Distillation

Current State

• Date: Sep 8, 2026. Both repository PRs have now been admin-squash-merged after their exact heads were clean:
  • Publish PR #9339: https://github.com/getsentry/publish/pull/9339
    • Former branch/worktree: feat/workspace-acceptance in /home/byk/Code/getsentry/publish-workspace-acceptance
    • Final PR head was fd1e1156ae878a12a276af401a15a656bfff8127 (fd1e115 fix: address publish workspace review feedback)
    • Admin-squash-merged at Sep 8 17:37 as resulting commit 7c60ddb7f43040fe8fbfea70efc833f689c04e75 (7c60ddb).
    • All listed CI/security/bot checks were green before merge, but GitHub’s self-approval restriction prevented submitting an approval through the API (HTTP 422: Review Can not approve your own pull request); user explicitly authorized admin merges when ready.
  • Craft PR #872: https://github.com/getsentry/craft/pull/872
    • Former branch/worktree: feat/workspace-action-propagation in /home/byk/Code/getsentry/craft-workspace-action-propagation
    • Final PR head was fb1a705a01277570bf8564477b37eb4d561d1967 (fb1a705 fix: ignore broken workspace symlinks)
    • Merged at 2026-09-08T17:39:00Z as commit c8a878c53d937a62124796b39ac00f4d73212fe0 (c8a878c).
    • At final gate, it was non-draft, all checks—including Warden, Cursor Bugbot, and Seer—were green, and all review threads were resolved. It had remained REVIEW_REQUIRED solely because self-approval is prohibited.
• Active task: cut the Craft release from master using the repository’s established self-release flow. Inspect the release workflow and current master version before releasing. Do not infer or manually improvise release steps.
• Task tracking as of Sep 8 17:39:
  • Verify Publish PR #9339 exact merge gate: completed.
  • Verify Craft PR #872 exact merge gate: completed.
  • Admin-merge ready PRs: completed.
  • Cut Craft release after merge: pending/active, high priority.
• User authorization: at Sep 8 17:34, user authorized the assistant to admin-merge both PRs once determined ready. That authorization was used for both merges.
• User directives:
  • Always load repo-setup before situation skills.
  • Action publish titles always carry the full concrete workspace path.
  • .sentryclirc resolution must always check global locations as fallback after walking upward from cwd.
  • Workspace/CLI parsing must never interpret flags such as --workspace --dry-run as a workspace name.
  • For CLI scanning, excluded directories such as node_modules must never be opened; default walks must not re-enter directories, including via symlinks when following them.
  • Superseding parsing preference (Sep 8 17:36; originating from Sep 2 review on Publish PR #9339): replace all regexp-based parsing with Peggy. Future parsing work should use Peggy rather than introduce/retain regexp-based parsing where the directive applies.
• Background tasks:
  • ses_f7ecc9434ffeledouaoJSXmmtQ, started Sep 8 13:28 for CLI discovery inspection, completed Sep 8 13:49 with no directly reusable findings.
  • ses_f7e3cf790ffean2YR8MT3hLull, started Sep 8 16:04 for independent Craft audit, completed Sep 8 16:59 with MERGE.
  • ses_f7dfd0a94ffeFo9yAHzdIeQDqO, started Sep 8 17:14 for initial broken-symlink repair audit, completed Sep 8 17:17 with DO-NOT-MERGE; its two MUST-FIX findings were repaired.
  • ses_f7df4b4a4ffeQoqF7rJr5Uz3FG, started Sep 8 17:23 for hardened broken-symlink repair audit, completed Sep 8 17:25 with MERGE and no material findings.
  • Scheduled follow-ups lncluebd (created Sep 8 17:27) and gip4peqt (created Sep 8 17:29) were superseded by final Craft checks/merge.
• Outpost/Jared project operating context:
  • Root AGENTS.md directs autonomous GitHub coding work in /workspace/repo, pipeline: triage → explore → plan → implement → review → ship; worker is a deprecated alias of implement.
  • For target repos, read their AGENTS.md / CONTRIBUTING.md first; long-term Outpost knowledge is in .lore.md if present.
  • Outpost operator-chat turns skip triage and should treat the request as the task/conversation response.
  • Skills are .agents/skills/, generated from canonical skills/ by scripts/sync-skills.mjs.
  • Model tiers: heavy triage/plan/review = Jared / Claude Opus 4.8; light = Jared / xAI Grok 4.3; explore = OpenAI gpt-5-mini; implement = Moonshot kimi-k2.7-code; ship = xAI Grok grok-build-0.1.

Key Decisions

• Craft concrete workspace contract
  • Canonical Craft title identity is path-only: publish: getsentry/<checkout-repository>/<full-concrete-workspace-path>@<version>.
  • Legacy JSON-qualified workspace-title syntax was removed. getsentry/ remains optional only for parsing existing issues.
  • cli/v2 is a valid concrete multi-segment workspace directory path, not legacy compatibility syntax. Removing support would violate the full-path title/selection contract and break valid paths such as packages/CLI.
  • Test terminology was corrected rather than behavior removed: use “allows multi-segment workspace paths.”
  • Safe repository/path token policy is ASCII [A-Za-z0-9_.-]+, excluding ., .., __proto__, and segments beginning -; versions are Craft-compatible semantic versions and may contain + build metadata.
  • Semantic token/semver validation remains in src/modules/publish-issue-validation.js; Peggy remains syntactic, and poller/controller validation remains required.
  • After exact revision checkout, matching is exact and case-sensitive: root "." remains root; only exact ./<workspace> discovery matches are workspaces; otherwise suffix remains safe checkout path.
• Craft configuration/workspace discovery
  • Top-level workspaces: keys may be literal concrete paths or glob patterns. Patterns expand to concrete directories relative to .craft.yml; selected release runs require one concrete path through --workspace <path> or CRAFT_WORKSPACE.
  • craft workspace list outputs concrete workspace paths as a JSON array for automation.
  • Workspace path constraints: nonempty ASCII path segments containing letters, digits, ., _, and -; no ., .., __proto__, leading -, backslashes, absolute paths, unsafe glob syntax, or matching files. Overlapping workspace keys/patterns are rejected.
  • Workspace configuration cannot use github.projectPath; workflows cannot provide both path and a workspace.
  • Explicit workspace root is threaded through remote config loading; prepare --config-from resolves relative config against git rev-parse --show-toplevel.
  • Workspace glob support includes *, ?, character classes/negated classes, globstar, finite balanced braces; extglob is rejected.
  • Nested-brace expansion fails closed; existing matching requires lexical and physical realpath containment, directory-only behavior, node_modules exclusion, sorted POSIX paths, and ambiguity rejection before dedupe.
  • Final broken/racy candidate behavior: a glob candidate whose realpathSync() fails with ENOENT is skipped, covering broken symlinks and candidates removed between globbing and resolution. All other realpath failures—including ELOOP, EACCES, EPERM, and unexpected I/O errors—must propagate. This preserves fail-closed filesystem/error behavior while avoiding ENOENT failure for a vanished candidate.
  • Regression strategy must prove the candidate reaches the resolver: the Craft test verifies installed glob emits packages/broken, verifies the broken candidate is ignored, and separately verifies an unexpected ELOOP resolution error propagates. Explicit EACCES test coverage is not needed because the guard is explicitly code === 'ENOENT'.
  • CLI’s scan walker is not a reusable replacement for Craft workspace expansion. Craft resolver is synchronous, deterministic, glob/config-oriented, and stricter regarding exact paths and release safety. Adopting CLI async walking would require async propagation through config loading, while preserving sorted output, exact error behavior, and symlink containment.
  • Do not add parallel scanning without profiling evidence. CLI parallel walking is suited to broad content scans, has completion-order/channel complexity and about 7 ms per-file overhead, and is beneficial only for large exhaustive scans. Bounded concurrency/cancellation concepts may be borrowed only if workspace expansion becomes proven bottleneck.
• GitHub target/release workspace behavior
  • Workspace config example requires minVersion: 2.29.0, global GitHub { owner: getsentry, repo: toolkit }, packages/* configured with releaseBranchPrefix: release/cli and GitHub tagPrefix: "cli@", and tools/mcp with releaseBranchPrefix: release/mcp and GitHub tagPrefix: "mcp@".
  • If one release unit has multiple GitHub targets with differing tagPrefix values, Craft uses the first prefix for read-path operations and logs a warning. Independent products should use separate release workspaces.
  • GitHub’s Latest badge/release is repository-wide rather than tag-prefix-scoped. isLatestRelease uses the repository current Latest, so Latest may move between monorepo products; tags, changelogs, release branches, and version detection remain per-product.
• Release/publish workflow security
  • Required order: title parse/validate → issue-body revision authority parse → exact authoritative revision checkout → optional root .craft.yml workspace discovery → full-suffix classification → craft publish <version> --rev <revision>.
  • Craft state stays outside target checkout in $GITHUB_WORKSPACE/.craft-state/craft; state identity uses physical container cwd SHA-1, lossless base64url workspace identity, and conditional lossless version identity to avoid case/build-metadata collisions.
  • CRAFT_PUBLISH_STATE_GITHUB_REPO identifies checkout repository, never workspace release-repository override.
• Intentional latest Craft image
  • Rejected image pinning: controller uses getsentry/craft:latest because it must understand formats in the exact checked-out revision. CI-approved SHA plus craft publish --rev bind the actual release revision; a fixed image cannot safely support all historical/configured workspace formats.
  • Tests intentionally require latest and reject getsentry/craft:2.31.0.
  • Craft release remains an intentional deployment prerequisite for Publish: it must release with both workspace list and --rev; when root .craft.yml exists, discovery failure remains fail-closed because compact fallback could silently misroute a workspace request.
• Workflow JSON handoffs
  • @actions/core.setOutput() cannot safely transmit plain objects to fromJSON(): object outputs must use JSON.stringify.
  • PUBLISH_ARGS absent/empty parses as "{}"; workspace-list input as "[]". Required repo and path checks provide contextual errors instead of raw JSON.parse syntax errors.
  • resolve-release-revision.js missing repo error: Publish input must define a repository.
  • discover-location.js missing path error: Publish input must define a path.
• Peggy revision and merge-target authority
  • User preference is now to replace all regexp-based parsing with Peggy, superseding regexp parsing; this originated in the Sep 2 review of Publish PR #9339.
  • src/modules/publish-issue-title.peggy is canonical for PublishIssueTitle, ReleaseRevision, and CheckRunsLinkCount; generated parser start rules are exactly ["PublishIssueTitle", "ReleaseRevision", "CheckRunsLinkCount"].
  • ReleaseRevision requires canonical body-start header: requester, required Merge target, Quick links, View changes, then one repository-bound checks URL.
  • Parser returns { repo, mergeTarget, revision }; details-from-context.js gets Merge target solely through getReleaseRevisionDetails(), not arbitrary body regex scanning.
  • (default) becomes empty Craft merge_target; appended/decoy Merge target: fields cannot override canonical header.
  • Canonical Merge target grammar is constrained to (default) or documented branch-token characters: letters, digits, _, ., /, and -; unrestricted arbitrary non-newline values such as main; not-a-branch are rejected.
  • CheckRunsLinkCount counts all literal - [View check runs]( occurrences across body to reject inline/blockquote/trailing decoys.
  • Exact retained errors:
    • Count mismatch: Expected exactly one View check runs link in Quick links for getsentry/${repo}.
    • Header/repository parse failure: Expected a View check runs link for getsentry/${repo} in the publish issue body.
    • Invalid replacement SHA: Release revision must be a lowercase 40-character SHA.
• Revision/body preservation
  • updateReleaseRevision() accepts only /^[0-9a-f]{40}$/, then replaces parser-recorded [start,end) SHA offsets only.
  • CI-poller cannot use Bash command substitution for body transfer because it strips trailing newlines. It uses jq -jr/jq -ejr file-backed body input/output and gh issue edit --body-file.
  • Branch-move rewrite fails closed: resolver must succeed; .issueBody must be a nonempty string; only then can the body file be submitted to gh issue edit. Invalid/malformed JSON, top-level non-object/scalar values, missing property, non-string (null, boolean, number), empty string, JSON failure, and resolver failure skip without edit.
  • Each per-issue poller iteration is a cleanup subshell with an EXIT trap for body_file, resolver_output_file, and updated_body_file; failure/skip paths use exit 0 inside the subshell rather than invalid continue, so cleanup occurs before outer while advances.
• Generated documentation
  • Generator extracts grammar only between // BEGIN TITLE GRAMMAR / // END TITLE GRAMMAR; docs use <!-- BEGIN GENERATED TITLE GRAMMAR --> / <!-- END GENERATED TITLE GRAMMAR -->.
  • Generator fails closed for missing, duplicate, or malformed marker-like documentation fragments—not merely exact duplicate complete pairs—to ensure one unambiguous generated grammar region.
  • Docs explicitly state Merge target is required and its restricted branch-token contract.
• Checkout scope
  • Scoped controller/target checkouts in .github/workflows/publish.yml and controller checkout in .github/workflows/ci-poller.yml use actions/checkout@v7.
  • Do not upgrade unrelated .github/workflows/test.yml or .github/workflows/auto-approve.yml in this PR; that is unrelated scope expansion.
• Sentry CLI operational context
  • Before working in CLI code, read packages/cli/AGENTS.md and .cursor/rules/ultracite.mdc.
  • CLI lives in packages/cli of a pnpm workspace; it is Node.js/pnpm/Stricli, with docs at apps/cli-docs.
  • It has no runtime dependencies: packages must be added with pnpm add -D <package> and remain in devDependencies; CI enforces this with pnpm run check:deps.
  • Use Node APIs, not Bun: no Bun.*, bun:test, or Bun CLI. Use node:fs/promises read/write APIs, node:fs existsSync, child-process spawn/execFile/execSync, src/lib/which.ts, src/lib/scan/, and node:timers/promises.
  • Create directories with mkdirSync(dir, { recursive: true, mode: 0o700 }); prefer array-argument execFileSync for user-controlled values to avoid shell injection.
  • Use direct @sentry/api API-response types rather than redundant Valibot schemas in src/types/sentry.ts.
  • Command conventions: import buildCommand from ../../lib/command.js, use async *func() generators, yield new CommandOutput(data), return { hint }, and let shared output rendering serialize the same data. Do not add custom JSON flags, write stdout manually, branch on flags.json, or write stderr from command files; use logger diagnostics and formatter modules.
  • Route groups import buildRouteMap from ../../lib/route-map.js, which supplies aliases such as list→ls, view→show, delete→remove/rm, and create→new.
  • .sentryclirc resolution already walks upward from cwd then applies global fallback locations afterward, using getGlobalPaths(), applyGlobalFallbacks(), tryApplyFile(), walkUpFrom(cwd), and loadSentryCliRc(). Global paths are cached in globalPaths, and tests reset it when SENTRY_CONFIG_DIR changes.
  • packages/cli/src/lib/walk-up.ts provides async function* walkUpFrom(startDir: string), resolving the start path, yielding absolute ancestors, and using realpath() plus a seen set to stop on broken/denied paths or symlink cycles.
  • packages/cli/src/lib/scan/walker.ts is a streaming DFS file scanner, not workspace discovery. It applies IgnoreMatcher before descent, ignores node_modules-like directories without opening them, emits sorted POSIX-normalized regular files only, skips symlinks unless enabled, and seeds visited inodes with root when following symlinks to prevent subtree re-entry. It supports deterministic serial walking and bounded parallel exhaustive scanning.

Technical Changes

Craft worktree: /home/byk/Code/getsentry/craft-workspace-action-propagation

• Completed and merged workspace implementation:
  • Branch feat/workspace-action-propagation
  • Commit d48b906 feat: support concrete release workspaces
  • Created Sep 5, 2026 03:34; pushed Sep 5 03:43, range 4862056..d48b906
  • 9 files, 684 insertions / 44 deletions:
    • action.yml
    • docs/src/content/docs/targets/github.md
    • src/__tests__/action.test.ts
    • src/__tests__/config.test.ts
    • src/commands/prepare.ts
    • src/config.ts
    • src/schemas/project_config.ts
    • src/utils/__tests__/publishState.test.ts
    • src/utils/publishState.ts
• Terminology correction:
  • Commit f174cea test: describe workspace paths accurately
  • Committed/pushed Sep 8 16:03; remote advanced d48b906..f174cea.
  • Changed src/__tests__/config.test.ts only: one insertion/one deletion, rename from allows legacy workspace names to allows multi-segment workspace paths.
  • Retained test behavior: validateConfiguration({ workspaces: { 'cli/v2': {} } }) does not throw.
• Broken-symlink glob repair:
  • Cursor Bugbot finding was at src/config.ts#L249-L260 (initially cited around line 252): realpathSync(resolvedMatch) ran before directory filtering and threw ENOENT for a broken symlink matched by a glob such as packages/*.
  • Initial regression at Sep 8 17:11 reproduced baseline failure: workspaces > ignores broken symlinks matched by workspace globs; failure was ENOENT from /tmp/craft-workspaces-EYzONj/packages/broken, stack getWorkspaceGlobMatches (src/config.ts:250) → getWorkspaceNamesFromConfig (src/config.ts:210) → getWorkspaceNames (src/config.ts:622) → test (src/__tests__/config.test.ts:522).
  • An initial uncommitted broad catch { return false; } passed tests but was rejected by audit at Sep 8 17:17 because it swallowed EACCES, EPERM, ELOOP, and unexpected I/O errors, and the fixture had not proven globSync emitted the symlink.
  • Final repair commit: fb1a705 fix: ignore broken workspace symlinks
    • Committed/pushed Sep 8 17:26; remote advanced f174cea..fb1a705.
    • Exact final head: fb1a705a01277570bf8564477b37eb4d561d1967.
    • Changed only src/config.ts and src/__tests__/config.test.ts, with 53 insertions / 1 deletion.
    • getWorkspaceGlobMatches() now catches only realpathSync(resolvedMatch) errors where error.code === 'ENOENT' and returns false for that candidate; it rethrows all other resolution errors.
    • Existing lexical safe-path validation/containment, physical realpath containment, directory-only filtering, node_modules exclusion, ambiguity behavior, and deterministic .sort() are preserved.
    • Regression test ignores broken symlinks matched by workspace globs creates temporary packages/cli and broken packages/broken symlink targeting missing-workspace, writes .craft.yml with minVersion: ${WORKSPACES_MIN_VERSION} and workspaces: packages/*, proves globSync emits the broken candidate, and expects getWorkspaceNames() to yield only ['packages/cli'].
    • Additional hardened regression proves unexpected ELOOP realpath failure propagates.
  • The repaired change was independently audited at Sep 8 17:25 with verdict MERGE, no MUST-FIX/CONCERN/FAIL/material coverage gap. It verified installed glob emission at src/__tests__/config.test.ts:523-525, ENOENT-only skip at src/config.ts:253-259, non-ENOENT rethrow at src/config.ts:260, safety checks at src/config.ts:263-271, and clean exact diff from f174ce….
  • Craft PR #872 merged at Sep 8 17:39 as c8a878c53d937a62124796b39ac00f4d73212fe0.
• Important Craft implementation:
  • loadConfigurationFromString(configContent, workspaceDirectory = process.cwd()); config-from resolves against Git top-level.
  • src/config.ts:210-229: a concrete workspace matching multiple configured patterns throws ConfigurationError: Workspace "${workspaceName}" matches multiple workspace patterns: ${matchingKeys.join(', ')}.
  • src/config.ts:231-271/final shifted lines: getWorkspaceGlobMatches() validates glob safety, uses globSync(... { absolute: false, cwd: root, dot: true, ignore: ['**/node_modules/**'], posix: true }), skips only ENOENT-unresolvable candidates, and admits sorted safe lexical/realpath-contained directories.
  • src/config.ts:269-390 originally contained path/glob safety and balanced-brace helpers duplicating analogous project_config.ts helpers. isWorkspacePattern() uses hasMagic(... { magicalBraces: true }).
  • src/config.ts:392-409: isVersionGteMinVersion() is a pure config-resolution-safe check and returns false for absent/unparseable versions.
  • src/schemas/project_config.ts:208-215: WorkspaceSchema accepts release-unit fields and partial GitHub config but rejects workspace github.projectPath with Workspace github.projectPath is not supported.
  • src/schemas/project_config.ts:219-334: workspace glob safety rejects unsafe empty/dot/parent/prototype/leading-dash segments; supports safe glob magic and finite balanced brace alternatives; unsafe paths raise Workspace paths must use safe ASCII segments.
  • src/schemas/project_config.ts:322-334: literal multi-segment paths are accepted without normalization.
  • src/commands/prepare.ts:806-812 resolves remote config workspace globs relative to Git top-level; src/config.ts:597-606 accepts the explicit root for string config.
  • action.yml:74-92: validate before side effects; :191-224: clear inherited CRAFT_WORKSPACE; :245-275: emit complete exact titles.
  • src/utils/publishState.ts:51-105: preserve workspace/version identities losslessly.
• Craft schema details:
  • CalVerConfigSchema: optional offset: z.number() (default documented as 14) and optional format: z.string() (default %y.%-m; supports %y, %m, %-m).
  • VersioningConfigSchema: optional policy of auto, manual, or calver, plus optional calver.
  • ChangelogConfigSchema: string or object with optional filePath, policy (auto, simple, none), and scopeGrouping.
  • releaseUnitFields: optional github, targets, preReleaseCommand, postReleaseCommand, releaseBranchPrefix, changelog, changelogPolicy, requireNames, statusProvider, artifactProvider, versioning, and noMerge; noMerge defaults to true for compiled GitHub Actions with dist/.
  • WorkspaceSchema uses all optional release-unit fields, with partial workspace GitHub settings that inherit missing top-level values.
  • WorkspaceNameSchema errors:
    • Workspace name "__proto__" is not supported.
    • Workspace names cannot be "." or "..".
    • Workspace paths must use safe ASCII segments.
  • CraftProjectConfigSchema.superRefine() rejects top-level github.projectPath when workspaces exist with Workspace configurations cannot use github.projectPath..
• Craft verification:
  • Pre-commit verification Sep 4 22:52: full Vitest 61 files / 1197 pass / 1 skipped / 1198 total; lint 0 errors with 7 established unused-variable warnings; tsc --noEmit, format, build, and git diff --check passed.
  • Sep 8 13:57 focused command vitest run -- src/__tests__/config.test.ts actually ran the full suite: 61 test files passed, 1,197 tests passed, 1 skipped (1,198 total), duration 62.99s.
  • Sep 8 17:11 baseline regression run: 61 test files total, 60 passed/1 failed; 1,199 total tests, 1,197 passed/1 failed/1 skipped; duration 42.36s.
  • Sep 8 17:13 after initial repair: 61 test files passed, 1,198 passed/1 skipped (1,199 total), duration 31.71s.
  • Sep 8 17:22 after hardened repair: 61 test files passed, 1,199 passed/1 skipped (1,200 total), duration 39.46s. Replacement audit additionally ran pnpm vitest run src/__tests__/config.test.ts --printConsoleTrace, with 69 focused tests, plus pnpm typecheck.
  • eslint --cache --cache-strategy content consistently had 0 errors and 7 established @typescript-eslint/no-unused-vars warnings: src/commands/publish.ts _abortError at lines 482, 499, and 527; _statusError at 515; _diffError at 521; src/utils/git.ts _err at lines 241 and 249.
  • prettier --check ., typecheck, node build.mjs, and git diff --check passed. Build skipped source-map upload because SENTRY_AUTH_TOKEN was absent.
  • Test runs emitted established Vite/esbuild SSR warnings in src/targets/__tests__/symbolCollector.test.ts:58-60,68-70 that assignments to imported checkExecutableIsPresent will throw, and remote-ref/branch fetch failures that used cached refs.
  • Independent initial audit Sep 8 16:59 ran: pnpm exec tsc --noEmit --incremental false; Prettier on every changed file; focused Vitest across 5 files with 141 passing; full Vitest across 61 files with 1,197 passing / 1 skipped; ESLint 0 errors. Five unchanged no-unused-vars warnings in publish.ts also exist on origin/master.
  • Audit noted one nonblocking coverage gap: no direct prepareMain mock assertion that --config-from passes git rev-parse --show-toplevel into workspace resolution; existing loadConfigurationFromString coverage verifies equivalent root contract.
• Craft PR #872 reviews/status:
  • Resolved directory-pattern request: docs/src/content/docs/targets/github.md:89, original line 87, comment PRRC_kwDOCDHbwM7pfr4E, created Sep 2 18:33:13 UTC.
  • Resolved outdated terminology request: src/__tests__/config.test.ts:164, original line 163, comment PRRC_kwDOCDHbwM7pftIQ, created Sep 2 18:33:53 UTC. Reply/resolve occurred Sep 8 17:00 at https://github.com/getsentry/craft/pull/872#discussion_r3960329900.
  • Cursor Bugbot finding: bug ID 294d500e-a01e-4627-af9f-b3d497c9b290, original discussion https://github.com/getsentry/craft/pull/872#discussion_r3960382720. It was addressed by fb1a705; a response documenting the constrained ENOENT fix and regressions was posted Sep 8 17:28 at https://github.com/getsentry/craft/pull/872#discussion_r3960550044.
  • Cursor Bugbot passed fb1a705 with no new finding; Seer completed successfully at Sep 8 17:30:08; Warden was last to complete and was green by Sep 8 17:38.
  • Final PR checks all succeeded: Build & Test (Node 22, Node 24, Build, Build Docs), Changelog Preview/Semver Impact, CodeQL, Dependency Review, Docs Preview, license compliance, Lint, Secret Scan, Warden including security review, image, Cursor Bugbot, Seer Code Review, Socket Security, and Semgrep.
• Other discovered Craft worktrees at Sep 8 13:15:
  • /home/byk/Code/getsentry/craft: b06435e4f20ff8cb0470de98ee113051978b3d63, byk/fix/commit-on-repo
  • /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/calm-circuit: 5d533c854ad481c31162c4e003cabe23ac5e900a, feat/ci-ready-signal
  • .../calm-squid: 347ade0345dc9f46bce480600ca2beef66100c8f, fix/postcss-security-alert
  • .../stellar-falcon: fc4c1d00d721eb76d9ccc46f841cb2b4b03ed665, byk/fix/dependabot-alerts-865
  • .../swift-squid: 752a693b6ddc3d9b855ddb921e3f91d6e3a847b8, fix/flaky-zip-test
  • /home/byk/Code/getsentry/craft-vercel-prebuilt-output: 3f701f5458f5dee92c730b9c7352d1e5b6ef2b56, fix/vercel-prebuilt-output
  • /home/byk/Code/getsentry/craft-vercel-project-config: 3cceffbf4d6e697c535ec11f83652bcb11800a06, fix/vercel-project-config
  • /home/byk/Code/getsentry/craft-workspaces-schema: ab635721cdaee8a3fe5ec853505e68ff76f8b9c5, feat/workspaces-schema
  • /tmp/opencode/pr865: 51cab289873990824bcfc9c17e7309c430ea2059, byk/pr865-fixes; marked prunable because its gitdir points to a nonexistent location.
• GitHub reported 9 vulnerabilities on Craft’s default branch Sep 8 17:26: 7 high, 1 moderate, 1 low; https://github.com/getsentry/craft/security/dependabot.

Publish worktree: /home/byk/Code/getsentry/publish-workspace-acceptance

• Publish PR #9339 is merged:
  • Former branch: feat/workspace-acceptance.
  • Final PR head: fd1e1156ae878a12a276af401a15a656bfff8127.
  • Base before merge: 83d210b29553ea6f4d97508821724a834c43856e.
  • Admin-squash merge at Sep 8 17:37 resulted in 7c60ddb7f43040fe8fbfea70efc833f689c04e75.
• Baseline PR/branch history:
  • Earlier commits: b658ffa fix: validate publish workspace JSON, 52ef600 feat: resolve compact workspace publish requests, a81ab03 feat: resolve workspace publish paths.
  • Baseline a81ab03 was pushed Sep 5 03:46 (52ef600..a81ab03), with 13 files / 308 insertions / 539 deletions and new src/modules/publish-issue-validation.js.
• Final review-fix commit:
  • fd1e115 fix: address publish workspace review feedback
  • Committed and pushed Sep 8 13:01; remote moved a81ab03..fd1e115.
  • Changed 21 files: 1,509 insertions / 96 deletions.
  • New files:
    • src/modules/__tests__/ci-poller-workflow.js
    • src/modules/__tests__/generate-publish-issue-title-parser.js
    • src/publish/__tests__/discover-location.js
    • src/publish/__tests__/resolve-location.js
    • src/publish/__tests__/resolve-release-revision.js
    • src/publish/discover-location.js
  • Other committed modified files:
    • .github/workflows/ci-poller.yml
    • .github/workflows/publish.yml
    • docs/publish-issue-format.md
    • scripts/generate-publish-issue-title-parser.js
    • src/modules/__tests__/details-from-context.js
    • src/modules/__tests__/publish-workflow.js
    • src/modules/__tests__/release-revision.js
    • src/modules/details-from-context.js
    • src/modules/publish-issue-title.js
    • src/modules/publish-issue-title.peggy
    • src/modules/release-revision.js
    • src/publish/inputs.js
    • src/publish/resolve-ci-poller-input.js
    • src/publish/resolve-location.js
    • src/publish/resolve-release-revision.js
• Existing/preserved functionality:
  • src/modules/publish-location.js validates safe paths/workspace names; discovery-invalid error: Craft workspace discovery returned an invalid workspace list. Exact matching is case-sensitive.
  • details-from-context.js and ci-poller-input.js validate title fields before state, checkout, Craft, network, or cross-repository API work.
  • Publish remains gated by fresh ci-ready, accepted + ci-ready, open issue, no pending/failed labels, 90-minute timeout.
  • Exact target checkout remains ref: ${{ steps.release-revision.outputs.revision }}, path __repo__, Release Bot token, fetch-depth: 0; craft publish ... --rev and state behavior remain preserved.
  • workflow_dispatch remains in ci-poller.yml, optional internal attempt default "0".
• Workflow input/discovery changes:
  • src/publish/inputs.js: core.setOutput("result", JSON.stringify(result)).
  • src/publish/resolve-location.js: parses PUBLISH_ARGS || "{}" and CRAFT_WORKSPACE_NAMES || "[]", serializes location output.
  • src/publish/resolve-release-revision.js: parses PUBLISH_ARGS || "{}" and requires repo.
  • New src/publish/discover-location.js exports getWorkspaceNames({ repositoryDirectory, exists = existsSync, execFile = execFileSync }) and discoverLocation(...); missing root .craft.yml returns []; root config invokes Docker/Craft workspace list; blank/malformed/non-array/unsafe lists fail closed; serialized output.
  • .github/workflows/publish.yml invokes node .__publish__/src/publish/discover-location.js with PUBLISH_ARGS and PUBLISH_REPOSITORY_DIRECTORY: __repo__.
  • .github/workflows/publish.yml:120 and :159, plus .github/workflows/ci-poller.yml:52, use actions/checkout@v7; unrelated test.yml:19 and auto-approve.yml:16 remain unchanged.
• Peggy/parser/revision implementation:
  • src/modules/publish-issue-title.peggy:7-34 contains title grammar markers; :36-85 contains canonical strict release header/merge-target parsing.
  • Header requires requester, Merge target, Quick links, View changes, and repository-bound checks URL with a lowercase SHA; supports LF/CRLF and optional terminal /checks/ slash; starts at body byte zero.
  • Sep 8 02:48 parser shape bug (NonNewline yielded merge-target character arrays) was fixed via string capture conversion; parser regenerated.
  • src/modules/release-revision.js:7-45 uses generated parser, globally counts duplicate check-runs link prefixes, validates repository binding, and indexed-replaces only canonical SHA offsets.
  • src/modules/details-from-context.js:54-75 draws Merge target only from canonical parser output.
• CI-poller exact-body/failure-safety:
  • src/publish/resolve-ci-poller-input.js reads UTF-8 PUBLISH_ISSUE_BODY_FILE when set, otherwise PUBLISH_ISSUE_BODY || "".
  • .github/workflows/ci-poller.yml:157-162 rejects invalid rewrite shapes and requires a nonempty string .issueBody.
  • src/modules/__tests__/ci-poller-workflow.js executes extracted actual workflow shell with fake node, mktemp, and gh.
  • Following the Sep 8 04:02 DO-NOT-MERGE audit finding, the harness was expanded to cover malformed resolver JSON and non-object/scalar rewrite responses, in addition to missing, non-string, and empty .issueBody, resolver failure, exact valid-body preservation, no issue edit on failures, and temporary-file cleanup. It covers six error/body-preservation paths.
• Generator/docs:
  • scripts/generate-publish-issue-title-parser.js:26-49 rejects missing, duplicate, and malformed marker-like generated documentation regions.
  • Parser/docs title grammar parity is in src/modules/publish-issue-title.peggy:7-34 and docs/publish-issue-format.md:12-41.
• Final verification/audits:
  • Sep 8 03:56: lint, generated check, full suite 14 files/92 tests, and git diff --check passed.
  • Sep 8 04:02 read-only audit found coverage gap for non-string/non-object/malformed resolver output; direct audit checks passed (git diff --check a81ab03, generated check, lint), but full test was intentionally not run under read-only constraint.
  • Sep 8 04:03: focused yarn vitest run src/modules/__tests__/ci-poller-workflow.js passed 1 file/6 tests in 704 ms. Full verification then passed: ESLint, generated check, Vitest 14 files/94 tests in 3.86s, and git diff --check.
  • Sep 8 04:14–04:15 final read-only audit returned MERGE with no CRITICAL/MAJOR/MINOR findings. It verified canonical body header/authoritative merge target, SHA parsing and duplicate prevention, byte-preserving rewrite, fail-closed poller updates/cleanup, parser/doc generation validation, JSON handoffs, scoped v7 checkouts, CI gating/manual dispatch/exact-SHA checkout/discovery/latest Craft, and diff hygiene.
  • That final read-only review deliberately did not execute full Vitest because src/modules/__tests__/ci-poller-workflow.js:40-49,146-150 creates/deletes temp files, contrary to read-only audit constraints.
  • No CocoaPods files/configuration changes are in the final diff.
  • Before Sep 8 17:37 merge, all listed PR checks succeeded: CodeQL Analyze (actions/javascript), Dependency Review, Secret Scan, unit tests, Warden (warden and warden: security-review), Cursor Bugbot, Seer Code Review, Socket Security Project Report/Pull Request Alerts, and semgrep-cloud-platform/scan.
• Tooling:
  • Publish uses Volta Node 24.0.0, Yarn 1.22.22.
  • Scripts: generate, check:generated, test = yarn check:generated && vitest run, lint = eslint src .github --ignore-pattern '!.github'.
  • Worktree is not jj: Error: There is no jj repo in "."; use Git.
  • GitHub reported 22 default-branch dependency vulnerabilities on Publish: 12 high, 8 moderate, 2 low; https://github.com/getsentry/publish/security/dependabot.

Session Timeline

• Sep 3–5, 2026:
  • Implemented concrete Craft workspace behavior and Publish canonical path-only title/location behavior.
  • Craft commit d48b906 feat: support concrete release workspaces created Sep 5 03:34, pushed 03:43.
  • Publish commit a81ab03 feat: resolve workspace publish paths created Sep 5 03:40, pushed 03:46.
  • Sep 5 02:05 evidence audit returned MERGE, no findings.
• Sep 5 13:10–Sep 7 19:02:
  • Reviewed PR #9339 feedback: output serialization/fallbacks, checkout v7, discovery Node script, docs/grammar source of truth, Peggy revision consolidation, and fail-closed contracts.
• Sep 7 23:56–Sep 8 04:15:
  • Implemented, audited, fixed, verified, and completed final MERGE audit for Publish PR #9339 review repairs.
• Sep 8 12:56–13:02:
  • User asked status of unresolved PR #9339 review comments.
  • Confirmed six unresolved GitHub threads were addressed locally, but PR still pointed to a81ab03 and required review.
  • User requested push at 13:01. Committed review fixes as fd1e115 (21 files, +1,509/-96) and pushed successfully.
  • Confirmed PR #9339 head at exact fd1e1156ae878a12a276af401a15a656bfff8127; review decision remained REVIEW_REQUIRED, with CI beginning.
• Sep 8 13:12–13:33:
  • User redirected active work to Craft PR #872’s unaddressed review comment and requested consideration of CLI directory-walking reuse.
  • Inspected Craft worktrees/PR state and identified resolved directory-pattern request plus unresolved legacy-workspace-name removal request.
  • User issued directive to load repo-setup before situation skills; Outpost AGENTS.md instructions were read.
  • Background CLI discovery inspection began at 13:28.
• Sep 8 13:34–13:53:
  • User clarified that Action titles carry full concrete workspace paths and provided workspace configuration, constraints, compatibility, list-output, tag-prefix ambiguity, and GitHub Latest limitations.
  • Established that cli/v2 is a valid concrete path, not legacy syntax; user explicitly requested test renaming instead of removal.
  • Inspected CLI guidance, .sentryclirc upward/global resolution, walk-up.ts, and scan walker.
  • Concluded CLI scan walker is not a safe direct reuse for Craft workspace discovery due to synchronous deterministic Craft config requirements and stronger glob/containment contracts.
• Sep 8 13:54–13:58:
  • First patch failed because it expected it(...); actual test used test('allows legacy workspace names', ...).
  • Renamed label to allows multi-segment workspace paths.
  • Full Craft suite passed: 61 files, 1,197 pass, 1 skipped, 1,198 total.
• Sep 8 15:30–15:31:
  • User asked whether CLI walker features, including parallel async scanning, could be reused.
  • Compared CLI serial/parallel walker semantics with Craft globSync discovery; recommended against introducing async walker complexity unless profiling proves a workspace-expansion bottleneck.
• Sep 8 15:51–16:03:
  • User stated work could be ready if bot and independent reviews found no issues.
  • Committed/pushed terminology fix f174cea at 16:03; exact PR head became f174ceafa57355e71617f32ba1b0a030953be0a2.
  • PR initially remained draft, blocked, review-required; CI began on exact head. Independent read-only audit task began at 16:04.
• Sep 8 16:59–17:00:
  • Independent audit returned MERGE with no findings; all reported CI/security checks passed.
  • Replied to and resolved the outdated terminology review thread.
  • Marked Craft PR #872 ready for review/non-draft. It remained blocked and review-required because a fresh approval was required.
• Sep 8 17:00–17:10:
  • Cursor Bugbot and Seer Code Review started. Seer completed successfully at 17:03:57Z with no findings.
  • Cursor Bugbot completed at 17:06:43Z with NEUTRAL and opened valid medium-severity finding 294d500e-a01e-4627-af9f-b3d497c9b290: broken symlink workspace glob candidates threw from realpathSync before directory filtering.
  • At Sep 8 17:10, a test-file modification was applied to add regression coverage.
• Sep 8 17:11–17:13:
  • The new regression reproduced the Bugbot baseline failure: realpathSync threw ENOENT for a broken /tmp/craft-workspaces-EYzONj/packages/broken candidate. Full suite had 60 passed/1 failed test file; 1,197 passed/1 failed/1 skipped tests.
  • Applied initial production guard; focused/full suite then passed 1,198 tests with 1 skipped, plus typecheck/format/build/diff checks. Lint retained only 7 established warnings.
• Sep 8 17:14–17:17:
  • Initial independent audit ses_f7dfd0a94ffeFo9yAHzdIeQDqO returned DO-NOT-MERGE.
  • It rejected unconditional error swallowing and insufficient fixture proof that glob emitted the broken link.
  • Accepted findings; planned ENOENT-only handling and deterministic/proven resolver-path coverage.
• Sep 8 17:18–17:25:
  • Inspected test/config imports and updated src/config.ts plus src/__tests__/config.test.ts.
  • Hardened behavior skips only ENOENT, rethrows other realpath errors, proves glob emits the broken symlink, and adds ELOOP propagation coverage.
  • Focused/full test execution passed: 61 files, 1,199 passed/1 skipped, 1,200 total; typecheck/lint/format/build/diff checks passed, with only 7 established lint warnings.
  • Replacement audit ses_f7df4b4a4ffeQoqF7rJr5Uz3FG returned MERGE at 17:25.
• Sep 8 17:26–17:33:
  • Committed/pushed hardened repair fb1a705 fix: ignore broken workspace symlinks; PR #872 head advanced from f174cea to exact fb1a705a01277570bf8564477b37eb4d561d1967.
  • Fresh CI began. Replied to resolved Bugbot thread at https://github.com/getsentry/craft/pull/872#discussion_r3960550044.
  • Cursor Bugbot passed the new head without a new finding; Seer passed at 17:30:08; Warden was the final running check.
• Sep 8 17:34–17:39:
  • User authorized admin merging of both PRs once ready.
  • User stated the standing preference to replace all regexp-based parsing with Peggy.
  • Verified Publish PR #9339 checks all green. Attempted API self-approval failed at 17:37 with HTTP 422: Review Can not approve your own pull request.
  • Admin-squash-merged Publish PR #9339 at 17:37 as 7c60ddb7f43040fe8fbfea70efc833f689c04e75.
  • Verified Craft PR #872 Warden and all remaining checks green; no unresolved review threads.
  • Admin-squash-merged Craft PR #872 at 2026-09-08T17:39:00Z as c8a878c53d937a62124796b39ac00f4d73212fe0.
  • Began next task: inspect Craft’s established release workflow and current master version, then release Craft through its self-release path.