Distillation

Date: Aug 29, 2026

• 🔴 (12:35) User stated that the CI poller always adds the ci-ready label after CI passes; the publish job must therefore trigger only when github.event.label.name == 'ci-ready', preventing a race with the waiting-for-ci job on the same event.
• 🟡 (12:35) User provided a GitHub Actions publish workflow: waiting-for-ci handles approved publish: issues, posts “Approved. Checking CI status on the release branch. Publishing will start automatically when CI passes.”, and sets repository variable CI_POLLER_HAS_PENDING to "true" using gh variable set CI_POLLER_HAS_PENDING -R "$GITHUB_REPOSITORY" -b "true" because sentry-internal-app lacks actions_variables:write; ci-ready starts publishing after the poller labels the issue.
• 🟡 (12:35) User provided src/modules/publish-issue-title.peggy: canonical Peggy grammar parses publish: titles as optional getsentry/ prefix, repo restricted to [A-Za-z0-9_.-]+, optional syntactic slash path segments with the same character set, optional legacy suffix [workspace: <JsonString>], and @version restricted to [A-Za-z0-9_.+-]+; the parser returns { repo, path: path || "", version, ...(workspace ? { workspace } : {}) }. A single path segment is resolved as a workspace only after checkout of the CI-approved revision. JsonCharacter excludes quotes, backslashes, and U+0000–U+001F except escaped non-control characters; JSON.parse remains authoritative for legacy-workspace escape validation.
• 🟡 (12:35) User provided generated parser src/modules/publish-issue-title.js, derived from src/modules/publish-issue-title.peggy.
• 🟡 (12:35) User provided scripts/generate-publish-issue-title-parser.js: reads src/modules/publish-issue-title.peggy, generates CommonJS source using peggy.generate() with grammarSource: "publish-issue-title.peggy" and output: "source", formats it via Prettier for src/modules/publish-issue-title.js, and with --check throws The generated publish issue title parser is stale. Run \yarn generate`.` if generated output differs; otherwise writes the generated parser.
• 🟡 (12:36) User provided package.json for private package publish version 0.0.1, an approval-based publishing system for Sentry. Volta pins Node 24.0.0 and Yarn 1.22.22; undici resolution is ^6.23.0. Scripts: generate runs node scripts/generate-publish-issue-title-parser.js; check:generated adds --check; test runs yarn check:generated && vitest run; test:watch runs vitest; lint runs eslint src .github --ignore-pattern '!.github'; prettier runs prettier --write src. Dev dependencies include peggy 5.1.0, Prettier ^2.2.1, and Vitest ^4.1.0.
• 🟡 (12:36) User provided src/modules/details-from-context.js: detailsFromContext({ context }) requires context.payload.issue, parses issue titles using parse from ./publish-issue-title, and throws Invalid publish issue title: '<title>' on parse failure. It parses legacy workspace JSON and throws Invalid publish workspace JSON in title: '<title>' on invalid JSON; rejects empty workspace names or names containing Unicode control (\p{Cc}), format (\p{Cf}), line-separator (\p{Zl}), or paragraph-separator (\p{Zp}) characters. It sets dry_run to "1" only when issue label dry-run exists; prepends "." to title path; rejects paths containing ..; and rejects a workspace combined with any non-root path.
• 🟡 (12:36) User provided src/modules/details-from-context.js: parses Merge target: <merge_target> from issue bodies using /^Merge target: (?<merge_target>[\w.\-/]+)$/m; extracts checked target IDs from a body Targets section via TARGETS_SECTION_PARSER_REGEX = /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m and CHECKED_TARGETS_PARSER_REGEX = /^\s*- \[x\] (\S+)/gim; returns parsed title details plus dry_run, merge_target, path, targets, and optional workspace.
• 🟡 (12:36) User provided src/modules/publish-location.js: needsWorkspaceDiscovery({ path, workspace }) returns true only for no workspace and a one-segment path matching /^\.\/[A-Za-z0-9_.-]+$/. resolvePublishLocation({ path, workspace, workspaceNames }) preserves an explicit workspace only when path === ".", otherwise throws A publish workspace must use the repository root path.; without discovery it preserves { path }; during discovery it rejects invalid workspace lists with Craft workspace discovery returned an invalid workspace list. and maps a matching one-segment ./<name> path to { path: ".", workspace: <name> }. isWorkspaceName(name) requires string type, forbids "__proto__", and allows only /^[A-Za-z0-9_.-]+$/.