Distillation

Date: September 10, 2026

• 🔴 [enforced-workflow] (00:04) User directed: “Always allow workflow_dispatch for manual recovery.”
• 🔴 [enforced-workflow] (00:04) User directed that because workflow_dispatch can target any ref, workflows must “Always run trusted code.”
• 🔴 [enforced-release-integrity] (00:04) User directed: “Never move a release to ci-ready after it changes.”
• 🔴 [enforced-release-integrity] (00:04) User stated CI checks can take hours and approval must be revalidated after the final check so a renamed or re-approved issue never reaches ci-ready.
• 🔴 [enforced-workflow] (00:04) User stated the CI poller always adds ci-ready.
• 🟡 (00:04) src/modules/__tests__/update-issue.js defines updateTargetsArgs with inputs: { repo: "sentry", version: "21.3.1" }, workflow runId: "1234", issue number "211", repository { owner: "getsentry", repo: "publish" }, and workflow URL https://github.com/getsentry/sentry/actions/runs/1234.
• 🟡 (00:04) src/modules/__tests__/update-issue.js mocks .craft-publish-21.3.1.json as { published: { lol: true, hey: false, github: true } } and checks for it at exact path ./__repo__/.craft-publish-21.3.1.json.
• 🟡 (00:04) When the Craft state file exists, updateIssue() retrieves issue "211" from getsentry/publish and updates target checkboxes to include - [x] github, - [ ] pypi, - [x] lol, and - [ ] hey; when the state file does not exist, it does not update the issue body.
• 🟡 (00:04) Regardless of whether the Craft state file exists, updateIssue() removes label accepted from issue "211" in getsentry/publish.
• 🟡 (00:04) updateIssue({ context, inputs: undefined, octokit }) must skip the filesystem check, issue retrieval, and issue-body update, while still removing label accepted from issue "211" in getsentry/publish (src/modules/__tests__/update-issue.js:132-158).
• 🟡 (00:04) transformIssueBody() reconciles the target section against publish state { "npm[@sentry/node]": true, "aws-lambda": true, github: false, foo: true }: it produces checked npm[@sentry/node], checked aws-lambda, unchecked github, and appends checked foo, while preserving the surrounding request metadata, links, approval text, and administrator guidance (src/modules/__tests__/update-issue.js:160-207).
• 🟡 (00:04) .github/workflows/auto-approve.yml adds workflow permission issues: write and configures job auto-approve with environment: production.
• 🟡 (00:04) .github/workflows/auto-approve.yml pins actions/checkout to actions/checkout@11d5960a326750d5838078e36cf38b85af677262 and actions/create-github-app-token to actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1.
• 🟡 (00:04) The workflow changes add an “Authorize approval” step and configure APPROVAL_ATTESTATION_AUTHOR: github-actions[bot].
• 🟡 (00:04) CI-poller dispatch processing defaults ATTEMPT with ${{ github.event.client_payload.attempt || '0' }}.
• 🟡 (00:04) When an issue’s approval becomes invalid during CI polling, the workflow warns Approval for issue #${number} is invalid. Removing accepted. and removes accepted; temporary attestation output is deleted with rm -f "$attestation_output" before continuing.
• 🟡 (00:04) If all check runs pass but commit statuses report failure, the CI poller swaps ci-pending to ci-failed and removes accepted using gh issue edit.