Distillation

["lore_tm_v1__CqT81pxLpapIy2YkcYbkw9pbSACEuxPF0Zgitp1-nc","lore_tm_v1_Y9GyrTBEe2noLmRvvQPPfGCMyslJVPgS6--S9Q26li0","lore_tm_v1_kvMUirfpUyvZ4m07C4nv1DiHiejNJr8ept1xtDZBg1w","lore_tm_v1_dCRfOnaR8Grtt1U3flXVyjDshF6fAZIn8yqJbMWyfF8","lore_tm_v1_MjXo9hewiriDrGo-PyCWMoVC4X99xhGHbo_Kroji3yg","lore_tm_v1_kPTlfHCA3GBTaP3bo_y0wNRyxC8KVmX2viY-dU0UYp8"]

🟡 (13:02) [requested-review] User asked to resume and complete the previously requested independent read-only review, provide substantive file:line evidence, make no file edits, and end the response with exactly MERGE or DO-NOT-MERGE.

🔴 (13:03) User directed that the events_url URI template’s {/privacy} component be replaced with /public to retrieve only public events; omitting it retrieves public events and, when authenticated as that user, private events.

🔴 (13:05) /home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js is 153 lines and imports currentAcceptedEvent, currentCiReadyEvent, hasApprovalAttestation, and hasCiReadyAttestation from ../modules/approval-attestation.js at lines 1-6.

🔴 (13:05) getGitHubResponse(path) in src/publish/validate-approval-attestation.js:8-16 fetches https://api.github.com/${path} with headers Accept: application/vnd.github+json, Authorization: Bearer ${process.env.APPROVAL_TOKEN}, and X-GitHub-Api-Version: 2026-03-10.

🔴 (13:05) getIssue({ repository, issueNumber }) in src/publish/validate-approval-attestation.js:18-30 requests repos/${repository}/issues/${issueNumber} and throws Could not retrieve issue #${issueNumber}: GitHub returned ${response.status} when the response is not OK.

🔴 (13:05) getAllPages({ repository, issueNumber, resource }) in src/publish/validate-approval-attestation.js:32-53 requests repos/${repository}/issues/${issueNumber}/${resource}?per_page=100&page=${page}, beginning at page 1 and incrementing by 1; it accumulates all records and returns once a page contains fewer than 100 records. A non-OK response throws Could not retrieve ${resource} for issue #${issueNumber}: GitHub returned ${response.status}.

🔴 (13:05) validateApprovalAttestation() in src/publish/validate-approval-attestation.js:55-67 accepts attestationAuthor, expectedAcceptedEvent, issueNumber, issueTitle, repository, and optional requireCiReadyAttestation = false, then concurrently fetches the issue, all events, and all comments.

🔴 (13:05) validateApprovalAttestation() derives event = currentAcceptedEvent(events) and ciReadyEvent = currentCiReadyEvent(events) at src/publish/validate-approval-attestation.js:68-69.

🔴 (13:05) Approval validation at src/publish/validate-approval-attestation.js:71-84 requires all of: issue.state === "open"; issue.title === issueTitle; an issue label named "accepted"; a non-null current accepted event; either no expectedAcceptedEvent or exact equality of both event.actor and event.eventId to it; and a successful hasApprovalAttestation({ attestationAuthor, comments, event, issue }).

🔴 (13:05) At src/publish/validate-approval-attestation.js:86-100, validateApprovalAttestation() immediately returns the approval result when approval is false or requireCiReadyAttestation is false. When CI-ready proof is required, it additionally requires a non-null current CI-ready event, an issue label named "ci-ready", and successful hasCiReadyAttestation({ acceptedEvent: event, attestationAuthor, comments, ciReadyEvent, issue }).

🔴 (13:05) main() in src/publish/validate-approval-attestation.js:103-114 requires environment variables APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and APPROVAL_ATTESTATION_AUTHOR; each missing value causes No "<NAME>" environment variable found.

🔴 (13:05) At src/publish/validate-approval-attestation.js:116-131, main() passes APPROVAL_ATTESTATION_AUTHOR, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_TITLE, and APPROVAL_ISSUE_REPOSITORY into validateApprovalAttestation(). It supplies expectedAcceptedEvent only if both EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID are truthy, and enables requireCiReadyAttestation only when REQUIRE_CI_READY_ATTESTATION === "true".

🔴 (13:05) At src/publish/validate-approval-attestation.js:133-137, failed validation throws exactly The current accepted label has no matching approval attestation, including when CI-ready validation was requested and failed.

🔴 (13:05) src/publish/validate-approval-attestation.js:140-145 runs main() only when invoked directly; rejected execution logs the error and sets process.exitCode = 1.

🔴 (13:05) src/publish/validate-approval-attestation.js:147-153 exports getAllPages, getGitHubResponse, getIssue, main, and validateApprovalAttestation.

🔴 (13:07) GitHub REST API documentation for API version 2026-03-10 states that most endpoints use Authorization: Bearer <YOUR-TOKEN>, Accept: application/vnd.github+json, and X-GitHub-Api-Version: 2026-03-10.

🔴 (13:07) GitHub’s users API endpoints shown were: GET /user for the authenticated user, PATCH /user to update the authenticated user, GET /user/{account_id} to retrieve a user by durable ID, GET /users to list users, GET /users/{username} to retrieve a user by login, and GET /users/{username}/hovercard for contextual hovercard information.

🔴 (13:07) GET /user requires read:user or broader user scope on OAuth app tokens and classic personal access tokens to return the private-user response; tokens without those scopes receive the public-user response. Documented statuses are 200, 304, 401, and 403.

🔴 (13:07) PATCH /user accepts body fields name, email, blog, twitter_username, company, location, hireable, and bio; documented statuses are 200, 304, 401, 403, 404, and 422. Sending email does not override private-email visibility settings.

🔴 (13:07) GET /users returns personal and organization accounts in GitHub signup order. Pagination uses since exclusively, where since is a user ID and only users with larger IDs are returned; per_page defaults to 30 and has a maximum of 100, and the Link header provides the next page URL.

🔴 (13:07) GET /users/{username} returns public account information; for a private profile, followers and following are 0 unless authenticated as that same user. Requests for inaccessible Enterprise Managed Users or relevant GitHub App bots return 404 Not Found.

🔴 (13:07) For user API responses, email is only the publicly visible profile email and is null when no public email is configured; GitHub authentication is required to see publicly visible email addresses through this endpoint.

🔴 (13:07) GET /users/{username}/hovercard accepts optional contextual subject_type values organization, repository, issue, or pull_request, plus subject_id; each is required when the other is used. OAuth app tokens and classic personal access tokens need the repo scope. Documented statuses are 200, 404, and 422.