Dashboard › publish › Distillation
d4a529c6-b5b8-4537-ae63-d6c2144b28a8["lore_tm_v1_vWdGFz2NoNBUOj1am1lAKeHMtYU5Mz0kkLNhiNzuDFw","lore_tm_v1_ApdTzaB8vUgkd9Nll3O5kO5RK-7wZWMFdMnOpV0PikM","lore_tm_v1_W08e2ZTsZZgKuFt5MgtLL3yHrlxiWYc0M4mWYOICOlk"]
/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js is 153 lines and imports currentAcceptedEvent, currentCiReadyEvent, hasApprovalAttestation, and hasCiReadyAttestation from ../modules/approval-attestation.js.validate-approval-attestation.js sends authenticated GitHub requests to https://api.github.com/${path} using APPROVAL_TOKEN, media type application/vnd.github+json, and API version 2026-03-10; getIssue() throws with the returned HTTP status if the issue cannot be retrieved.getAllPages() in validate-approval-attestation.js paginates issue events and comments with per_page=100&page=${page}, accumulates records until a page has fewer than 100 entries, and throws with the resource name, issue number, and HTTP status on failure.validateApprovalAttestation() fetches the live issue, all events, and all comments concurrently. Basic approval validity requires: the issue remains open; its title exactly equals issueTitle; the accepted label remains present; currentAcceptedEvent(events) is non-null; any supplied expectedAcceptedEvent matches both .actor and .eventId; and hasApprovalAttestation() succeeds for the attestation author, comments, current accepted event, and live issue.requireCiReadyAttestation is true, validateApprovalAttestation() additionally requires a non-null currentCiReadyEvent(events), the live ci-ready label, and a valid hasCiReadyAttestation() bound to the current accepted event, attestation author, comments, current CI-ready event, and live issue.validate-approval-attestation.js requires environment variables APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and APPROVAL_ATTESTATION_AUTHOR. It constructs expectedAcceptedEvent only when both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID exist, and enables the CI-ready requirement only when REQUIRE_CI_READY_ATTESTATION === "true".validate-approval-attestation.js throws The current accepted label has no matching approval attestation; the CLI catches errors, logs them, and sets process.exitCode = 1. The module exports getAllPages, getGitHubResponse, getIssue, main, and validateApprovalAttestation./home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js contains 7 Vitest tests in this order: 1. exact release paths are loaded from the auto-approval allowlist; 2. authorization is written after a successful GitHub permission lookup; 3. a requester cannot approve their own release; 4. an allowlisted automated request is authorized when it has request proof; 5. automated approval without request proof is rejected; 6. direct approval by an automated opener is rejected; 7. authorization fails closed when GitHub cannot return permission.src/publish/__tests__/authorize-approval.js verifies that file contents getsentry/sentry-javascript and getsentry/objectstore/clients become exactly new Set(["getsentry/sentry-javascript", "getsentry/objectstore/clients"]).contractor, issue publish: getsentry/sentry-javascript@10.0.0, requester requester, permission role_name: "write", and accepted-label event ID "100" by contractor; it expects a lookup at repos/getsentry/sentry-javascript/collaborators/contractor/permission with Authorization: "Bearer release-bot-token" and output matching authorized=true followed by a <!-- publish-approval ... --> attestation.contractor for publish: getsentry/sentry-javascript@10.0.0 and expects exactly authorized=false\n.publish: getsentry/relay@1.2.3, requester getsantry[bot], labeler sentry-internal-app[bot], accepted event ID "100", and a github-actions[bot] comment generated by createAutoApprovalAttestation(); it expects no collaborator lookup and an authorized=true approval attestation.getsentry/relay@1.2.3 requester/labeler setup but an empty comments response and expects exactly authorized=false\n.sentry-release-bot[bot] for publish: getsentry/relay@1.2.3, expects no GitHub fetch at all, and expects exactly authorized=false\n.contractor and publish: getsentry/sentry-javascript@10.0.0; main() must reject with Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404, without logging through the mocked console.error or writing GITHUB_OUTPUT.can_approve_pull_request_reviews: true and default_workflow_permissions: "write".AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, CI_POLLER_APP_PRIVATE_KEY, CLOUDFLARE_API_TOKEN, COCOAPODS_TRUNK_TOKEN, CRAFT_GCS_STORE_CREDS_JSON, CRAFT_GCS_TARGET_CREDS_JSON, CRATES_IO_TOKEN, DOCKER_PASSWORD, GEM_HOST_API_KEY, GPG_PASSPHRASE, GPG_PRIVATE_KEY, HEX_API_KEY, NPM_TOKEN, NUGET_API_TOKEN, OSSRH_PASSWORD, OSSRH_USERNAME, POWERSHELL_API_KEY, PUBDEV_ACCESS_TOKEN, PUBDEV_REFRESH_TOKEN, SENTRY_RELEASE_BOT_PRIVATE_KEY, TWINE_PASSWORD, and VERCEL_TOKEN.