Dashboard › publish › Distillation
ba83af82-ba5b-4272-9dc4-acaceee5c038["lore_tm_v1_eodLNG2UOvSqnGx27TaPrfIyzbo1mPVVZdyhN2Lfwpw","lore_tm_v1_a_mJbn-cemTDjFKVK9jijAykQRQNDtUCIjaLoga_IUk","lore_tm_v1_s45lGPl78aEm3UQ-OBNrXHNUgI1w5iODgfEtKSBAE2g","lore_tm_v1_-wM0DnRX4KCgIm8zg8Gq70--el7oFSsiWkWDr8yIMDM","lore_tm_v1_QvNn5SwOQGurY1d2Ry06PegUki8a-u6WDe8i4fHywKU","lore_tm_v1_RRcL6KkvGmPitr-dCe03hqcpk2aaJIITeTZcgKCAjHc"]
/home/byk/Code/getsentry/publish/src/publish/record-auto-approval-attestation.js defines recordAutoApprovalAttestation({ autoApprover, getIssue, issueNumber, issueTitle, repository }); it retrieves the live issue with getIssue({ repository, issueNumber }) and rejects with Error("The automated approval request changed before approval") if the issue is not open, its title differs from issueTitle, or issue.user?.login does not case-insensitively match autoApprover.recordAutoApprovalAttestation() returns createAutoApprovalAttestation({ autoApprover, issue }).main() in /home/byk/Code/getsentry/publish/src/publish/record-auto-approval-attestation.js requires environment variables GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and AUTO_APPROVER; a missing value raises No "<name>" environment variable found.main() appends auto_approval_attestation=${attestation}\n to the file identified by GITHUB_OUTPUT using fs.appendFileSync(). Direct execution catches errors, logs them with console.error(error), and sets process.exitCode = 1; the module exports { main, recordAutoApprovalAttestation }./home/byk/Code/getsentry/publish/src/publish/__tests__/record-auto-approval-attestation.js tests that an open issue titled publish: getsentry/sentry-javascript@10.0.0, authored by getsantry[bot], produces an attestation parsed by parseAutoApprovalAttestation() into { autoApprover: "getsantry[bot]", requestDigest: expect.any(String), title }.contractor is rejected with The automated approval request changed before approval.VERCEL_ORG_ID, CI_POLLER_APP_CLIENT_ID, and CI_POLLER_HAS_PENDING./home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js tests authorizeApproval() with canonical issue title publish: getsentry/sentry-javascript@10.0.0.authorizeApproval() tests require direct approval by either getsantry[bot] or sentry-release-bot[bot] to return { authorized: false, repository: "getsentry/sentry-javascript" } without calling getPermission, even when the repository is in autoApprovedRepositories.authorizeApproval() tests require getsantry[bot] approval for getsentry/sentry-javascript to be rejected without a permission lookup when autoApprovedRepositories only contains getsentry/sentry-python.authorizeApproval() tests accept repository collaborator roles write, maintain, and admin; each returns { authorized: true, repository: "getsentry/sentry-javascript" } and calls getPermission({ owner: "getsentry", repository: "sentry-javascript", username: "contractor" }).publish: sentry-javascript/packages/core@10.0.0 is tested as resolving to getsentry/sentry-javascript, with authorization based on a permission lookup against owner getsentry, repository sentry-javascript, and username contractor.authorizeApproval() tests reject collaborator roles none, read, triage, Elevated Bot, and undefined, returning { authorized: false, repository: "getsentry/sentry-javascript" }.publish: @1.0.0 and publish: getsentry/sentry-javascript are tested as returning { authorized: false, repository: null } without querying GitHub.Error("Not Found") from authorizeApproval()./home/byk/Code/getsentry/publish/src/publish/__tests__/workflow-action-pinning.js enumerates every .yml file in .github/workflows and requires every actions/...@revision reference to use a lowercase 40-character hexadecimal commit SHA matching /^[a-f0-9]{40}$/.SECRET_BEARING_JOBS maps .github/workflows/auto-approve.yml → auto-approve, .github/workflows/ci-poller.yml → check-ci, .github/workflows/cocoapods-keepalive.yml → keepalive, and .github/workflows/publish.yml → waiting-for-ci plus publish; every mapped job must contain environment: production.workflow_dispatch: in every workflow except .github/workflows/ci-poller-dispatch.yml. The protected relay must contain workflow_dispatch:, permissions: {}, and environment: production, and must not contain secrets...github/workflows/auto-approve.yml 21/2; .github/workflows/ci-poller.yml 172/23; .github/workflows/cocoapods-keepalive.yml 1/2; .github/workflows/publish.yml 131/8; .github/workflows/test.yml 3/3; AGENTS.md 6/0; README.md 3/1; docs/key_rotation_vault_changes.md 20/20; docs/rfc.md 5/4; src/libs/__tests__/github.js 1/1; src/libs/github.js 4/2; src/modules/__tests__/details-from-context.js 21/1; src/modules/__tests__/update-issue.js 28/0; src/modules/details-from-context.js 14/3; src/modules/post-workflow-details.js 2/2; src/modules/process-end-state.js 2/2; src/modules/update-issue.js 23/19; src/publish/inputs.js 8/9; src/publish/post-result.js 4/4; src/publish/post-workflow-details.js 4/4; and src/publish/update-issue.js 26/7..github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/authorize-approval.js, src/publish/__tests__/auto-approval-workflow.js, src/publish/__tests__/ci-poller-workflow.js, src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/publish-workflow.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/workflow-action-pinning.js, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.