Distillation

Date: Sep 8, 2026

• 🟡 (02:58) Search of craft/src/commands/publish.ts found 14 mergeTarget matches: optional mergeTarget?: string at line 134; mergeTarget parameter documentation at line 418 and optional parameter at line 425; absent values resolve through getDefaultBranch(git, remoteName) at lines 428–430; Craft checks out, pulls/rebases, merges into, and pushes mergeTarget at lines 431–501; no-merge validation references argv.mergeTarget at line 779 and publish invocation passes it at line 807. craft/src/commands/__tests__/publish.test.ts:392 tests default-branch resolution when mergeTarget is omitted.
• 🟡 (02:59) Tool reported no files found for an unspecified lookup.
• 🟡 (02:59) Tool output identified main; not-a-branch as an example merge-target value.
• 🟡 (03:00) publish-workspace-acceptance/src/modules/__tests__/update-issue.js test fixture sets GITHUB_WORKSPACE="." and CRAFT_STATE_FILE_PATH=".craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json". It mocks state content {"published":{"lol":true,"hey":false,"github":true}} and an issue body whose canonical header contains Requested by: @BYK, Merge target: (default), a sentry compare link, and check-runs revision 7e5ca7ed5581552de066e2a8bc295b8306be38ac.
• 🟡 (03:00) update-issue.js tests both state-file-exists states: when present, updateIssue() reads the secure workflow-output path and updates target checkboxes (github checked, pypi unchecked, added lol checked, added hey unchecked); when absent, it does not update the issue body. Both cases remove the accepted label from issue 211 in getsentry/publish. A separate test verifies that deleting CRAFT_STATE_FILE_PATH prevents state-file reads and issue-body updates.
• 🟡 (03:00) transformIssueBody() regression test expects published targets to be reconciled while preserving the canonical header and target explanatory text: npm[@sentry/node] becomes checked, aws-lambda remains checked, github becomes unchecked, and missing published target foo is added as checked.
• 🟡 (03:00) Tool stated “canonical revision only.”
• 🟡 (03:00) Working tree status showed modifications to 15 previously listed files plus new untracked src/modules/__tests__/generate-publish-issue-title-parser.js, src/publish/__tests__/, and src/publish/discover-location.js. The repository file listing also includes unrelated .github/workflows/cocoapods-keepalive.yml, README.md, package.json, yarn.lock, publish modules, and associated tests.
• 🟡 (03:00) Assistant review finding MAJOR 1: .github/workflows/ci-poller.yml:147-151 pipes release-revision validation into jq without pipefail. If updateReleaseRevision rejects a replacement SHA, jq can exit successfully and write an empty temporary file, after which gh issue edit --body-file could overwrite the canonical issue body with empty content. Evidence cited: bash -e continues after false | jq …; no regression covers this workflow failure path. Assistant marked this as a do-not-merge issue.
• 🟡 (03:00) Assistant review finding MAJOR 2: src/modules/publish-issue-title.peggy:43 captures mergeTarget with unrestricted NonNewline (:78), whereas docs/publish-issue-format.md:94 documents only letters, digits, _, ., /, and -. src/modules/details-from-context.js:54-75 forwards the raw value and .github/workflows/publish.yml:247 supplies it to Craft. Example accepted invalid value: Merge target: main; not-a-branch. Assistant concluded this breaks strict canonical-format and docs/code parity and marked it do-not-merge.
• 🟡 (03:00) Assistant review finding MEDIUM: .github/workflows/ci-poller.yml:98-105 and :147-155 remove temporary issue-body files only on successful paths; failed rewrites, gh issue edit, or later unguarded commands can leave body_file and/or updated_body_file. Recommended fix: scoped cleanup trap.
• 🟡 (03:00) Assistant review finding MINOR: .github/workflows/cocoapods-keepalive.yml:1 only removes quotes from the workflow name and is unrelated formatter churn within this workspace-acceptance change set.
• 🟡 (03:00) Assistant review checks marked PASS: Peggy title parser correctness (anchored grammar and parsed title validation); release-revision parser correctness (header at byte zero, exact repo, lowercase 40-character SHA); merge target derives solely from canonical header; global CheckRunsLinkCount rejects appended exact decoy links; valid JSON {}/[] fallbacks and serialized Action outputs; conditional root .craft.yml discovery with exact workspace spelling; fresh ci-ready gating through pending reset and required label event; CI revision checkout and craft publish --rev use canonical header SHA; state key isolation via checkout repo, canonical cwd hash, workspace encoding, and version encoding; intentional retention of getsentry/craft:latest; and .github/workflows/ci-poller.yml:52 use of actions/checkout@v7.
• 🟡 (03:00) Assistant review checks marked FAIL: canonical request-header authority and docs-generation parity due to unrestricted PEG merge-target syntax contradicting docs; rewrite bounds/replacement-SHA validation and CI body-byte preservation due to workflow suppression of validation failures; safe temporary-file cleanup; and tests/diff hygiene despite 86 tests, lint, generated-file check, and git diff --check passing, because failure-path coverage is missing and unrelated churn remains.