Distillation

Date: Sep 8, 2026

• 🟡 (02:14) Tool output showed commits by Burak Yigit Kaya byk@sentry.io: 33de3f1df5bdb9a6a480e9217d566df7b5a48b8e (feat: accept workspace publish requests, 377 insertions/40 deletions across 6 files, Aug 26, 2026); b658ffa0299fedf78c9dd9a2121cd740691ca157 (fix: validate publish workspace JSON, 112 insertions/2 deletions across 5 files, Aug 27, 2026); 52ef600d6759911d4b76d7f3108c5a41c3e0ec2a (feat: resolve compact workspace publish requests, 1,601 insertions/88 deletions across 20 files, Sep 2, 2026); and a81ab033098f151fbc291b7b0c934901405bb162 (feat: resolve workspace publish paths, 308 insertions/539 deletions across 13 files, Sep 5, 2026). (meaning Aug 26–Sep 5, 2026)
• 🔴 (02:14) User stated CI Status Poller must always allow workflow_dispatch for manual recovery; its check-ci job runs when vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'.
• 🔴 (02:14) User stated the CI poller always adds ci-ready after checking CI; waiting-for-ci removes an existing ci-ready first so the fresh label event triggers publishing.
• 🟡 (02:14) .github/workflows/ci-poller.yml changed the Check out publish controller action from actions/checkout@v5 to actions/checkout@v7, retaining checkout path .__publish__.
• 🔴 (02:14) User stated new Craft publish requests always include the checkout repository identity, e.g. publish: getsentry/sentry@21.3.1 and publish: getsentry/toolkit/packages/cli@1.2.3.
• 🔴 (02:14) User stated a title path suffix is resolved only after checking out the CI-approved revision: an exact craft workspace list match is a workspace; all other suffixes remain checkout paths; discovery errors when root .craft.yml exists fail the release.
• 🔴 (02:14) User stated a missing root .craft.yml always means checkout-path behavior.
• 🔴 (02:14) User stated Craft never normalizes repository, workspace, or path names; workspace path spelling is preserved exactly.
• 🟡 (02:14) docs/publish-issue-format.md now embeds generated canonical Peggy title grammar between <!-- BEGIN GENERATED TITLE GRAMMAR --> and <!-- END GENERATED TITLE GRAMMAR -->; it says getsentry/ is optional only when parsing existing issues, paths use safe [A-Za-z0-9_.-]+ segments excluding ., .., __proto__, and leading -, and versions may include build metadata such as 4.2.6+sentry1.
• 🟡 (02:14) Publish issue body contract now requires Merge target: <branch-or-(default)>; allowed branch characters are letters, digits, _, ., /, and -. The controller requires Quick links immediately after Requested by and Merge target, with exactly one View changes then exactly one checkout-repository View check runs link.
• 🟡 (02:14) .github/workflows/publish.yml changed Resolve publish location to invoke node .__publish__/src/publish/discover-location.js with PUBLISH_ARGS: ${{ steps.inputs.outputs.result }} and PUBLISH_REPOSITORY_DIRECTORY: __repo__, replacing inline Docker workspace-list discovery and resolve-location.js.
• 🟡 (02:14) Publish workflow Set targets securely derives container_cwd with realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH" and rejects paths outside /github/workspace/__repo__; hashes it with sha1sum | cut -c1-12, writes state under $GITHUB_WORKSPACE/.craft-state/craft, base64url-encodes workspace and non-sanitized versions, and outputs state_file.
• 🟡 (02:14) Publish workflow uses XDG_STATE_HOME: /github/workspace/.craft-state outside __repo__/ to prevent repository contents pre-populating Craft state; it sets CRAFT_PUBLISH_STATE_GITHUB_REPO: getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }} so state follows checkout identity rather than an optional workspace GitHub release-repository override.
• 🟡 (02:14) scripts/generate-publish-issue-title-parser.js now generates both src/modules/publish-issue-title.js and the documentation grammar. Peggy generation permits start rules PublishIssueTitle, ReleaseRevision, and CheckRunsLinkCount; --check throws either The generated publish issue title parser is stale. Run \yarn generate`.orThe generated publish issue title documentation is stale. Run `yarn generate`.`.
• 🟡 (02:14) generateDocumentation({ documentation, titleGrammar }) replaces the generated-grammar marker block with a peggy fenced block and throws Could not find the generated title grammar in the documentation. if markers are missing; the script exports generateDocumentation and executes main() only when require.main === module.
• 🟡 (02:14) src/modules/publish-issue-title.peggy adds ReleaseRevision, RequestHeader, CheckRunsRevision, and CheckRunsLinkCount grammar rules. RequestHeader anchors at issue-body start and parses Requested by, Merge target, Quick links, and a https://github.com/getsentry/<repo>/commit/<40-lowercase-hex>/checks/? check-runs URL; CheckRunsRevision returns { value, start, end } offsets for precise replacement.
• 🟡 (02:14) src/modules/release-revision.js replaced regex parsing with parse from ./publish-issue-title: getReleaseRevisionDetails() first requires CheckRunsLinkCount === 1, parses ReleaseRevision, validates the parsed repository, and returns details; updateReleaseRevision() replaces only the revision substring using returned start/end offsets.
• 🟡 (02:14) src/publish/inputs.js now calls core.setOutput('result', JSON.stringify(result)) rather than passing the object directly.
• 🟡 (02:14) src/publish/resolve-location.js defaults absent environment JSON to PUBLISH_ARGS || "{}" and CRAFT_WORKSPACE_NAMES || "[]", retains the array validation error Craft workspace discovery returned an invalid workspace list., and JSON-stringifies resolvePublishLocation(...) before core.setOutput("result", ...).
• 🟡 (02:14) src/publish/resolve-release-revision.js defaults absent PUBLISH_ARGS to "{}" and explicitly throws Publish input must define a repository. before attempting release-revision parsing.
• 🟡 (02:15) README.md describes getsentry/publish as a meta/control repository implementing the Central Publish Repository RFC. Its release flow is: 1. Developer triggers release workflow; 2. SDK repo runs craft prepare; 3. build artifacts and create release branch; 4. upload artifacts to GitHub; 5. create issue in getsentry/publish; 6. release manager review; 7. add accepted; 8. publish workflow triggers; 9. download artifacts; 10. craft publish to registries; 11. close issue on success or update issue on failure.
• 🟡 (02:15) README goals are: 1. employees must not publish through personal accounts; 2. employees must not access global credentials; 3. employees must not build and publish releases from their machines; 4. releases require formal approval from a limited set of release managers; 5. engineers should not be discouraged from initiating releases.
• 🟡 (02:15) README usage is: 1. trigger the release workflow in the target repository; 2. locate its publish request in this repository after the workflow finishes; 3. add the accepted label to initiate publishing, potentially requesting a team lead or manager due to elevated permissions; 4. observe the issue for triggered-run information; 5. the issue automatically closes when publishing succeeds.
• 🟡 (02:15) README CalVer configuration uses .craft.yml: versioning.policy: calver, calver.format: "%y.%-m" (example 24.12 for December 2024), and optional calver.offset: 14 days.
• 🟡 (02:15) README states merge_target defaults to the repository default branch, typically master or main; Craft reusable workflow example passes ${{ inputs.version }} and ${{ inputs.merge_target }} to getsentry/craft/.github/workflows/release.yml@v2 with secrets: inherit.
• 🟡 (02:15) README states public packages such as sentry-cli, Sentry SDKs, and distributed symbolicator utilities require explicit approval; internal dependencies such as arroyo may use auto-approval, managed by .github/workflows/auto-approve.yml.
• 🟡 (02:15) README states publishing uses Craft and short-lived Sentry Release Bot GitHub App tokens generated each action run with actions/create-github-app-token, organization variables/secrets SENTRY_RELEASE_BOT_CLIENT_ID and SENTRY_RELEASE_BOT_PRIVATE_KEY; GITHUB_TOKEN cannot trigger downstream workflows due to GitHub event restrictions.
• 🟡 (02:15) README states getsentry/publish is read-only except to release managers because repository secrets include admin GitHub and package-registry publishing credentials; users with write access could expose secrets by creating or triggering arbitrary GitHub workflows.