Dashboard › publish › Distillation
d7c63c2f-ebb5-46a6-95eb-7d113db052fc["lore_tm_v1_k4IMQ0gVQnYAVtvjddD1tmncpWsH3KYukSjCmdNsGac","lore_tm_v1_j6-pYwKZWvEBzhbwbXyeR-AO1esyGzMIIAZJAEO9WJM","lore_tm_v1_ccSSvDXjC19kgn-3Wx2Cg0h0hc1KlHAu1-t6Bj2U1nU","lore_tm_v1_iEAWDmmWCc3nFGH2F4jQ-YjNOcEPNs8wFxu_J7MJScw","lore_tm_v1_9jK0fDiSIN6WEibpxDtqEjBNZIs0v1KUHMhax8GmN1c","lore_tm_v1_tIdfXumk8vpRWysr-sCwDWJfCRHLM0IGZv2xu9LZPAw","lore_tm_v1_oS2NWpHu1ghnLF5BbJRVXI_0pS1UmRXdcQL_GTUhDrk","lore_tm_v1_lGXrxD0nvn7H87HM9ad7rwuEiTI4vC_Kmgyv1VnSUzk","lore_tm_v1_dNks_oGGhQjj5JsmENYbi6ZNYoQnWmp0fg4t8Yz3plo","lore_tm_v1_uKv6o_ER91OKusp8eY83Sr9M2zt5I-45A4-eWCOLjnA","lore_tm_v1_RiSUKENuSEJ9DXOoKV6s9zIgLGxJEo36WITIj24bNXc","lore_tm_v1_5nOGN6nKTIWBmDyvrpkerXgt0O0OCGKdJZRYEGJfSXI","lore_tm_v1_ko5E5ZqoUlAr2qLJZzR2jRJcDTUe707pdkO9pWls8pc","lore_tm_v1_ksS7jcJw9Q06QQqBi_mgNgN5I6Txi_vITYLV9aaOpQo","lore_tm_v1_EzwQrirHVrwCPmrD1Tc-A1j7jaxcGJCNWAypk8UgFFk","lore_tm_v1_jv18OIZAtE64q2ujh-xgroFyOlUHjRh1K-oiGMOsy1I","lore_tm_v1_7MRO_sLgvMTuowkFKbvxWI4Ia_DwQMWpbiwGqL9uvrI","lore_tm_v1_5dICBU9EI-Ijp56IxzNrBWVsaTubMBFbtqFnwfq76UE"]
Date: Aug 27, 2026
/home/byk/Code/getsentry/publish; requested assessment of correctness, security, GitHub Actions behavior, and missing tests; requested only substantive findings with severity and file:line references, ending in MERGE or DO-NOT-MERGE..github/workflows/publish.yml; untracked src/modules/__tests__/approval-authorizer.js, src/modules/approval-authorizer.js, and src/publish/authorize-approval.js. Diffstat for .github/workflows/publish.yml: 36 insertions..github/workflows/publish.yml adds a Get publish code step using actions/checkout@v6 with persist-credentials: false; a Get release bot auth token step using actions/create-github-app-token@v3, ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}, ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}, and owner: getsentry; and an Authorize approval step running node src/publish/authorize-approval.js with APPROVAL_TOKEN, APPROVAL_ACTOR: ${{ github.actor }}, and APPROVAL_ISSUE_TITLE: ${{ github.event.issue.title }}..github/workflows/publish.yml adds Reject unauthorized approval, conditional on steps.authorization.outputs.authorized != 'true', which uses the internal-app token as GH_TOKEN, removes the accepted label, comments @${{ github.actor }} cannot approve this release. Approvers must have write, maintain, or admin access to the target repository., then exits 1.src/modules/approval-authorizer.js defines ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]), AUTO_APPROVER = "getsantry[bot]", and PUBLISH_TITLE_REGEX = /^publish: (?<owner>[^/]+)\/(?<repository>[^/@]+)(?:\/[^@]+)?@[^@]+$/.authorizeApproval({ actor, issueTitle, getPermission }) in src/modules/approval-authorizer.js:5-25 rejects malformed titles and non-getsentry owners without a permission lookup, returns { authorized: true, repository } for actor getsantry[bot] without lookup, otherwise calls getPermission({ owner, repository, username: actor }) and authorizes only GitHub role_name values write, maintain, or admin.src/publish/authorize-approval.js defines getPermission() which calls https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/collaborators/${encodeURIComponent(username)}/permission with Accept: application/vnd.github+json, Authorization: Bearer ${process.env.APPROVAL_TOKEN}, and X-GitHub-Api-Version: 2026-03-10; non-OK responses throw an error including username, owner/repository, and HTTP status.src/publish/authorize-approval.js:25-46 requires GITHUB_OUTPUT and APPROVAL_TOKEN, calls authorizeApproval() with APPROVAL_ACTOR and APPROVAL_ISSUE_TITLE, appends authorized=${authorized}\n to GITHUB_OUTPUT, and handles top-level errors by logging them and setting exit code 1.src/modules/__tests__/approval-authorizer.js contains 12 tests: trusted getsantry[bot] authorization without lookup; authorization for write, maintain, and admin; rejection for none, read, triage, Elevated Bot, and undefined; rejection of non-getsentry and malformed titles without lookup; and propagation of permission-lookup failure.ci-ready.docs/rfc.md:10 says SDK releases need approval by a manager or senior engineer per SOC/ISO compliance policy; docs/rfc.md:23 says release-repository owners add the accepted tag to trigger publishing; and docs/rfc.md:30 raises whether release-repo owners should need a second person’s approval, like code review..github/workflows/auto-approve.yml:1-35 automatically approves issues opened by sentry-release-bot[bot] or getsantry[bot] with titles starting publish: : it checks out auto-approve-repos.txt, obtains an internal-app token using actions/create-github-app-token@v3, extracts REPO via sed -n 's/^publish: \(.*\)@.*/\1/p', and adds accepted if REPO exactly matches a line in auto-approve-repos.txt.src/publish/inputs.js:1-12 calls detailsFromContext({ context: github.context }) and sets output result through @actions/core.src/modules/details-from-context.js:24-56 parses issue titles using /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/; supports omitted getsentry/ owner, optional target paths, parses dry-run, optional Merge target: ..., and checked targets from the issue body.README.md:26-32 states publish-system goals: employees should not publish through personal accounts, access global credentials, or build/publish from machines; releases should require formal approval from a limited set of release managers while allowing any engineer to initiate a release.README.md:83-91 states publicly distributed packages such as sentry-cli, SDKs, and symbolicator require explicit approval, while internal dependencies such as arroyo may use auto-approval; it identifies .github/workflows/auto-approve.yml as the automatic-approval mechanism.README.md:93-99 states Sentry Release Bot is installed on all getsentry repositories with read/write access to code, PRs, and actions; app tokens are generated with SENTRY_RELEASE_BOT_CLIENT_ID and SENTRY_RELEASE_BOT_PRIVATE_KEY; the publish repository is read-only except for release managers because its secrets include admin GitHub and package-publishing credentials.package.json specifies Node 24.0.0, Yarn 1.22.22, vitest ^4.1.0, scripts test: vitest run, lint: eslint src .github --ignore-pattern '!.github', and dependencies @actions/core ^2.0.0, @actions/github ^7.0.0, and @sentry/node ^10.0.0.yarn vitest run src/modules/__tests__/approval-authorizer.js passed: 1 test file and all 12 tests passed; Vitest v4.0.17; duration 217 ms; Yarn completed in 0.67 s.yarn eslint src .github --ignore-pattern '!.github' failed with 1 error and 0 warnings: .github/workflows/cocoapods-keepalive.yml:1:7, yml/plain-scalar, “Must use plain style scalar”; ESLint reported the error could potentially be fixed with --fix.auto-approve-repos.txt contains 46 auto-approvable targets: getsentry/arroyo, getsentry/auto-type-annotate, getsentry/devenv, getsentry/infra-event-notifier, getsentry/jest-sentry-environment, getsentry/json-schema-diff, getsentry/js-source-scopes, getsentry/objectstore/clients, getsentry/ophio, getsentry/pdb, getsentry/pyo3-python-tracing-subscriber, getsentry/pytest-sentry, getsentry/relay/py, getsentry/responses, getsentry/rust-proguard, getsentry/rust-sourcemap, getsentry/rust-usage-accountant, getsentry/script-runner, getsentry/sentry-api-schema, getsentry/sentry-forked-djangorestframework-stubs, getsentry/sentry-forked-django-stubs, getsentry/sentry-forked-jsonnet, getsentry/sentry-infra-tools, getsentry/sentry-kafka-management, getsentry/sentry-kafka-schemas, getsentry/sentry-protos, getsentry/sentry-redis-tools, getsentry/service-registry, getsentry/skrooge, getsentry/snuba-sdk, getsentry/statsdproxy, getsentry/status-page-list, getsentry/streams/sentry_streams, getsentry/symbolic, getsentry/taskbroker/clients, getsentry/usage-accountant, getsentry/watto, getsentry/sentry, getsentry/snuba, getsentry/vroom, getsentry/relay, getsentry/symbolicator, getsentry/taskbroker, getsentry/uptime-checker, getsentry/launchpad, and getsentry/self-hosted.(?:publish: (?!getsentry/)) failed because ripgrep’s default regex engine does not support look-around; it advised --pcre2.src/publish/__tests__/authorize-approval.js tests the entry point: a successful write permission response must fetch https://api.github.com/repos/getsentry/sentry-javascript/collaborators/contractor/permission with Authorization: Bearer release-bot-token and write authorized=true\n to /tmp/github-output; an HTTP 404 permission response must reject with Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404, must not call console.error, and must not write output.