207, and 340; .github/workflows/ci-poller.yml lines 163, 293, 315, and 360; and .github/workflows/auto-approve.yml line 35. Related implementation and test references include src/publish/record-auto-approval-attestation.js, src/publish/current-accepted-event.js, src/publish/record-ci-ready-attestation.js, and their corresponding suites.request-digest-from-event.js entry point and make EXPECTED_REQUEST_DIGEST mandatory in all 4 attestation executables, preventing workflow or future callers from silently falling back to live-only validation.src/publish/__tests__/request-digest-from-event.js and modified src/publish/__tests__/authorize-approval.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/auto-approval-workflow.js, and src/publish/__tests__/publish-workflow.js.requestDigestFromEvent({ issue }) must equal requestDigest(issue) for a valid event and reject malformed event snapshots; authorization and automated proof creation must reject a different live request even when identity and labels remain valid; both workflows must provide the event digest before approval is minted or consumed.yarn vitest run src/publish/__tests__/request-digest-from-event.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/record-auto-approval-attestation.js src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/publish-workflow.js --printConsoleTrace reproduced all intended failures under Vitest v4.1.0.src/publish/__tests__/auto-approval-workflow.js had 3 tests with 1 failure (records a request-bound attestation before adding accepted); src/publish/__tests__/record-auto-approval-attestation.js had 3 tests with 1 failure (rejects a valid live request for a different opened-event snapshot); src/publish/__tests__/authorize-approval.js had 8 tests with 1 failure (rejects a valid live approval for a different label-event snapshot); src/publish/__tests__/publish-workflow.js had 3 tests with 1 failure (binds approval and publication to the triggering issue snapshot); src/publish/__tests__/request-digest-from-event.js reported 0 tests and a failed suite because the helper was absent.publish.yml comment, the labeled event would not occur and publish.yml would never fire.ci-ready; the publish job is intended not to race waiting-for-ci on the same event.src/publish/record-ci-ready-attestation.js line 51 only compared requestDigest(issue) when expectedRequestDigest was truthy, while src/publish/validate-approval-attestation.js line 76 allowed validation when expectedRequestDigest was absent or matched. The mandatory contract is intended to remove both live-only fallback paths.src/modules/approval-attestation.js function requestDigest({ body, labels, title }), which throws "Invalid publish request" for invalid input; src/modules/ci-poller-input.js line 39; src/publish/__tests__/request-digest-from-event.js line 14; and existing approval, CI-ready, poller-input, and attestation tests.