Dashboard › publish › Distillation
c62fa813-bdcc-4888-a063-f4a681e4ad84["lore_tm_v1_8hEoCOCcIP3dFgiQE62QT7a67KJOKq8LbACTLG4-ZyQ","lore_tm_v1_3aVjaaWtVxhcpHoWOdwX_xmjhRoOdI7stS_tO3kBwRU","lore_tm_v1_n6JhfMczL_5KQDhiMtgG-dR4gqY-h4IORSC2Op_5En0"]
Date: Sep 8, 2026
src/publish/__tests__/validate-approval-attestation.js defines issue(title, { body = "", labels = [{ name: "accepted" }], state = "open" } = {}) and mocks GitHub JSON responses with { ok: true, json: vi.fn().mockResolvedValue(json) }; afterEach() restores Vitest mocks.validateApprovalAttestation() test accepts an open publish: getsentry/sentry-javascript@10.0.0 issue with accepted, latest accepted event {actor:"contractor", eventId:"100"}, and a matching createApprovalAttestation() comment by github-actions[bot].validateApprovalAttestation() tests reject a trusted approval attestation when: the live issue title changes from publish: getsentry/sentry-javascript@10.0.0 to publish: getsentry/sentry-python@10.0.0; the live body changes to Merge target: main\n\n- [ ] npm; the accepted label is absent; the issue state is closed; or accepted was re-added and current latest accepted label event is "200" rather than attested event "100".validateApprovalAttestation() rejects a valid attestation for later accepted event "200" when caller supplies expectedAcceptedEvent: { actor: "contractor", eventId: "100" }.requireCiReadyAttestation: true, validateApprovalAttestation() accepts an issue labeled accepted and ci-ready only where standard approval proof binds accepted event {actor:"contractor", eventId:"100"} and createCiReadyAttestation() binds it to CI-ready label actor sentry-internal-app[bot] (CI-ready event ID "200"), all posted by github-actions[bot].requireCiReadyAttestation: true, validateApprovalAttestation() rejects a CI-ready proof made for sentry-internal-app[bot] if the actual latest ci-ready label event was manually applied by contractor.src/publish/__tests__/authorize-approval.js runAuthorization({ actor, issueTitle, responses }) sets GITHUB_OUTPUT=/tmp/github-output, APPROVAL_TOKEN=release-bot-token, APPROVAL_ACTOR, APPROVAL_ISSUE_NUMBER=123, APPROVAL_ISSUE_REPOSITORY=getsentry/publish, and APPROVAL_ISSUE_TITLE; it mocks fs.appendFileSync, queues global.fetch responses, runs main(), and waits for output. afterEach() restores process.env, mocks, and modules.getAutoApprovedRepositories() is tested to parse exact newline-delimited allowlist paths into a Set, including getsentry/sentry-javascript and nested path getsentry/objectstore/clients.contractor authorization test confirms authorize-approval.js requests https://api.github.com/repos/getsentry/sentry-javascript/collaborators/contractor/permission with Authorization: Bearer release-bot-token; given role_name:"write", an open accepted issue requested by requester, and latest accepted event by contractor ID "100", it writes /tmp/github-output as authorized=true plus approval_attestation=<!-- publish-approval ... -->.authorize-approval.js rejects self-approval: even with role_name:"write" and latest accepted event by contractor, it writes exactly authorized=false\n when the issue requester login is also contractor.publish: getsentry/relay@1.2.3 request by getsantry[bot], current accepted label event by sentry-internal-app[bot] ID "100", and matching createAutoApprovalAttestation() comment by github-actions[bot]; it writes authorized=true with standard approval_attestation and makes no /collaborators/ permission request.authorize-approval.js fails closed when GitHub returns permission lookup HTTP 404 for human contractor: main() throws Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404, does not log console.error, and does not append authorization output.auto-approve-repos.txt contains 46 exact allowlisted release paths, in order: 1. getsentry/arroyo; 2. getsentry/auto-type-annotate; 3. getsentry/devenv; 4. getsentry/infra-event-notifier; 5. getsentry/jest-sentry-environment; 6. getsentry/json-schema-diff; 7. getsentry/js-source-scopes; 8. getsentry/objectstore/clients; 9. getsentry/ophio; 10. getsentry/pdb; 11. getsentry/pyo3-python-tracing-subscriber; 12. getsentry/pytest-sentry; 13. getsentry/relay/py; 14. getsentry/responses; 15. getsentry/rust-proguard; 16. getsentry/rust-sourcemap; 17. getsentry/rust-usage-accountant; 18. getsentry/script-runner; 19. getsentry/sentry-api-schema; 20. getsentry/sentry-forked-djangorestframework-stubs; 21. getsentry/sentry-forked-django-stubs; 22. getsentry/sentry-forked-jsonnet; 23. getsentry/sentry-infra-tools; 24. getsentry/sentry-kafka-management; 25. getsentry/sentry-kafka-schemas; 26. getsentry/sentry-protos; 27. getsentry/sentry-redis-tools; 28. getsentry/service-registry; 29. getsentry/skrooge; 30. getsentry/snuba-sdk; 31. getsentry/statsdproxy; 32. getsentry/status-page-list; 33. getsentry/streams/sentry_streams; 34. getsentry/symbolic; 35. getsentry/taskbroker/clients; 36. getsentry/usage-accountant; 37. getsentry/watto; 38. getsentry/sentry; 39. getsentry/snuba; 40. getsentry/vroom; 41. getsentry/relay; 42. getsentry/symbolicator; 43. getsentry/taskbroker; 44. getsentry/uptime-checker; 45. getsentry/launchpad; 46. getsentry/self-hosted.