Distillation

🔴 (12:04) [enforced-ci-ready-transition] User requires the CI poller, after CI succeeds, to remove any stale ci-ready label, revalidate the exact approved release snapshot, and always add ci-ready again so a fresh label event triggers publishing; the add must never be treated as an idempotent optimization.
🔴 (12:04) [enforced-request-revalidation] User requires the CI poller to revoke or stop processing an issue—and never let it reach ci-ready—if the issue is renamed, its release details change, or it is re-approved with a different accepted event.
🔴 (12:04) [requested-regression-tests] User requires focused regressions for stale ci-ready removal, final revalidation, and per-issue termination, including mutation checks proving tests fail when any of those protections is removed.
🔴 (12:04) [enforced-manual-recovery] User requires workflow_dispatch wherever operators need manual recovery.
🔴 (12:04) [enforced-trusted-recovery] For privileged recovery, user requires a no-secret relay protected by a main-only environment and a successful default-branch workflow_run handoff rather than direct secret-bearing dispatch, because dispatchers select workflow YAML before jobs, guards, or checkout execute.
🔴 (12:04) [enforced-workflow-identification] User requires workflows to be identified by checked-in filename, such as ci-poller.yml, rather than placeholders or numeric IDs.
🔴 (12:04) [enforced-provenance-gates] User requires release authorization and attestations to be bound to the exact live request, a trusted actor, and current label-event provenance.
🔴 (12:04) [enforced-automated-approval-proof] User requires automated approval to have request-bound github-actions[bot] proof before sentry-internal-app[bot] adds accepted; generic app identity is insufficient.
🔴 (12:04) [enforced-live-fencing] User requires validation of the captured accepted event and request digest before CI, after CI, while recording CI-ready proof, immediately before adding ci-ready, and immediately before Craft. Repeated live fencing was chosen over initial-only validation because issue state can change during CI or setup.
🔴 (12:04) [enforced-trusted-transitions] User requires publishing and CI workflow boundaries to be treated as security gates: before applying accepted, moving an issue to ci-ready, or publishing, validate the live canonical issue, current label events, actor provenance, and matching attestations; reject renamed, closed, changed, re-approved, self-approved, or unverifiable requests.
🔴 (12:04) User stated the CI poller is solely responsible for adding ci-ready.
🔴 (12:04) [enforced-dispatch-safety] User requires recovery dispatch to remain available but forbids execution of arbitrary dispatched-ref code or exposure of repository secrets to dispatched refs; workflows must check out a trusted ref and use protected environments.
🔴 (12:04) [enforced-supply-chain-security] User requires least-privilege permissions, no exposure of RBAC data, and actions and publishing images pinned to immutable revisions or digests.
🔴 (12:04) [requested-regression-tests] User requires regression tests for workflow ordering and final revalidation immediately before credential-bearing publication.
🔴 (12:04) [enforced-snapshot-validation] User requires approval, CI-poller, and publication workflows to treat the exact triggering issue snapshot as immutable security input, binding attestations and validation to the raw title, body, labels, and dry-run state and rejecting requests whose live state no longer matches.
🔴 (12:04) [enforced-snapshot-validation] User requires snapshot-bound checks for human approval, automated approval, CI-ready proof creation, and final publication, with snapshot verification mandatory at every entry point rather than optional.
🔴 (12:04) [enforced-trusted-code] User requires trusted default-branch code to run before credentials are created and forbids interpolation of untrusted issue text into shell commands.
🔴 (12:04) [requested-regression-tests] User requires fail-first regression tests for mutation, stale-event, provenance, and workflow-ordering bypasses, followed by targeted and full validation.
🔴 (12:04) [enforced-validation-workflow] User requires focused regression tests followed by the full test suite, linting, formatting/whitespace checks, and workflow/YAML validation before changes are declared complete.
🔴 (12:04) [enforced-security-review] For GitHub Actions changes, user requires verification of trusted-code execution, protected-secret usage, trigger safety, and immutable action pinning; exact test/file counts must be reported, current-change failures must be distinguished from pre-existing or unrelated formatting/lint issues, and passing unit tests alone is insufficient readiness evidence.
🔴 (12:04) [enforced-defense-in-depth] User requires release, approval, and CI-poller changes to preserve strict trust boundaries: trusted default-branch code before token access, secret-bearing jobs behind the protected production environment, no secrets for dispatched refs, and immutable digests for actions and containers.
🔴 (12:04) [enforced-approval-invalidation] User requires approvals to bind immutable request details and current label-event IDs, prohibits self-approval, and requires attestation revalidation immediately before every privileged state transition or publish operation; if the request or approval changes, approval-related labels must be removed and processing stopped.
🔴 (12:04) [requested-regression-tests] User requires focused automated tests covering workflow ordering, token identity, action pinning, dispatch restrictions, exact body preservation, cleanup, and race-condition handling.
🔴 (12:04) [enforced-automated-approval] User requires authorizeApproval() to fail closed when either getsantry[bot] or sentry-release-bot[bot] directly adds accepted, even if both appear in generic AUTO_APPROVERS; only sentry-internal-app[bot] may represent automated approval, backed by matching github-actions[bot] attestation.
🟡 (12:04) src/modules/__tests__/approval-authorizer.js tests both direct-bot paths with test.each(["getsantry[bot]", "sentry-release-bot[bot]"]); each must return { authorized: false, repository: "getsentry/sentry-javascript" } without calling getPermission.
🟡 (12:04) src/modules/__tests__/approval-authorizer.js also verifies: 1. getsantry[bot] is rejected when getsentry/sentry-javascript is outside autoApprovedRepositories; 2. write, maintain, and admin collaborators are authorized; 3. none, read, triage, "Elevated Bot", and undefined roles are rejected; 4. unqualified publish: sentry-javascript/packages/core@10.0.0 resolves to getsentry/sentry-javascript; 5. malformed titles return { authorized: false, repository: null } without a GitHub query; 6. permission lookup error "Not Found" propagates.
🟡 (12:04) src/modules/__tests__/approval-attestation.js verifies currentAcceptedEvent() chooses the latest accepted event and returns { actor: "contractor", eventId: "200" }; numeric GitHub event ID 29503999078 is normalized to string "29503999078".
🟡 (12:04) src/modules/__tests__/approval-attestation.js verifies approval attestations authored by github-actions[bot] are matched to the exact issue and current accepted event, while malformed, stale, wrong-author, changed-event, and changed-request attestations are rejected; parseApprovalAttestation("") returns null.
🟡 (12:04) src/modules/__tests__/approval-attestation.js verifies CI-ready attestations bind accepted event { actor: "contractor", eventId: "200" }, CI-ready actor sentry-internal-app[bot], and issue snapshot; changing the accepted event to ID "201" or the CI-ready actor to contractor causes rejection.
🟡 (12:04) src/modules/__tests__/approval-attestation.js verifies changing a request from non-dry-run to dry-run changes requestDigest() and causes hasApprovalAttestation() to reject the previously created attestation.
🟡 (12:04) src/modules/__tests__/ci-poller-input.js defines REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac" and verifies getCiPollerInput() parses both publish: getsentry/toolkit/cli@1.2.3 and publish: toolkit/packages/cli/v2@1.2.3 into repo: "getsentry/toolkit", revision: REVISION, version: "1.2.3", and a snapshot-derived requestDigest.
🟡 (12:04) src/modules/__tests__/ci-poller-input.js verifies .github/workflows/ci-poller.yml checks out publish code under .__publish__, contains name: Get publish code, invokes node .__publish__/src/publish/resolve-ci-poller-input.js, and no longer parses the revision with grep -oP '(?<=commit/.
🟡 (12:04) src/modules/__tests__/ci-poller-input.js rejects unsafe repositories -toolkit, ., .., and __proto__ with Invalid publish issue repository; invalid versions --config and 1.2 with Invalid publish issue version; malformed identities publish: getsentry/@1.2.3 and publish: getsentry/toolkit$@1.2.3 with Invalid publish issue title; and unsafe paths containing ../other, ./other, __proto__/other, or --config with Invalid publish issue path.

Distillation

Observations