Dashboard › publish › Distillation
da9a3167-a4a2-4676-a9d3-841d9659247c["lore_tm_v1_OG5EmoBemaVdVJB8LQ2rnjCU0I8wUZTcGnSO3DR7EmM","lore_tm_v1_1G6ggEuCgW-t8NAQXVisH89NddKL8IU4gMlYk-WlxfU","lore_tm_v1_5TSFDGhEE8wXmrRDkg7xHgWAVytaaIy2Ah26EQ7F9bA","lore_tm_v1_Q-t6aboxEfH-m8SFVfBd0TlRpQfQ83jDq7W6oq8o-Z4","lore_tm_v1_2u1JE83G7sDUsXhOP0kS66pCofSrP65rd8RQ1YSW28M","lore_tm_v1_W4THCEaxVnT0Ex5bTI1XDhbkwwZ8VOPdEEFT8OKsYsE","lore_tm_v1_w5p3Gvv0PGl5EusOPVhMkyeyhbo9U1TcZks-fmbn5ok","lore_tm_v1_GD0JLVaWlINRvD-vlEBynOD9ZWpuaPy94ogxNr2hnII","lore_tm_v1_fydgWHu8p-2Ubn1CvWj9P9quVZddTWmMYUdc2iJh2oI","lore_tm_v1_cIttmXtYiGm-2hAf7ywcYltMzuv4obDXY5msN9PC3Zc","lore_tm_v1_YnAYQX3IMq3GPX_DJ8L4PXLKidTx8CKhM7DySY5cEWE","lore_tm_v1_e44UhJiajHWI17uT2I_etsLHg9O9QJ5p5XPibAsO8g4"]
Date: Sep 10, 2026
/home/byk/Code/getsentry/publish/src/publish/__tests__/request-digest-from-event.js contains 2 tests for requestDigestFromEvent(): 1. an exact issue-event snapshot with body Merge target: main, labels accepted and dry-run, and title publish: getsentry/relay@1.2.3 produces requestDigest(issue); 2. an event without issue throws "The GitHub event has no issue snapshot", while an incomplete issue { body: "", labels: [] } throws "Invalid publish request"./home/byk/Code/getsentry/publish/src/publish/__tests__/post-result.js tests main() with PUBLISH_ARGS either absent or "not-json"; both cases still invoke report with inputs: {} and status: "failure"./home/byk/Code/getsentry/publish/src/publish/__tests__/workflow-action-pinning.js dynamically checks every .github/workflows/*.yml action reference matching actions/...@revision and requires a 40-character lowercase hexadecimal revision. workflow_dispatch: is forbidden everywhere except .github/workflows/ci-poller-dispatch.yml.SECRET_BEARING_JOBS requires environment: production for .github/workflows/auto-approve.yml job auto-approve, .github/workflows/ci-poller.yml job check-ci, .github/workflows/cocoapods-keepalive.yml job keepalive, and .github/workflows/publish.yml jobs waiting-for-ci and publish..github/workflows/ci-poller-dispatch.yml must contain workflow_dispatch:, permissions: {}, and environment: production, and must not contain secrets../home/byk/Code/getsentry/publish/src/modules/__tests__/details-from-context.js verifies detailsFromContext() parses publish: getsentry/sentry@21.3.1 with canonical Merge target: custom-branch into { dry_run: "", merge_target: "custom-branch", path: ".", repo: "sentry", targets: ["github", "npm[@sentry/node]", "docker[latest]"], version: "21.3.1" }; (default) maps to merge_target: ""; a later decoy Merge target: decoy does not override the canonical request header.details-from-context.js verifies versions containing +, including 4.2.6+sentry1; parsePublishTitle("publish: getsentry/sentry-javascript/packages/core@10.0.0") returns { path: "/packages/core", repo: "sentry-javascript", version: "10.0.0" }, while legacy publish: sentry-javascript@10.0.0 returns { path: "", repo: "sentry-javascript", version: "10.0.0" }; publish: getsentry/toolkit/packages/cli@1.2.3 resolves to checkout path ./packages/cli.details-from-context.js rejects: title publish: getsentry/toolkit @1.2.3 and version-path title publish: getsentry/toolkit@1.2.3/other with "Invalid publish issue title"; paths ../other and ./other with "Invalid publish issue path"; repositories -toolkit, ., .., and __proto__ with "Invalid publish issue repository"; versions --config and 1.2 with "Invalid publish issue version"; and missing issue payload with "Issue context is not defined"./home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js verifies processEndState() terminal reporting for issue "211" and run "1234": failure posts "Failed to publish." with focused run logs and a branch-deletion link for version 21.3.1; cancellation posts "Publish workflow cancelled." with the same links; success posts "Published successfully: [run#1234](https://github.com/getsentry/sentry/actions/runs/1234)" and closes the issue.process-end-state.js verifies successful publication closes issue "211" before workflow-run lookup and commenting, so the close still occurs if getWorkflowRun rejects with "unavailable"; undefined status throws "Unknown status: 'undefined'" without commenting or updating the issue./home/byk/Code/getsentry/publish/src/modules/__tests__/publish-location.js, containing tests for resolvePublishLocation()./home/byk/Code/getsentry/publish/src/modules/__tests__/publish-location.js verifies exact, case-sensitive workspace classification: path ./packages/CLI with workspace names ["packages/cli", "packages/CLI"] returns { path: ".", workspace: "packages/CLI" } without normalization. Non-exact workspace suffixes remain checkout paths: ./packages with ["cli"] returns { path: "./packages" }, and ./packages/cli with ["cli"] returns { path: "./packages/cli" }; root path . remains { path: "." }.publish-location.js rejects unsafe publish paths ./., ./.., and ./packages/../other with "Invalid publish path."; invalid discovery workspace cli-ζ₯ζ¬θͺ; and unsafe workspace names ., .., packages/./cli, packages/../cli, packages/__proto__/cli, packages/-cli, packages/foo], packages/foo!, and packages/foo^ with "Craft workspace discovery returned an invalid workspace list.". Even a root release validates discovery output and rejects packages/../cli./home/byk/Code/getsentry/publish/src/modules/__tests__/release-revision.js uses revision 7e5ca7ed5581552de066e2a8bc295b8306be38ac and verifies getReleaseRevision() extracts it only from the canonical request-header [View check runs](https://github.com/getsentry/toolkit/commit/<revision>/checks/) link; CRLF bodies and omission of the trailing slash after checks are accepted.release-revision.js rejects a check-runs URL lacking /checks, a link targeting getsentry/other, a complete Quick links block outside the request header, and a complete request header not starting at the beginning with "Expected a View check runs link for getsentry/toolkit"; duplicate/decoy links outside the canonical header throw "Expected exactly one View check runs link in Quick links".updateReleaseRevision() replaces only the canonical request-header revision while preserving CRLF and trailing content. Replacement revisions "A".repeat(40), "a".repeat(39), and "a".repeat(41) throw "Release revision must be a lowercase 40-character SHA."./home/byk/Code/getsentry/publish/src/modules/__tests__/publish-workflow.js extracts the Bash script between workflow steps Set targets and Revalidate approval attestation, runs it with CRAFT_PUBLISH_PATH, CRAFT_PUBLISH_REPO, CRAFT_PUBLISH_TARGETS_JSON='["github"]', CRAFT_PUBLISH_VERSION, CRAFT_PUBLISH_WORKSPACE, GITHUB_OUTPUT, and GITHUB_WORKSPACE, and cleans temporary publish-workflow-test- directories after each test.src/modules/__tests__/publish-workflow.js requires .github/workflows/publish.yml ordering Resolve CI-approved release revision β Inform start β Check out target repo β Resolve publish location β Set targets β Publish using Craft; checkout uses ref: ${{ steps.release-revision.outputs.revision }} and exactly 2 references to actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1.node .__publish__/src/publish/discover-location.js, PUBLISH_REPOSITORY_DIRECTORY: __repo__, Craft image docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b, location-derived CRAFT_PUBLISH_PATH and CRAFT_PUBLISH_WORKSPACE, and command craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}.ci-ready label event: github.event.label.name == 'ci-ready', current labels include accepted and ci-ready, and current labels exclude ci-pending and ci-failed.sentry@21.3.1 state path ending .craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json; monorepo workspace packages/cli for toolkit@1.2.3 ends .craft-state/craft/publish-state-getsentry-toolkit-c232c383e26f-workspace-cGFja2FnZXMvY2xp-1.2.3.json; both contain { published: { github: true } }.4.2.6+sentry1 ends -version-NC4yLjYrc2VudHJ5MQ.json, while 4.2.6+Sentry1 ends -version-NC4yLjYrU2VudHJ5MQ.json, and the paths must differ.master.src/commands/__tests__/publish.test.ts, src/commands/publish.ts, src/commands/workspace.ts, src/commands/workspace_cmds, src/commands/workspace_cmds/__tests__, src/commands/workspace_cmds/__tests__/list.test.ts, src/commands/workspace_cmds/list.ts, src/utils/__fixtures__/workspaces, src/utils/__fixtures__/workspaces/no-workspace, src/utils/__fixtures__/workspaces/no-workspace/package.json, src/utils/__fixtures__/workspaces/npm-workspace, src/utils/__fixtures__/workspaces/npm-workspace/package.json, src/utils/__fixtures__/workspaces/npm-workspace/packages, src/utils/__fixtures__/workspaces/npm-workspace/packages/pkg-a, src/utils/__fixtures__/workspaces/npm-workspace/packages/pkg-a/package.json, src/utils/__fixtures__/workspaces/npm-workspace/packages/pkg-b, src/utils/__fixtures__/workspaces/npm-workspace/packages/pkg-b/package.json, src/utils/__fixtures__/workspaces/pnpm-workspace, src/utils/__fixtures__/workspaces/pnpm-workspace/package.json, src/utils/__fixtures__/workspaces/pnpm-workspace/packages, src/utils/__fixtures__/workspaces/pnpm-workspace/packages/pkg-a, src/utils/__fixtures__/workspaces/pnpm-workspace/packages/pkg-a/package.json, src/utils/__fixtures__/workspaces/pnpm-workspace/packages/pkg-b, src/utils/__fixtures__/workspaces/pnpm-workspace/packages/pkg-b/package.json, src/utils/__fixtures__/workspaces/pnpm-workspace/pnpm-workspace.yaml, src/utils/__tests__/publishState.test.ts, src/utils/__tests__/workspaces.test.ts, src/utils/publishState.ts, and src/utils/workspaces.ts.src/utils/publishState.ts moves publish-resume state outside the repository checkout to $XDG_STATE_HOME/craft/, falling back to $HOME/.local/state/craft/, preventing committed repository content or earlier CI steps from pre-populating completed targets. getsentry/publish runs in Docker with HOME=/root.getCraftStateDir() returns join(XDG_STATE_HOME, "craft") when nonempty, otherwise join(homedir(), ".local", "state", "craft"). sanitiseForFilename() lowercases, replaces characters outside [a-z0-9._-] with _, collapses runs, and trims leading/trailing underscores.encodeVersionForFilename() uses the sanitized version only when it exactly equals the original; otherwise it emits version-${Buffer.from(version).toString('base64url')} to preserve distinctions such as case. shortCwdHash() is the first 12 hexadecimal characters of SHA-1 over the absolute cwd.getPublishStateFilename(version, githubConfig, cwd = process.cwd(), workspace?) uses publish-state-<owner>-<repo>-<sha1(cwd)[:12]>-<version>.json with GitHub config, or publish-state-<sha256(cwd)[:16]>-<version>.json without it. A workspace inserts workspace-${Buffer.from(workspace).toString('base64url')}- before the encoded version so same-repository, same-version release units do not share resume state.getPublishStatePath(version, githubConfig, cwd = process.cwd(), workspace?) joins getCraftStateDir() with getPublishStateFilename(version, githubConfig, cwd, workspace).