Dashboard › publish › Distillation
cfa3bbb9-4339-4c52-9a33-3dfed8c76f98["lore_tm_v1_CbQMI01Z69KAxnher4D1t6FveRw7-9vEFYhA6Apc4VY","lore_tm_v1_Pzh3ByFNRmcLD8ZQWUfJ_ohG6jw9iHfsG5h_owh7I2Y","lore_tm_v1_eKcnqDIcDT-5t9gPlEMP_CpkeyVN8RvJ6tw9cR7J7nw","lore_tm_v1_how1N7T-SeD8ODV2c-0-9kAOHySwBEljvChN2qosOkA","lore_tm_v1_gkxptlybELumXeA_9qMDj_3AP1yCM7qxI-_UiKMR8OU"]
file:line findings and command results if review was completed.MERGE or DO-NOT-MERGE; if review cannot be completed, it must begin BLOCKED, state the exact reason, and end exactly DO-NOT-MERGE.src/modules/__tests__/approval-attestation.js contains 6 tests across 174 lines: (1) lines 22-56 match the latest accepted event (eventId: "200") to an approval attestation authored by github-actions[bot]; (2) lines 58-69 accept numeric GitHub issue-event ID 29503999078 and stringify it; (3) lines 71-114 validate a CI-ready attestation against accepted actor/event and CI-ready actor, rejecting changed accepted event "201" and CI-ready actor contractor; (4) lines 116-149 reject an untrusted comment author, a stale event/title, and malformed payload <!-- publish-approval not-base64 -->; (5) lines 151-173 reject an approval after the issue’s dry-run state changes.src/modules/__tests__/approval-attestation.js:13-19 defines helper issue(title, { body = "", dryRun = false } = {}), returning body, title, and either labels: [{ name: "dry-run" }] or labels: [].src/modules/__tests__/approval-authorizer.js contains authorization tests across 147 lines: lines 8-27 reject direct approval by both getsantry[bot] and sentry-release-bot[bot] without calling getPermission; lines 29-45 reject getsantry[bot] when getsentry/sentry-javascript is outside the allowlist; lines 47-69 accept exact roles write, maintain, and admin; lines 71-90 resolve unqualified title publish: sentry-javascript/packages/core@10.0.0 to getsentry/sentry-javascript; lines 92-106 reject roles none, read, triage, Elevated Bot, and undefined; lines 108-134 reject malformed titles publish: @1.0.0 and publish: getsentry/sentry-javascript without querying GitHub; lines 136-146 propagate permission lookup error Not Found.src/modules/__tests__/approval-authorizer.js:63-67 and :85-89 require getPermission() arguments { owner: "getsentry", repository: "sentry-javascript", username: "contractor" }..github/workflows/ci-poller-dispatch.yml lines 4 and 6; .github/workflows/publish.yml lines 12, 14, 45, 55, 152, 162, 239, 271, 381, 383-387, 389-407, 413, 420, 427, and 434; .github/workflows/ci-poller.yml lines 12, 14, 23, 51, 63, 74, 423, and 444; .github/workflows/cocoapods-keepalive.yml lines 10 and 19; .github/workflows/auto-approve.yml lines 6, 8, and 27; and .github/workflows/test.yml lines 6 and 8..github/workflows/publish.yml search results showed private-key references at lines 45 (SENTRY_INTERNAL_APP_PRIVATE_KEY), 55 and 271 (SENTRY_RELEASE_BOT_PRIVATE_KEY), and 152 (CI_POLLER_APP_PRIVATE_KEY); publishing credentials at lines 381 and 383-407; and GITHUB_TOKEN references at lines 239, 381, 413, 420, 427, and 434..github/workflows/ci-poller.yml:51 explicitly states that because workflow_dispatch can target any ref, the workflow must always run trusted code..github/workflows/ci-poller-dispatch.yml; protected environment secrets must enforce that an arbitrary dispatched ref cannot add them..github/workflows/ci-poller-dispatch.yml:10-12 documents that production permits deployments only from main, repository secrets must never be used by this workflow, and protected environment secrets prevent an arbitrary dispatched ref from adding them.