Distillation

Date: Aug 25, 2026

• 🟡 [requested-security-review] (14:33) User requested a read-only adversarial correctness/security review of uncommitted changes in /home/byk/Code/getsentry/publish-workspace-acceptance on branch feat/workspace-acceptance, compared with origin/main; explicitly requested no file modifications.
• 🟡 (14:33) Review scope requested: .github/workflows/publish.yml, src/modules/details-from-context.js, and its tests.
• 🟡 (14:33) User requested verification of exact backward compatibility for legacy issue grammar, output, and state files.
• 🟡 (14:33) User requested verification that workspace grammar matches Craft action syntax: publish: repo/path [workspace: <JSON string>] @version.
• 🟡 (14:33) User requested fail-closed parsing coverage, including malformed JSON and dangerous strings; shell/YAML injection; Base64URL state-file byte-level equivalence with Craft getPublishStateFilename; preserved CI ready/accepted gating; issue-concurrency identity; dry run; and target-state resume isolation.
• 🟡 (14:33) User requested inspection of relevant source/tests and a report organized by severity with file:line evidence, PASS/FAIL per concern, test gaps, and a clear MERGE/DO-NOT-MERGE recommendation.
• 🟢 (14:34) Repository directory /home/byk/Code/getsentry/publish-workspace-acceptance contains 14 entries: .eslintrc.js, .git, .github/, .gitignore, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, README.md, src/, vitest.config.js, and yarn.lock.
• 🔴 (14:35) User-provided repository agent guidelines state this is the Sentry Publish Repository, a GitHub Actions approval system for publishing releases across Sentry projects using Craft; it is pure JavaScript using Node.js 24.0.0 and CommonJS modules.
• 🔴 (14:35) User-provided repository convention: use Yarn classic 1.22.22, managed by Volta in package.json; do not use npm.
• 🔴 (14:35) User-provided repository commands: yarn install; yarn test; yarn test:watch; yarn test src/modules/__tests__/update-issue.js; yarn test -t "pattern"; yarn lint; and yarn prettier.
• 🔴 (14:35) User-provided repository structure: src/libs/ contains shared utilities, src/modules/ contains reusable core business logic, and src/publish/ contains GitHub Actions entry points.
• 🔴 (14:35) User-provided repository conventions: files use kebab-case (e.g. details-from-context.js, update-issue.js); tests are in __tests__/ with corresponding source names; variables/functions use camelCase; constants/regex patterns use UPPER_SNAKE_CASE.
• 🔴 (14:35) User-provided repository convention: source uses CommonJS (require/module.exports), while test files use ES Modules (import/export); imports are ordered Node built-ins, external packages, then local modules.
• 🔴 (14:35) User-provided repository convention: use Prettier defaults, double-quoted strings, and semicolons; run yarn prettier before committing.
• 🔴 (14:35) User-provided error-handling preference: use descriptive errors and early guard clauses to validate inputs.
• 🔴 (14:35) User stated: always throw for unexpected values, including a default case in switch statements that throws an Error such as Unknown status: '${status}'.
• 🔴 (14:35) User-provided repository convention: check fs.existsSync(CRAFT_STATE_FILE_PATH) before reading Craft state files and return if absent.
• 🔴 (14:35) User-provided test convention: Vitest v4.0.0 with globals enabled and mocks auto-cleared between tests; external dependencies should be mocked before importing the module under test.
• 🟢 (14:36) Worktree .git points to gitdir: /home/byk/Code/getsentry/publish/.git/worktrees/publish-workspace-acceptance.
• 🟡 (14:37) Uncommitted changes are limited to 3 modified files: .github/workflows/publish.yml, src/modules/__tests__/details-from-context.js, and src/modules/details-from-context.js; diffstat is 123 insertions and 7 deletions.
• 🟢 (14:37) Current branch is feat/workspace-acceptance; current commit is 83d210b29553ea6f4d97508821724a834c43856e.
• 🔴 (14:38) User stated the CI poller always adds ci-ready.
• 🟡 (14:39) src/modules/details-from-context.js:4-5 defines TARGETS_SECTION_PARSER_REGEX as /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m.
• 🟡 (14:39) src/modules/details-from-context.js:11 defines TARGETS_PARSER_REGEX as /^\s*- \[[ x]\] (\S+)/gim; :17 defines CHECKED_TARGETS_PARSER_REGEX as /^\s*- \[x\] (\S+)/gim.
• 🟡 (14:39) detailsFromContext({ context }) in src/modules/details-from-context.js:19-22 throws Error("Issue context is not defined") unless context.payload.issue exists.
• 🟡 (14:39) src/modules/details-from-context.js:24-25 parses issue titles using ^publish: (?:getsentry\/)?(?<repo>[A-Za-z0-9_.-]+)(?<path>\/[\w./-]+)?(?: \[workspace: (?<workspace>"(?:[^"\\]|\\.)*")\] )?@(?<version>[\w.+-]+)$.
• 🟡 (14:39) src/modules/details-from-context.js:26-31 fails closed for nonmatching title grammar by throwing Invalid publish issue title: '<title>'.
• 🟡 (14:39) src/modules/details-from-context.js:32-40 extracts workspace, parses it with JSON.parse(workspaceJson), and rejects empty workspace values or values containing \n/\r with Workspace names must be nonempty and cannot contain line breaks.
• 🟡 (14:39) src/modules/details-from-context.js:42-45 sets dry_run to "1" only when an issue label name equals "dry-run"; otherwise ""; it computes path as "." + (titleDetails.path || "").
• 🟡 (14:39) src/modules/details-from-context.js:48-53 parses Merge target: <value> only where <value> matches [\w.\-/]+; otherwise merge_target remains "".
• 🟡 (14:39) src/modules/details-from-context.js:55-63 matches the targets section and returns only checked targets from CHECKED_TARGETS_PARSER_REGEX.
• 🟡 (14:39) src/modules/details-from-context.js:65-72 returns repo, version, optional title path, dry_run, merge_target, path, and targets; it includes workspace only if its parsed value is truthy.
• 🟡 (14:40) Existing test fixture in src/modules/__tests__/details-from-context.js:5-35 uses issue number: "223", title publish: getsentry/sentry@21.3.1, merge target custom-branch, CRLF-containing Targets lines, and labels ["accepted"].
• 🟡 (14:40) src/modules/__tests__/details-from-context.js:37-47 asserts strict legacy output compatibility via toStrictEqual: dry_run: "", merge_target: "custom-branch", path: ".", repo: "sentry", checked targets ["github", "npm[@sentry/node]", "docker[latest]"], and version: "21.3.1".
• 🟡 (14:40) src/modules/__tests__/details-from-context.js:49-64 tests version parsing with publish: getsentry/sentry-forked-django-stubs@4.2.6+sentry1 and expects version === "4.2.6+sentry1".
• 🟡 (14:40) src/modules/__tests__/details-from-context.js:66-102 tests that Merge target: (default) produces merge_target: "" while retaining path: ".", repo: "sentry", checked targets ["github", "docker[latest]"], version 21.3.1, and empty dry-run.
• 🟡 (14:40) src/modules/__tests__/details-from-context.js:104-124 tests workspace title parsing for publish: getsentry/toolkit [workspace: "cli/v2"] @1.2.3, expecting repo: "toolkit", version: "1.2.3", and workspace: "cli/v2".
• 🟡 (14:40) src/modules/__tests__/details-from-context.js:126-143 tests JSON-escaped workspace characters for publish: getsentry/toolkit [workspace: "cli [preview] \\"next\\""] @1.2.3, expecting workspace cli [preview] "next".
• 🟡 (14:40) src/modules/__tests__/details-from-context.js:145-160 tests rejection of the legacy-like title publish: getsentry/toolkit @1.2.3 because of its unexpected space before the version, expecting Invalid publish issue title.
• 🟡 (14:40) src/modules/__tests__/details-from-context.js:162-195 tests rejection of empty workspace "" and JSON newline workspace "cli\\nnext", each expecting Workspace names must be nonempty and cannot contain line breaks.
• 🟡 (14:40) src/modules/__tests__/details-from-context.js:197-200 tests missing issue payload rejection with Issue context is not defined.
• 🟡 (14:41) Workflow diff context shows the publish job retains gating against issue labels ci-pending and ci-failed, has timeout-minutes: 90, checks out repository contents into .__publish__, sets up Node 24, uses Yarn cache with .__publish__/yarn.lock, installs using yarn install --cwd ".__publish__", and parses inputs with node .__publish__/src/publish/inputs.js.
• 🟡 (14:41) Workflow diff context shows Inform start runs only when steps.inputs.outcome == 'success' and uses GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} to execute node .__publish__/src/publish/post-workflow-details.js.
• 🟡 (14:41) Workflow diff context indicates new Craft state-file handling writes state to a safe location Craft reads from, pins state beneath the GitHub workspace rather than target-repository contents, constructs container CWD under /github/workspace/__repo__/..., sanitises getsentry and CRAFT_PUBLISH_REPO, and writes payload using printf %s "$payload" > "$state_file".