Distillation

Date: Aug 27, 2026

• 🟡 (16:38) Working tree status: modified .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, src/publish/update-issue.js; untracked .lore.md, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, and src/publish/authorize-approval.js.
• 🟡 (16:38) .github/workflows/publish.yml change shown: waiting-for-ci now checks out publish code before authorization using actions/checkout@v6 with persist-credentials: false.
• 🟡 (16:38) .github/workflows/publish.yml change shown: creates an internal-app token in step Get auth token (id: token) using actions/create-github-app-token@v3, client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}, and private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}.
• 🟡 (16:38) .github/workflows/publish.yml change shown: obtains a release-bot token in Get release bot auth token (id: release-token) using actions/create-github-app-token@v3, continue-on-error: true, client-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}, private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}, and owner: getsentry; comment states this checks the actor’s current effective target-repository role without exposing RBAC data.
• 🟡 (16:38) .github/workflows/publish.yml change shown: Authorize approval (id: authorization) runs node src/publish/authorize-approval.js with continue-on-error: true, APPROVAL_TOKEN: ${{ steps.release-token.outputs.token }}, APPROVAL_ACTOR: ${{ github.actor }}, and APPROVAL_ISSUE_TITLE: ${{ github.event.issue.title }}.
• 🟡 (16:38) .github/workflows/publish.yml change shown: Reject unauthorized approval or failed authorization runs when steps.authorization.outcome != 'success' || steps.authorization.outputs.authorized != 'true'; with GH_TOKEN: ${{ steps.token.outputs.token }}, it executes gh issue edit "${{ github.event.issue.number }}" -R "$GITHUB_REPOSITORY" --remove-label "accepted", comments that @${{ github.actor }} cannot approve and approvers need write, maintain, or admin target-repository access, then exits 1.
• 🟡 (16:38) src/modules/details-from-context.js change shown: extracted and exported PUBLISH_TITLE_REGEX = /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/; detailsFromContext() now matches issue titles against PUBLISH_TITLE_REGEX rather than an inline titleParser.