Dashboard › publish › Distillation
cd593ab0-dbba-4b99-b152-2abd5237054e["lore_tm_v1_IiwMc8WSiFT4MFYxt0Qtf9mQdFeVGGgpMKwkJfsW1rc","lore_tm_v1_0MtqTHdOMktxRlI7c2lwTsCu9eyyF4rG-e8y0y3JG68","lore_tm_v1_-m4DZZQEaFEGBDJAnkbDcWIRLNWfD42t8X7pNHBjEd4","lore_tm_v1_rDncrthTLLj0memLXGgV9XK5VW41i5gbD5jvTXiemx8","lore_tm_v1_gswCxSwGdvRF5bJqaYLF6ZwjQwMyF2kVzw8KdT4eGdc","lore_tm_v1_g-RmBahswYodGMwidGCeqIUkOycneS43NDWupQYWKbY","lore_tm_v1_EUPAK7NbPzeHJLoqRtCsWYnfRP2u2R1eIKm3RxO4KWo","lore_tm_v1_oGo4ybzKfw-y5-xGYeRc9MtWXEQU0WE4T8CJnEQhwM4"]
Date: Aug 27, 2026
src/publish/validate-approval-attestation.js validates an approval attestation by concurrently fetching the issue, all events, and all comments through Promise.all; it requires the fetched issue title to equal issueTitle, a current accepted label, a non-null currentAcceptedEvent(events), and hasApprovalAttestation({ attestationAuthor, comments, event, title }).getAllPages({ repository, issueNumber, resource }) in src/publish/validate-approval-attestation.js requests repos/${repository}/issues/${issueNumber}/${resource}?per_page=100&page=${page} beginning at page 1, aggregates responses until a page has fewer than 100 records, and throws Could not retrieve ${resource} for issue #${issueNumber}: GitHub returned ${response.status} for a non-OK response.src/publish/validate-approval-attestation.js requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and APPROVAL_ATTESTATION_AUTHOR; main() throws The current accepted label has no matching approval attestation when validation returns false. Direct execution logs errors and sets process.exitCode = 1.src/modules/__tests__/approval-authorizer.js tests authorizeApproval() policy: allowlisted getsantry[bot] releases are authorized without a target-repository permission lookup; the bot is rejected outside the allowlist; collaborator roles write, maintain, and admin are authorized, while none, read, triage, Elevated Bot, and undefined are rejected.src/modules/__tests__/approval-authorizer.js verifies unqualified title publish: sentry-javascript/packages/core@10.0.0 resolves to repository getsentry/sentry-javascript; malformed titles publish: @1.0.0 and publish: getsentry/sentry-javascript return { authorized: false, repository: null } without GitHub lookup; permission lookup failures such as Not Found propagate.src/modules/__tests__/approval-attestation.js verifies the latest accepted-label event is used for attestation matching, including numeric GitHub event ID 29503999078 normalized to string "29503999078"; attestations are rejected when authored by an untrusted commenter, when event ID/title becomes stale, or when parsing malformed <!-- publish-approval not-base64 -->.src/publish/__tests__/authorize-approval.js verifies getAutoApprovedRepositories() parses exact allowlist entries getsentry/sentry-javascript and getsentry/objectstore/clients; successful authorization writes /tmp/github-output content matching authorized=true\napproval_attestation=<!-- publish-approval .+ -->\n; a GitHub permission 404 rejects without writing output.src/publish/__tests__/validate-approval-attestation.js covers valid trusted attestations and rejection if the issue title changes, the current accepted label is removed, or accepted is re-added with a newer event ID than the attested event.workflow_dispatch must always be allowed for manual recovery.ci-ready after either the latest accepted-label event or issue title changes..github/workflows/ci-poller.yml was changed so job check-ci runs when vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch', uses concurrency group ci-status-poller with cancel-in-progress: false, and now checks out publish code with actions/checkout@v6 and persist-credentials: false..github/workflows/ci-poller.yml now invokes node src/publish/validate-approval-attestation.js for each ci-pending + accepted issue with APPROVAL_TOKEN="$GH_TOKEN", APPROVAL_ATTESTATION_AUTHOR="github-actions[bot]", APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY="$GITHUB_REPOSITORY", and APPROVAL_ISSUE_TITLE="$title" before evaluating CI status..github/workflows/ci-poller.yml, the workflow emits warning Approval for issue #${number} is invalid. Removing accepted., removes labels ci-pending and accepted, posts Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., and continues without moving the release forward.PUBLISH_TITLE_REGEX in src/modules/process-end-state.js: /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/; it supports optional getsentry/, an optional path suffix, and versions containing word characters, ., +, or -.@getsentry/releng (Release Engineering team) and adds a lore-managed “Long-term Knowledge” section pointing to root .lore.md and https://github.com/BYK/loreai..github/workflows/ contains 5 workflow files: auto-approve.yml, ci-poller.yml, cocoapods-keepalive.yml, publish.yml, and test.yml.