Distillation

Date: Aug 28, 2026

• 🔴 (10:33) User stated that the CI poller always adds the ci-ready label after checking CI; waiting-for-ci first removes ci-ready, ensuring a fresh labeled event triggers the publish workflow.
• 🟡 (10:33) src/modules/post-workflow-details.js exports async function postWorkflowDetails({context, octokit}): it obtains publishRepo and runId from context, issue_number from context.payload.issue.number, calls octokit.rest.actions.getWorkflowRun({...publishRepo, run_id}), then creates an issue comment Publishing: [run#${run_id}](${workflowInfo.html_url}).
• 🟡 (10:33) .github/workflows/publish.yml is named Publish, runs on issue labeled events, and serializes duplicate publish issues using concurrency.group: ${{ github.event.issue.title }} with cancel-in-progress: false; permissions are contents: read, issues: write, and packages: write.
• 🟡 (10:33) .github/workflows/publish.yml job waiting-for-ci runs only for an open issue titled publish: when the added label is accepted; it obtains an internal-app token, removes ci-failed and ci-ready, adds ci-pending, comments either retry-CI or approval/CI-check status, best-effort sets repository variable CI_POLLER_HAS_PENDING=true using a dedicated poller app token, and dispatches ci-poller.yml using the internal app token.
• 🟡 (10:33) .github/workflows/publish.yml job publish runs only when an open issue receives a ci-ready label and currently has accepted and ci-ready, but not ci-pending or ci-failed; it has timeout-minutes: 90, checks out the publish repository into .__publish__, uses actions/setup-node@v6 with Node 24 and Yarn caching, then runs yarn install --cwd ".__publish__" and node .__publish__/src/publish/inputs.js.
• 🟡 (10:33) The publish workflow’s Inform start step runs node .__publish__/src/publish/post-workflow-details.js only after successful input parsing. Its conditional target-checkout branch allowlist includes sentry-migr8/tmp-merge-target; sentry-javascript branches v10, v9, v8, v7, and master; sentry-python/alpha; and sentry-wizard/1.x.
• 🟡 (10:33) The workflow’s Set targets step builds {"published": {...}} from CRAFT_PUBLISH_TARGETS_JSON, validates that realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH" remains within /github/workspace/__repo__, hashes the container cwd with SHA-1 truncated to 12 characters, sanitizes owner/repository/version to lowercase [a-z0-9._-], base64url-encodes a nonempty workspace, and writes the Craft state file under $GITHUB_WORKSPACE/.craft-state/craft.
• 🟡 (10:33) The Craft publish step uses docker://getsentry/craft:latest, executes craft publish <version> after changing to __repo__/<path>, pins XDG_STATE_HOME=/github/workspace/.craft-state, passes CRAFT_MERGE_TARGET, CRAFT_DRY_RUN, CRAFT_WORKSPACE, and CRAFT_PUBLISH_STATE_GITHUB_REPO=getsentry/<issue-checkout-repository>; it uses GitHub/Craft/package-publishing credentials via named environment variables including GITHUB_TOKEN, GITHUB_API_TOKEN, NPM_TOKEN, CRATES_IO_TOKEN, and TWINE_PASSWORD (values not recorded).
• 🟡 (10:33) After Craft execution, the workflow runs node .__publish__/src/publish/update-issue.js on cancellation or failure with PUBLISH_ARGS and the secure CRAFT_STATE_FILE_PATH; it posts cancellation/failure status with post-result.js cancelled or post-result.js failure, and on success runs post-result.js success to close the issue.
• 🟡 (10:33) Search results identified GitHub Actions entry points using github.context: src/publish/update-issue.js, src/publish/post-workflow-details.js, src/publish/post-result.js, and src/publish/inputs.js; inputs.js imports @actions/core, calls the details parser with context: github.context, and uses core.setOutput('result', result).
• 🟡 (10:36) Relevant tests/files found include src/modules/__tests__/publish-workflow.js, which reads .github/workflows/publish.yml, extracts its Set targets script, and throws Error("Missing Set targets workflow script") if absent; src/modules/__tests__/update-issue.js documents that the state-file path originates from the workflow’s secure state-file step output; src/modules/__tests__/post-workflow-details.js tests creation of workflow-details comments; and src/modules/__tests__/process-end-state.js includes cancellation-comment expectations.
• 🟡 (10:38) Search results showed .github/workflows/ci-poller.yml parses repository and version from publish: issue titles using sed, with comments describing expected title shape "publish: owner/repo[/path]@version"; .github/workflows/auto-approve.yml similarly extracts REPO from the text between publish: and @.
• 🔴 (10:39) User directive: Always throw for unexpected values in switch statements; the expected default behavior is throw new Error(\Unknown status: '${status}'`)`.
• 🟡 (10:39) AGENTS.md describes the repository as the Sentry Publish Repository: a GitHub Actions approval system for Craft-based releases across Sentry projects, implemented as CommonJS JavaScript on Node.js 24.0.0; it requires Yarn classic 1.22.22 and explicitly says not to use npm.
• 🟡 (10:39) AGENTS.md specifies commands: yarn install, yarn test, yarn test:watch, yarn test src/modules/__tests__/update-issue.js, yarn test -t "pattern", yarn lint, and yarn prettier; a file-and-pattern invocation is yarn test src/modules/__tests__/update-issue.js -t "specific test name".
• 🟡 (10:39) AGENTS.md project structure is src/libs/ for shared utilities, src/modules/ for reusable core business logic, and src/publish/ for GitHub Actions entry points; source filenames must be kebab-case, test files belong in __tests__/ and match source names, variables/functions use camelCase, constants/regex patterns use UPPER_SNAKE_CASE, source files use CommonJS, and test files use ES Modules.
• 🟡 (10:39) AGENTS.md coding conventions require import order of Node built-ins, external packages, then local modules; Prettier default formatting with double-quoted strings and required semicolons; and running yarn prettier before commit.
• 🟡 (10:39) AGENTS.md error-handling guidance requires descriptive errors, early guard clauses such as if (!context || !context.payload || !context.payload.issue) { throw new Error("Issue context is not defined"); }, and checking file existence with fs.existsSync(CRAFT_STATE_FILE_PATH) before reading a state file.
• 🟡 (10:39) AGENTS.md testing guidance specifies Vitest v4.0.0 with globals enabled, automatic mock clearing between tests, mocking external dependencies with vi.mock(), and importing the module under test after mocks; key dependencies are @actions/core, @actions/github, and @sentry/node.