Distillation

Date: Aug 27, 2026

• 🟡 (14:09) src/utils/publishState.ts moves resumable craft publish completed-target JSON state out of the repository checkout—previously .craft-publish-<version>.json in cwd could be pre-populated by committed content or earlier CI steps to silently skip targets—to $XDG_STATE_HOME/craft/, falling back to $HOME/.local/state/craft/. In getsentry/publish Docker, HOME=/root, making this a clean workflow-writable location inaccessible to committed repository contents.
• 🟡 (14:09) src/utils/publishState.ts:getCraftStateDir() returns join(process.env.XDG_STATE_HOME, 'craft') when nonempty, otherwise join(homedir(), '.local', 'state', 'craft'); STATE_DIR_NAME = 'craft'.
• 🟡 (14:09) src/utils/publishState.ts:sanitiseForFilename() lowercases strings, replaces runs outside [a-z0-9._-] with _, and strips leading/trailing underscores. shortCwdHash() uses the first 12 hex characters of SHA-1 of absolute cwd to isolate monorepo subpaths.
• 🟡 (14:09) getPublishStateFilename(version, githubConfig, cwd = process.cwd(), workspace?) creates publish-state-<owner>-<repo>-<sha1(cwd)[:12]>-<workspace-prefix><safe-version>.json when GitHub config is resolvable; offline/non-GitHub fallback is publish-state-<sha256(cwd)[:16]>-<workspace-prefix><safe-version>.json. Workspace prefix is lossless Base64URL encoding: workspace-${Buffer.from(workspace).toString('base64url')}-, preventing same-repository/same-version release workspaces from sharing state. getPublishStatePath() joins this filename to getCraftStateDir().
• 🟡 (14:09) src/commands/__tests__/publish.test.ts:runPostReleaseCommand tests default execution of /bin/bash scripts/post-release.sh '' 2.3.4 only when executable; custom command python ./increase_version.py "argument 1" executes as python ['./increase_version.py', 'argument 1', '', '2.3.4']. Subprocess environment includes PATH, HOME, USER, GIT_COMMITTER_NAME, GIT_AUTHOR_NAME, EMAIL, all GITHUB_*/RUNNER_*, and CRAFT_RELEASED_VERSION.
• 🟡 (14:09) Post-release command environment tests establish that arbitrary environment values—including LD_PRELOAD, AWS_SECRET_ACCESS_KEY, and SECRET_TOKEN—must not reach the subprocess; GITHUB_RUN_ID, GITHUB_REPOSITORY, and RUNNER_OS are forwarded by prefix, while NPM_TOKEN and DOCKER_PASSWORD are excluded.
• 🟡 (14:09) getPublishStateGitHubConfig() uses controller checkout identity getsentry/toolkit for publish-state identity even if resolved workspace GitHub config is {owner: 'release-owner', repo: 'release-repo', projectPath: 'packages/cli'}; without controller identity it retains resolved config; malformed controller repo value getsentry/toolkit/extra throws referencing CRAFT_PUBLISH_STATE_GITHUB_REPO.
• 🔴 (14:11) User stated that a following option such as --workspace --dry-run must never be mistaken for a workspace name.
• 🟡 (14:11) src/utils/helpers.ts:extractWorkspaceSelection(argv, env = process.env) pre-parses --workspace foo/--workspace=foo and CRAFT_WORKSPACE with Node parseArgs(... tokens: true) because yargs command builders may load configuration before middleware. It selects the last valid workspace occurrence; a bare/empty last option clears an earlier CLI value and falls back to CRAFT_WORKSPACE; inline option-like values such as --workspace=-foo are accepted, but non-inline values beginning - are rejected.
• 🟡 (14:12) src/index.ts calls sanitizeDynamicLinkerEnv() before all other CLI work to prevent LD_PRELOAD, DYLD_*, and related dynamic-linker variables leaking into spawned subprocesses. It extracts workspace selection and calls setActiveWorkspace(extractWorkspaceSelection(argv)) before yargs parsing, since publish builders derive target choices from config and cannot wait for middleware.
• 🟡 (14:12) Craft global CLI --workspace is a string option described as selecting a named release-unit workspace, required when configuration defines workspaces, with CRAFT_WORKSPACE environment support. --dry-run means no file writes, commits, pushes, or API mutations; --no-input defaults to isCI; yargs uses boolean-negation: false, strict commands, and setGlobals middleware.
• 🔴 (14:20) User directed that prerelease relaxation applies only to the current Craft-version side, never the configured minVersion side.
• 🟡 (14:20) src/config.ts:applyWorkspaceSelection() returns config unchanged only when no workspaces and no active selection; errors if a workspace is selected but config lacks workspaces; errors if workspaces exist with no explicit selection, listing available names and requiring --workspace <name> or CRAFT_WORKSPACE; and gates selected workspaces on minVersion >= WORKSPACES_MIN_VERSION before resolveWorkspaceConfig(config, _activeWorkspaceName).
• 🟡 (14:20) getConfiguration() and loadConfigurationFromString() validate YAML with CraftProjectConfigSchema, call checkMinimalConfigVersion(parsed), then cache applyWorkspaceSelection(parsed). loadConfigurationFromString() is used by --config-from.
• 🟡 (14:20) checkMinimalConfigVersion() treats a local prerelease Craft build such as 2.29.0-dev.0 as satisfying minVersion up to release 2.29.0 for dogfooding. It strips prerelease and build metadata only from currentVersion when prerelease, otherwise strips build metadata; it always strips only build metadata from configured minVersion. Build metadata such as 2.29.0+linux is ignored for precedence because the comparison helper rejects build metadata.
• 🔴 (14:22) User directed: Always allow workflow_dispatch for manual recovery.
• 🟡 (14:22) publish-workspace-acceptance/.github/workflows/ contains auto-approve.yml, ci-poller.yml, cocoapods-keepalive.yml, publish.yml, and test.yml.
• 🟡 (14:22) ci-poller.yml synchronizes repository variable CI_POLLER_HAS_PENDING after CI checks: it sets "false" when no ci-pending issues remain and "true" otherwise, including when a manual workflow_dispatch bypassed a false gate. It obtains an app token with actions/create-github-app-token@v3, vars.CI_POLLER_APP_CLIENT_ID, and secrets.CI_POLLER_APP_PRIVATE_KEY.
• 🟡 (14:22) ci-poller.yml self-dispatches ci-poller.yml while pending issues remain, using GH_TOKEN: ${{ steps.token.outputs.token }} and input attempt; it increments the attempt count, caps at 60 attempts (approximately 30 minutes), relies on cron fallback after the cap, and cites GitHub */5 cron drift to 30–40 minutes under load versus roughly 30–60 seconds between self-dispatch checks. Its concurrency group limits accumulation to 1 running plus 1 queued run.
• 🟡 (14:21) publish-workspace-acceptance/src/publish/update-issue.js gets GitHub Actions context, creates Octokit with github.getOctokit(getGitHubToken()), parses process.env.PUBLISH_ARGS as JSON, and calls updateIssue({ context, octokit, inputs }).