Dashboard › publish › Distillation
bebc1494-9905-4b5a-994a-4451569e6342["lore_tm_v1_7qClrYQZnTgJN5ExiUTqq41hmEDWOOyGIh3e4pBr9jc","lore_tm_v1_GZ1ydu5XWarITF50MHsmbr3qdCHxhnd_BQq4Drd-3tQ","lore_tm_v1_nKKljNIJBGHIJE3uUwV3MnK9wCiAk0DWSXsvNMXkKBg","lore_tm_v1_Fv14FTsDFccmKZvl36PUZdu4dIkNYUU6W6a8xu0D8aQ","lore_tm_v1_5Po2YLv4fJ35wejsowmAxdDJiyUMuqHGeTCAFR82fpY"]
Date: Sep 9, 2026
src/modules/approval-authorizer.js:1-5 defines allowed approval roles as new Set(["write", "maintain", "admin"]), AUTO_APPROVAL_LABELER = "sentry-internal-app[bot]", and AUTO_APPROVERS = new Set(["getsantry[bot]", "sentry-release-bot[bot]"]).src/modules/approval-authorizer.js:7-25 implements isAutoApprovedRepository({ actor, autoApprovedRepositories, issueTitle }): it rejects actors outside AUTO_APPROVERS and titles that fail parsePublishTitle(issueTitle), then checks whether autoApprovedRepositories contains getsentry/${title.repo}${title.path || ""}.src/modules/approval-authorizer.js:27-50 implements authorizeApproval({ actor, issueTitle, getPermission }): an invalid publish title returns { authorized: false, repository: null }; the repository is getsentry/${title.repo}; actors in AUTO_APPROVERS and the exact AUTO_APPROVAL_LABELER are denied without a permission lookup; other actors are checked through getPermission({ owner: "getsentry", repository: title.repo, username: actor }) and authorized only when role_name is write, maintain, or admin.src/modules/approval-authorizer.js:52-57 exports AUTO_APPROVAL_LABELER, AUTO_APPROVERS, authorizeApproval, and isAutoApprovedRepository.src/publish/authorize-approval.js:14-21 implements getAutoApprovedRepositories() by reading auto-approve-repos.txt as UTF-8, splitting on /\r?\n/, removing empty lines with .filter(Boolean), and returning a Set.src/publish/authorize-approval.js:23-47 implements GitHub authorization API access: getPermission({ owner, repository, username }) requests repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/collaborators/${encodeURIComponent(username)}/permission and throws Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ${response.status} for a non-OK response; getGitHubResponse(path) fetches https://api.github.com/${path} with Accept: application/vnd.github+json, Authorization: Bearer ${process.env.APPROVAL_TOKEN}, and X-GitHub-Api-Version: 2026-03-10.src/publish/authorize-approval.js:49-61 implements getIssue({ repository, issueNumber }) using repos/${repository}/issues/${issueNumber} and throws Could not retrieve issue #${issueNumber}: GitHub returned ${response.status} on a non-OK response.src/publish/authorize-approval.js:63-107 implements paginated getIssueEvents() and getIssueComments(): each requests pages beginning at 1 with per_page=100, accumulates results, and stops when a page contains fewer than 100 records; failures throw resource-specific errors containing the issue number and GitHub status.src/publish/authorize-approval.js:109-130 requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; main() reads APPROVAL_ACTOR and APPROVAL_ISSUE_TITLE and loads the allowlist through getAutoApprovedRepositories().src/publish/authorize-approval.js:135-171 handles approvals performed by AUTO_APPROVAL_LABELER: it concurrently retrieves the live issue, all events, and all comments; derives the requester from liveIssue.user?.login and the latest accepted-label event through currentAcceptedEvent(events); and authorizes only if the issue remains open with the same title, the requester is a string in AUTO_APPROVERS, isAutoApprovedRepository() accepts the requester/repository, the accepted event actor equals the labeler, and hasAutoApprovalAttestation() validates a proof authored by exactly github-actions[bot].src/publish/authorize-approval.js:172-179 sends non-AUTO_APPROVAL_LABELER actors through authorizeApproval({ actor, issueTitle, getPermission, autoApprovedRepositories }); if authorization fails, lines 181-184 append exactly authorized=false\n to GITHUB_OUTPUT and return.src/publish/authorize-approval.js:186-213 re-fetches the live issue and events when they were not already loaded, selects currentAcceptedEvent(events), and rejects authorization if the issue is not open, its live title differs from APPROVAL_ISSUE_TITLE, its requester login is absent, a normal approving actor is also the requester under case-insensitive comparison, no accepted event exists, or the accepted event actor differs from the approving actor.src/publish/authorize-approval.js:215-223 creates an approval proof with createApprovalAttestation({ actor: event.actor, eventId: event.eventId, issue }) and appends authorized=true\napproval_attestation=${attestation}\n to GITHUB_OUTPUT.src/publish/authorize-approval.js:226-241 runs main() only when invoked directly, logs failures and sets process.exitCode = 1, and exports getAutoApprovedRepositories, getGitHubResponse, getIssue, getIssueComments, getIssueEvents, getPermission, and main.src/publish/current-accepted-event.js:1-18 implements getCurrentAcceptedEvent({ getIssueEvents, issueNumber, repository }) by fetching issue events and applying currentAcceptedEvent(); it throws The issue has no current accepted label event if none exists.src/publish/current-accepted-event.js:20-39 requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY; main() supplies an event fetcher backed by getAllPages({ repository, issueNumber, resource: "events" }) and writes the selected event as JSON.stringify(event) to stdout.src/publish/current-accepted-event.js:41-48 runs main() only when invoked directly, logs errors and sets process.exitCode = 1, and exports getCurrentAcceptedEvent and main.src/publish/record-auto-approval-attestation.js:7-25 implements recordAutoApprovalAttestation({ autoApprover, getIssue, issueNumber, issueTitle, repository }): it fetches the live issue and throws The automated approval request changed before approval unless the issue is still open, its title still equals issueTitle, and issue.user?.login equals autoApprover case-insensitively; valid requests return createAutoApprovalAttestation({ autoApprover, issue }).src/publish/record-auto-approval-attestation.js:27-51 requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and AUTO_APPROVER; main() calls recordAutoApprovalAttestation() with those values and appends auto_approval_attestation=${attestation}\n to GITHUB_OUTPUT.src/publish/record-auto-approval-attestation.js:54-61 runs main() only when invoked directly, logs errors and sets process.exitCode = 1, and exports main and recordAutoApprovalAttestation.src/publish/record-ci-ready-attestation.js:12-28 implements getAuthenticatedLogin() by requesting the GitHub user endpoint through getGitHubResponse("user"); a non-OK response throws Could not retrieve the authenticated user: GitHub returned ${response.status}, a non-string login throws GitHub returned no authenticated user login, and a valid login is returned.src/publish/record-ci-ready-attestation.js:30-59 implements recordCiReadyAttestation({ expectedAcceptedEvent, getAuthenticatedLogin, getIssue, getIssueEvents, issueNumber, issueTitle, repository }): it concurrently fetches the live issue, issue events, and authenticated CI actor; derives acceptedEvent via currentAcceptedEvent(events); and throws The approval changed before CI could be marked ready unless the issue remains open with the same title, still has an accepted label, has a current accepted event, and—when supplied—the expected accepted actor and event ID exactly match the current event. A valid request returns createCiReadyAttestation({ acceptedEvent, ciReadyActor, issue }).src/publish/record-ci-ready-attestation.js:61-90 requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and APPROVAL_ISSUE_TITLE; it constructs expectedAcceptedEvent only when both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID are present, and retrieves events using getAllPages({ repository, issueNumber, resource: "events" }).src/publish/record-ci-ready-attestation.js:92-109 appends ci_ready_attestation=${attestation}\n to GITHUB_OUTPUT, runs main() only when invoked directly with error logging and process.exitCode = 1, and exports getAuthenticatedLogin, main, and recordCiReadyAttestation.