Distillation

🔴 (03:27) /home/byk/Code/getsentry/publish/src/publish/__tests__/workflow-action-pinning.js enumerates every .yml file in .github/workflows and requires every uses: actions/...@revision reference to use an exact lowercase 40-character hexadecimal revision matching /^[a-f0-9]{40}$/. 🔴 (03:27) workflow-action-pinning.js prohibits workflow_dispatch: in every workflow except .github/workflows/ci-poller-dispatch.yml. 🔴 (03:27) workflow-action-pinning.js defines secret-bearing jobs that must contain environment: production: .github/workflows/auto-approve.yml job auto-approve; .github/workflows/ci-poller.yml job check-ci; .github/workflows/cocoapods-keepalive.yml job keepalive; and .github/workflows/publish.yml jobs waiting-for-ci and publish. 🔴 (03:27) workflow-action-pinning.js requires the sole workflow-dispatch relay .github/workflows/ci-poller-dispatch.yml to contain workflow_dispatch:, permissions: {}, and environment: production, and forbids it from containing secrets.. 🔴 (03:27) /home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js requires .github/workflows/ci-poller.yml step Get publish code to use actions/checkout@ with a lowercase 40-character SHA and ref: ${{ github.event.repository.default_branch }}, and requires that checkout to occur before Get auth token. 🔴 (03:27) ci-poller-workflow.js verifies the protected manual-recovery design: .github/workflows/ci-poller.yml accepts repository_dispatch: type [ci-poller] and workflow_run: from [Run CI Status Poller], gated by github.event.workflow_run.conclusion == 'success' and github.event.workflow_run.head_branch == github.event.repository.default_branch, while containing no workflow_dispatch:. 🔴 (03:27) ci-poller-workflow.js requires .github/workflows/ci-poller-dispatch.yml to contain workflow_dispatch:, permissions: {}, and environment: production, while containing neither secrets. nor repository_dispatch:. 🔴 (03:27) ci-poller-workflow.js requires Validate dispatch attempt to run before Get auth token; the workflow’s shell attempt regex must accept decimal strings 0 through 59 and reject "", "00", "01", "60", "-1", "1x", and "$(id)". 🔴 (03:27) ci-poller-workflow.js requires dispatch attempts to set ATTEMPT: ${{ github.event_name == 'repository_dispatch' && steps.dispatch-attempt.outputs.value || '0' }}, increment with attempt=$((10#$ATTEMPT + 1)), and redispatch via gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -. 🔴 (03:27) ci-poller-workflow.js verifies every poller approval fence is bound to the listed request snapshot by extracting request_digest=$(echo "$publish_input" | jq -r '.requestDigest') and requiring exactly 4 occurrences of EXPECTED_REQUEST_DIGEST="$request_digest".