Dashboard › publish › Distillation
bfbb119d-e11f-4d71-a3b6-f3ba897dd445["lore_tm_v1_5P__ugmR0DLuRXTSEOIQne3K28mB0d6RXZNpjW784lg","lore_tm_v1_2zGM5YxvGveE-lwhV9kqIobKbmChFpyM5fLOYnq0TfM","lore_tm_v1_SI0zfe9QlH8eMB1QtArBnxY6RB8MR3YgfM0G3ngy5IU","lore_tm_v1_iQeDZERIggaIRWvelbboQ0UnIdYGrkgaDi9DLiYnkQc","lore_tm_v1_DSRHIaQ8incfOA7ck6HZy40riVa-nEvXgGfemgndk5g","lore_tm_v1_dEqrKuZIt3EsDqaYHKkcBh33W1ZJxLsWo7GK0-WJGRI"]
main...origin/main [behind 1]; reported revisions were 83d210b29553ea6f4d97508821724a834c43856e and 7c60ddb7f43040fe8fbfea70efc833f689c04e75..github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, package.json, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, src/publish/update-issue.js, and yarn.lock.docs/publish-issue-format.md, scripts/generate-publish-issue-title-parser.js, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/ci-poller-workflow.js, src/modules/__tests__/generate-publish-issue-title-parser.js, src/modules/__tests__/publish-location.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/ci-poller-input.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/publish-issue-validation.js, src/modules/publish-location.js, src/modules/release-revision.js, src/publish/__tests__/discover-location.js, src/publish/__tests__/resolve-location.js, src/publish/__tests__/resolve-release-revision.js, src/publish/discover-location.js, src/publish/resolve-ci-poller-input.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js..github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.ci-ready was already present, waiting-for-ci removes it first so a fresh labeled event fires..github/workflows/publish.yml runs publishing only for an open issue on a ci-ready label event when both accepted and ci-ready are present and neither ci-pending nor ci-failed is present; job timeout is 90 minutes and environment is production..github/workflows/publish.yml validates approval twice using src/publish/validate-approval-attestation.js: once before setup and again immediately before publishing, with APPROVAL_ATTESTATION_AUTHOR=github-actions[bot] and REQUIRE_CI_READY_ATTESTATION="true". Failed validation removes accepted, comments “Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue.”, and exits 1.actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with Node 24 and Yarn caching, and actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1..github/workflows/publish.yml are: sentry-migr8 → tmp-merge-target; sentry-javascript → v10, v9, v8, v7, or master; sentry-python → alpha; and sentry-wizard → 1.x. Registered branches must be protected.__repo__/ under $GITHUB_WORKSPACE/.craft-state/craft, with filename publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json; cwd_hash is the first 12 characters of SHA-1 over the container cwd, and XDG_STATE_HOME is /github/workspace/.craft-state.docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b, runs craft publish ${{ fromJSON(steps.inputs.outputs.result).version }}, and uses Craft publish-state support associated with getsentry/craft#797, released in 2.26.0..github/workflows/ci-poller.yml enforces this by checking out ${{ github.event.repository.default_branch }} even though workflow_dispatch can target any ref.ci-ready..github/workflows/ci-poller.yml triggers via cron */5 * * * *, repository_dispatch type ci-poller, and completed workflow_run events for Run CI Status Poller. The check-ci job runs when CI_POLLER_HAS_PENDING == 'true', on repository dispatch, or after a successful default-branch relay run.^(0|[1-5][0-9])$, i.e. integer values 0 through 59; invalid values emit repository_dispatch attempt must be an integer from 0 through 59.ci-pending and accepted, using gh issue list --limit 200 --json number,title,labels,body.SENTRY_INTERNAL_APP_ID / SENTRY_INTERNAL_APP_PRIVATE_KEY) for label changes that trigger .github/workflows/publish.yml, and a release-bot token (SENTRY_RELEASE_BOT_CLIENT_ID / SENTRY_RELEASE_BOT_PRIVATE_KEY, owner getsentry) for cross-repository check-suite, status, and check-run API access.src/publish/current-accepted-event.js, then validates actor and eventId through src/publish/validate-approval-attestation.js with EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID. Binding or validation failure removes both ci-pending and accepted.parsePublishTitle from src/modules/details-from-context.js, extracts a 40-character commit SHA from the issue body’s /commit/{SHA}/checks link, resolves the release branch from the original commit’s first check suite, and then resolves branch HEAD to account for bot pushes. API failures fall back to the issue SHA; if HEAD changed, the issue-body check-runs link is updated.success or have total_count == 0, all check runs must be completed, and no completed check may have a conclusion other than success, neutral, or skipped.ci-ready, the poller creates proof with src/publish/record-ci-ready-attestation.js, requires output beginning ci_ready_attestation=, posts the proof using ${{ github.token }}, and verifies approval once more. Any proof or revalidation failure removes ci-pending and accepted.ci-pending and adding ci-ready, then comments CI checks passed for ${repo}@${version}. Publishing is starting now.ci-pending to ci-failed, remove accepted, list failed check names, link to the commit’s check runs, and instruct the author to re-add accepted after fixing CI. A failed combined commit status with otherwise passing checks follows the same label transition and lists failing/error status contexts.ci-pending and accepted, then synchronizes CI_POLLER_HAS_PENDING to "true" or "false" using CI_POLLER_APP_CLIENT_ID / CI_POLLER_APP_PRIVATE_KEY.*/5 cron can drift to 30–40 minutes. Concurrency group ci-status-poller uses cancel-in-progress: false; self-dispatch is capped at 60 attempts (approximately 30 minutes), after which cron is the fallback.src/modules/update-issue.js currently reads Craft state from ${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json; if absent it skips target updates. It transforms the issue target checklist according to craftState.published, appends published targets absent from the declared list, and always removes the accepted label.src/publish/update-issue.js parses PUBLISH_ARGS as JSON, warns Could not parse publish inputs; skipping target update on parse failure, invokes updateIssue({ context, octokit, inputs }), and sets process.exitCode = 1 after logging an uncaught error.