Dashboard › publish › Distillation
cb2a3e93-7940-4684-a4b7-807885590a04["lore_tm_v1_W70zWZBJioRgQfa1OveywWKdv-Czd56eMn-beYdBI80","lore_tm_v1_Hf4Z1RzdvqxnHd8O7lFebDPszfkQJBIHgxCyjYLQtdA","lore_tm_v1_MnX_xj1nAlmtnWyavArgr4yLB6A9t-ISuKU3E1pGWKE","lore_tm_v1_yiaLGv4n4oivHxgso00zyL2kBKmSGx832y-QPeg6aaw","lore_tm_v1_q77rw6JNPohnvYqYGH-_WKyLz8CXxLAZuxJ7CU5pPxI","lore_tm_v1_89qboNU5PBXEfpL7AFUx_DpEGrHsMe8LQUQyZ6wFGO8","lore_tm_v1_iEw7w4FlUkL_7wanI0sp7u7-wiCGF-rZK7Loi3VykXE","lore_tm_v1_tx2U0RdGH8drAV9wA0_Cr3bdN8PgVi0kGBpOH3wflLg","lore_tm_v1_v-I6SP-ANoExYVO1wtHnOSDUAByxru_NcMoZ8VBU1dA","lore_tm_v1_AI6RyfPWtrMnHTC2_CMC7Dw0737-9GbF-W7f3fA18Us","lore_tm_v1_zhQ6c92oUppMs8X2zrcH8w2gehcV9aNx8HvDuFjjUs4","lore_tm_v1_RXriCOF-649u3Tpt8O2E4KFgFE-hbN6lVoL5NsXDvNc","lore_tm_v1_7Uv0nCaOBg1ZYNWnA6ps3BhxDvZPUzAD3xTMIlI_xHc"]
Date: Sep 8, 2026
src/publish/current-accepted-event.js exports getCurrentAcceptedEvent({ getIssueEvents, issueNumber, repository }), which fetches issue events, returns currentAcceptedEvent(events), and throws "The issue has no current accepted label event" if none exists. Its CLI requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY, gets paginated "events" through getAllPages(), and writes the selected { actor, eventId } JSON to stdout; missing environment variables throw exact No "{NAME}" environment variable found errors./home/byk/Code/getsentry/publish/: publish scripts record-auto-approval-attestation.js, current-accepted-event.js, record-ci-ready-attestation.js, validate-approval-attestation.js, authorize-approval.js, update-issue.js, post-workflow-details.js, post-result.js, inputs.js; modules approval-attestation.js, approval-authorizer.js, update-issue.js, process-end-state.js, post-workflow-details.js, details-from-context.js; GitHub library src/libs/github.js; and corresponding test files including publish-workflow.js, auto-approval-workflow.js, ci-poller-workflow.js, current-accepted-event.js, record-ci-ready-attestation.js, record-auto-approval-attestation.js, validate-approval-attestation.js, authorize-approval.js, approval-attestation.js, approval-authorizer.js, update-issue.js, process-end-state.js, post-workflow-details.js, details-from-context.js, and github.js.src/publish/__tests__/authorize-approval.js verifies getAutoApprovedRepositories() loads exact allowlist paths getsentry/sentry-javascript and getsentry/objectstore/clients; successful human authorization for contractor approving publish: getsentry/sentry-javascript@10.0.0 uses GitHub GET /repos/getsentry/sentry-javascript/collaborators/contractor/permission with Authorization: Bearer release-bot-token and writes authorized=true plus a <!-- publish-approval ... --> attestation.authorize-approval entry-point tests verify it writes authorized=false\n when requester contractor self-approves; authorizes sentry-internal-app[bot] for open publish: getsentry/relay@1.2.3 requested by getsantry[bot] only with an auto-approval attestation comment by github-actions[bot], without collaborator lookup; rejects direct sentry-release-bot[bot] approval without any GitHub request; and propagates failed permission lookup as "Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404" without writing output or logging to console.error.src/publish/__tests__/validate-approval-attestation.js verifies validateApprovalAttestation() accepts a trusted current approval attestation, but returns false if the issue title/body/dry-run state changes, the "accepted" label is removed, the issue closes, the accepted label is re-added with a newer event ID, or expectedAcceptedEvent differs from the newest accepted event.{ actor: "contractor", eventId: "100" }, with current CI-ready event { actor: "sentry-internal-app[bot]", eventId: "200" }; a manually added "ci-ready" label by contractor causes validation to return false even if an otherwise matching attestation exists.src/publish/__tests__/publish-workflow.js enforces that .github/workflows/publish.yml runs "Revalidate approval attestation" after "Set targets" and before "Publish using Craft", with REQUIRE_CI_READY_ATTESTATION: "true" in that trailing workflow section; it also requires Craft to be pinned as docker://getsentry/craft@sha256: followed by exactly 64 lowercase hexadecimal characters.src/publish/__tests__/auto-approval-workflow.js enforces .github/workflows/auto-approve.yml runs node src/publish/record-auto-approval-attestation.js before --add-label accepted; the workflow posts "Post automated approval attestation" with GH_TOKEN: ${{ github.token }} before labeling, then uses GH_TOKEN: ${{ steps.token.outputs.token }} after the proof step.src/publish/__tests__/ci-poller-workflow.js enforces .github/workflows/ci-poller.yml checks out trusted publish code via actions/checkout@v6 at ${{ github.event.repository.default_branch }} in "Get publish code" before "Get auth token".src/modules/__tests__/approval-authorizer.js verifies direct approval by getsantry[bot] or sentry-release-bot[bot] is rejected for getsentry/sentry-javascript without calling getPermission, including when the provided allowlist excludes that repository. Human contractor approval is authorized only for collaborator roles "write", "maintain", or "admin"; "none", "read", "triage", "Elevated Bot", and undefined are rejected.authorizeApproval() tests verify unqualified title publish: sentry-javascript/packages/core@10.0.0 resolves to repository getsentry/sentry-javascript and queries permission with { owner: "getsentry", repository: "sentry-javascript", username: "contractor" }; malformed titles publish: @1.0.0 and publish: getsentry/sentry-javascript return { authorized: false, repository: null } without GitHub lookup; permission errors such as "Not Found" propagate.src/modules/__tests__/approval-attestation.js verifies latest accepted event ID "200" supersedes "100", numeric GitHub event ID 29503999078 is returned as string "29503999078", and CI-ready attestation matching requires both the bound accepted event and CI-ready label actor. It rejects attestations from an untrusted comment author, stale event/title/digest data, malformed payload <!-- publish-approval not-base64 -->, and a changed "dry-run" label state.src/publish/__tests__/record-ci-ready-attestation.js verifies a successful CI-ready attestation records acceptedActor: "contractor", acceptedEventId: "100", ciReadyActor: "sentry-internal-app[bot]", a string requestDigest, and the unchanged publish title. It rejects title/event changes, including re-approval from expected accepted event ID "100" to current ID "200", with "The approval changed before CI could be marked ready".src/publish/__tests__/record-auto-approval-attestation.js verifies automated requester getsantry[bot] can create an auto-approval attestation bound to live open request publish: getsentry/sentry-javascript@10.0.0, body "Merge target: main", and a string request digest; differing live requester contractor is rejected with "The automated approval request changed before approval".src/publish/__tests__/current-accepted-event.js verifies getCurrentAcceptedEvent() selects latest accepted-label event { actor: "contractor", eventId: "200" } over ID "100" and rejects an empty event list with "The issue has no current accepted label event"..github/workflows/test.yml defines Test, triggered on pushes to main and all pull requests, with contents: read permission; job unit-test runs on ubuntu-latest, checks out via actions/checkout@v6, sets up Node 24 via actions/setup-node@v6, caches node_modules via actions/cache@v4 keyed ${{ runner.os }}-node_modules-${{ hashFiles('package.json', 'yarn.lock') }}, installs with yarn install --frozen-lockfile only on cache miss, then runs yarn test.