Distillation

🔴 (03:22) The combined tracked diff covered exactly 32 files with 662 insertions and 183 deletions. 🔴 (03:22) User stated the publish workflow’s poller always adds ci-ready; the publish job fires only on ci-ready label events, not accepted, to avoid racing with waiting-for-ci. 🔴 (03:22) User stated workflow_dispatch can target any ref and directed the CI poller to “Always run trusted code.” .github/workflows/ci-poller.yml:51-52 checks out ${{ github.event.repository.default_branch }}. 🔴 (03:22) User directed: “Never move a release to ci-ready after it changes.” .github/workflows/ci-poller.yml snapshots issue_sha from publish_input.revision before inspecting CI. 🔴 (03:22) User stated a renamed or re-approved issue must never reach ci-ready. 🔴 (03:22) User stated repository secrets must never be used by .github/workflows/ci-poller-dispatch.yml; protected production environment secrets enforce that an arbitrary dispatched ref cannot add them. 🔴 (03:22) New .github/workflows/ci-poller-dispatch.yml defines name: Run CI Status Poller, is triggered by workflow_dispatch, sets permissions: {}, and has one dispatch job using environment: production, runs-on: ubuntu-latest, with the sole step run: ":". 🔴 (03:22) .github/workflows/auto-approve.yml triggers only for opened issues and grants contents: read plus issues: write; job auto-approve uses environment: production and runs only when the actor is sentry-release-bot[bot] or getsantry[bot] and the issue title starts with publish: . 🔴 (03:22) .github/workflows/auto-approve.yml:18-20 uses immutable actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with persist-credentials: false. 🔴 (03:22) .github/workflows/auto-approve.yml:21-26 uses immutable actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, with client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }} and private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}. 🔴 (03:22) .github/workflows/auto-approve.yml:27-39 binds the request snapshot via node src/publish/request-digest-from-event.js, then invokes node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN=${{ github.token }}, issue number/repository/title from the event, AUTO_APPROVER=${{ github.actor }}, and EXPECTED_REQUEST_DIGEST=${{ steps.request-digest.outputs.request_digest }}. 🔴 (03:22) .github/workflows/auto-approve.yml:40-46 posts ${{ steps.attestation.outputs.auto_approval_attestation }} as an issue comment using ${{ github.token }} only when the attestation step succeeds. 🔴 (03:22) .github/workflows/auto-approve.yml:47-57 parses REPO from ISSUE_TITLE with sed -n 's/^publish: \(.*\)@.*/\1/p'; it adds the accepted label using the generated app token only when REPO is non-empty and exactly matches a line in auto-approve-repos.txt via grep -qxF. 🔴 (03:22) .github/workflows/test.yml runs on pushes to main and pull requests, grants only contents: read, and sets the default run shell to bash. 🔴 (03:22) .github/workflows/test.yml job unit-test runs on ubuntu-latest and uses immutable references actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, and actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830. 🔴 (03:22) .github/workflows/test.yml configures Node.js 24, caches node_modules under key ${{ runner.os }}-node_modules-${{ hashFiles('package.json', 'yarn.lock') }}, runs yarn install --frozen-lockfile only on a cache miss, and validates with yarn test. 🔴 (03:22) src/modules/details-from-context.js defines TARGETS_SECTION_PARSER_REGEX=/^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m, TARGETS_PARSER_REGEX=/^\s*- \[[ x]\] (\S+)/gim, and CHECKED_TARGETS_PARSER_REGEX=/^\s*- \[x\] (\S+)/gim. 🔴 (03:22) src/modules/details-from-context.js:27-44 adds parsePublishTitle(title), which parses via parsePublishIssueTitle(), prefixes the parsed path with ., returns null on parsing failure or when repo, version, or path fails isPublishRepository(), isReleaseVersion(), or isPublishPath(), and otherwise returns titleDetails. 🔴 (03:22) detailsFromContext({ context }) throws Issue context is not defined if issue context is absent; emits specific errors for invalid title, repository, version, and path; derives dry_run as "1" when label dry-run exists and "" otherwise; converts merge target (default) to ""; and returns parsed title details, dry_run, merge_target, prefixed path, and checked targets. 🔴 (03:22) src/modules/details-from-context.js exports detailsFromContext, TARGETS_SECTION_PARSER_REGEX, TARGETS_PARSER_REGEX, CHECKED_TARGETS_PARSER_REGEX, and parsePublishTitle. 🔴 (03:22) src/modules/publish-location.js defines resolvePublishLocation({ path, workspaceNames }): invalid paths throw Invalid publish path., any invalid workspace name throws Craft workspace discovery returned an invalid workspace list., path . remains { path }, a path whose substring after ./ exactly matches a workspace resolves to { path: ".", workspace }, and otherwise remains { path }. 🔴 (03:22) src/modules/publish-location.js accepts a publish path only when it is exactly . or begins with ./ and every slash-delimited segment passes isSafeWorkspaceSegment(). 🔴 (03:22) src/modules/publish-location.js validates workspace names by splitting on / and requiring every segment to match /^[A-Za-z0-9_.-]+$/, not equal ., .., or __proto__, and not begin with -. 🔴 (03:22) src/modules/publish-location.js exports resolvePublishLocation and isPublishPath.