Distillation

Date: Sep 4, 2026

• 🔴 (10:35) User stated that Action publish titles should always carry the full concrete workspace path.
• 🟡 (10:35) Read-only audit evidence: /home/byk/Code/getsentry contains 34 entries, including the two audited worktrees craft-workspace-action-propagation/ and publish-workspace-acceptance/.
• 🟡 (10:35) Read-only audit evidence: /home/byk/Code/getsentry/craft-workspace-action-propagation contains 33 entries, including action.yml, README.md, src/, docs/, dist/, package.json, pnpm-lock.yaml, node_modules/, and .git/.
• 🟡 (10:35) Read-only audit evidence: the craft-workspace-action-propagation worktree has uncommitted modifications including action.yml and src/__tests__/action.test.ts; the displayed stat shows src/__tests__/action.test.ts changed by 59 lines (++++++++---), with additional modified files/stat lines elided.
• 🟡 (10:35) action.yml adds shell validation for a nonempty WORKSPACE: node -e splits it on / and requires every segment to match /^[A-Za-z0-9_.-]+$/, not be ., .., or __proto__, and not start with -; failure exits nonzero.
• 🟡 (10:35) Documentation changes state that craft workspace list prints concrete workspace paths as a JSON array for automation, replacing the prior statement that it prints exact configured workspace names; documentation also states that Action publish titles always carry the full concrete path.
• 🟡 (10:35) Documentation retains caution that multiple github targets with different tagPrefix values in one release unit are ambiguous; Craft uses the first prefix for read-path operations and logs a warning, and separate release workspaces should be used for independent products.
• 🟡 (10:35) src/__tests__/action.test.ts renames the publish-title test from uses the compact workspace path in publish request titles to uses the full workspace path in publish request titles.
• 🟡 (10:35) src/__tests__/action.test.ts adds parameterized unsafe-workspace-path rejection coverage for ./packages/cli, packages//cli, packages/./cli, packages/../cli, packages/__proto__/cli, and packages/-cli; each expects runActionStep('Validate workspace', workspace, environment).status to be 1 and both gitCalls and craftCalls to remain empty.
• 🟡 (10:35) The action tests include prior/non-ASCII validation coverage: rejects non-ASCII workspace input in a UTF-8 locale, expecting craftCalls to be empty.
• 🟡 (10:35) Workspace/configuration test additions shown in the diff cover: a packages/README.md non-workspace fixture; remote configuration glob expansion from repository root; workspace-glob configuration cases; safe/invalid glob cases; creation of packages/mcp; outside-root brace glob patterns {../outside/*,packages/*} and {/tmp/*,packages/*}; a literal packages/foo! case; and rejection when a concrete workspace path matches multiple globs.
• 🟡 (10:35) Workspace resolution implementation changes resolveWorkspaceConfig(base, workspaceName, workspaceDirectory) to use getWorkspaceConfig(workspaces, workspaceName, workspaceDirectory) rather than direct Object.hasOwn(workspaces, workspaceName) lookup. On no matching workspace, it derives available names through getWorkspaceNamesFromConfig(base, workspaceDirectory) before throwing ConfigurationError.
• 🟡 (10:35) The diff introduces workspace matching/discovery helpers that use getWorkspaceGlobMatches(key, workspaceDirectory), map concrete workspace names to matching configured keys, reject concrete names with more than one matching glob, and return discovered names sorted via Array.from(keysByWorkspaceName.keys()).sort().
• 🟡 (10:35) The workspace validation/matching changes shown prohibit backslashes and include checks excluding ..; configured workspace glob segment validation uses /^[A-Za-z0-9_.?*[\]!^-]+$/.
• 🟡 (10:35) findConfigFile() cache handling changes from if (_configPathCache) to if (_configPathCache && existsSync(_configPathCache)); when the cached file no longer exists, it clears _configPathCache with _configPathCache = undefined as unknown as string.