Distillation

🔴 (12:11) README.md approval policy requires explicit approval for customer-installed public releases such as sentry-cli, SDKs, and symbolicator utilities; internal dependencies such as arroyo may receive automatic approval because their later dependency bump in Sentry proper requires another explicit approval. Automatic approvals are managed by .github/workflows/auto-approve.yml. 🔴 (12:11) README.md notes that an independently published package gaining sufficient use outside Sentry may need its automatic-approval status reconsidered because it could become an attractive attack target. 🔴 (12:11) README.md explains that releases use Craft and short-lived Sentry Release Bot GitHub App tokens generated by actions/create-github-app-token; the app is installed across getsentry repositories with read/write access to code, pull requests, and actions, using organization-level SENTRY_RELEASE_BOT_CLIENT_ID and SENTRY_RELEASE_BOT_PRIVATE_KEY. 🔴 (12:11) README.md explains that Craft’s GitHub Actions use Sentry Release Bot tokens to create publish-request issues because workflows triggered with GITHUB_TOKEN cannot trigger additional workflows. 🔴 (12:11) README.md states the repository is read-only for everyone except release managers and cites getsentry/sentry#21930 as an example of the protected-repository model.