Distillation

Date: Sep 4, 2026

• 🔴 (15:30) User stated that new Craft requests always include the checkout repository identity.
• 🔴 (15:30) User stated that a missing root .craft.yml always means checkout-path behavior.
• 🔴 (15:30) User stated that the controller never normalizes names.
• 🟡 (15:30) Publish workflow change in .github/workflows/publish.yml: workspace discovery now runs whenever __repo__/.craft.yml exists, rather than only when needsWorkspaceDiscovery(input) is true; it runs getsentry/craft:latest workspace list against the exact CI-approved checkout.
• 🟡 (15:30) Publish workflow state filename change in .github/workflows/publish.yml: retains legacy sanitized version filenames when version_sanitised == "$CRAFT_PUBLISH_VERSION"; otherwise uses lossless URL-safe base64 version component version-${version_encoded}, where version_encoded="$(printf %s "$CRAFT_PUBLISH_VERSION" | base64 -w 0 | tr '+/' '-_' | tr -d '=')". Workspace components remain workspace-${workspace_encoded}-.
• 🟡 (15:30) Canonical publish-title documentation in docs/publish-issue-format.md now removes legacy-workspace syntax and defines title = "publish: ", [ "getsentry/" ], repository, [ path ], "@", version ;; workspace releases use full concrete path suffixes, e.g. publish: getsentry/toolkit/packages/cli@1.2.3.
• 🟡 (15:30) Documentation specifies title workspace-path segments and repository identities use ASCII [A-Za-z0-9_.-]+ token rules; ., .., __proto__, and segments/names beginning - are prohibited. Versions must be valid Craft semantic versions, including build metadata such as 4.2.6+sentry1.
• 🟡 (15:30) Documentation specifies that after exact CI-approved-revision checkout, craft workspace list supplies exact concrete workspace paths; an exact suffix match is a workspace, all other suffixes remain checkout paths, missing root .craft.yml uses checkout-path behavior, and discovery errors with root configuration fail the release.
• 🟡 (15:30) Documentation changes CI acceptance semantics: the accepted label starts CI waiting; publishing starts only on a fresh ci-ready label added to an open accepted issue with neither ci-pending nor ci-failed; dry-run still requests dry-run mode.
• 🟡 (15:30) src/modules/publish-issue-title.peggy and generated src/modules/publish-issue-title.js remove parsing and returned workspace data for legacy [workspace: <json-string>] title syntax. The grammar now parses optional syntactic paths and resolves complete suffixes only after CI-approved checkout.
• 🟡 (15:30) New src/modules/publish-issue-validation.js introduces shared isPublishRepository(name) and isReleaseVersion(version). Repository validation permits /^[A-Za-z0-9_.-]+$/ but rejects ., .., __proto__, and leading -; release-version validation uses case-insensitive semver regex ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-?([0-9a-z-]+(?:\.[0-9a-z-]+)*))?(?:\+([0-9a-z-]+(?:\.[0-9a-z-]+)*))?$.
• 🟡 (15:30) src/modules/ci-poller-input.js now validates parsed title repository, version, and path = \.${parsedTitle.path}`before callinggetReleaseRevision({ issueBody, repo }); it throws Invalid publish issue repository, Invalid publish issue version, or Invalid publish issue path` for invalid values.
• 🟡 (15:30) src/modules/details-from-context.js now uses the shared isPublishRepository, isReleaseVersion, and isPublishPath validators, removes legacy workspace JSON parsing and root-path/workspace mutual-exclusion logic, and returns parsed full-path title details with path.
• 🟡 (15:30) src/modules/publish-location.js removes needsWorkspaceDiscovery and explicit legacy workspace handling. resolvePublishLocation({ path, workspaceNames }) validates paths and all discovered workspace names, returns { path: "." , workspace } only when the complete path.slice(2) exactly matches a discovered workspace path, returns root { path: "." } for root releases, and otherwise preserves the checkout path.
• 🟡 (15:30) src/modules/publish-location.js adds isPublishPath(path): accepts only . or ./ plus slash-separated safe workspace segments. isSafeWorkspaceSegment(segment) requires /^[A-Za-z0-9_.-]+$/, rejects ., .., __proto__, and leading -; isWorkspaceName(name) validates every slash-separated segment.
• 🟡 (15:30) src/publish/resolve-location.js now always parses CRAFT_WORKSPACE_NAMES as JSON and passes it with input.path to resolvePublishLocation; it no longer conditionally discovers workspace names or passes input.workspace.
• 🟡 (15:30) Publish test changes: src/modules/__tests__/ci-poller-input.js covers root and full-path titles plus rejection before CI API calls for unsafe repositories (-toolkit, ., .., __proto__), invalid versions (--config, 1.2), malformed repository titles, and unsafe paths (../, ./, __proto__, --config).
• 🟡 (15:30) Publish test changes: src/modules/__tests__/details-from-context.js now verifies concrete packages/cli title suffix becomes path: "./packages/cli" and rejects spaces before versions, unsafe repositories, invalid versions, traversal/current-directory paths, and version path syntax.
• 🟡 (15:30) Publish test changes: src/modules/__tests__/publish-location.js verifies exact full workspace-path matching without case normalization, nonmatching multi-segment suffix preservation, invalid root-discovery output rejection, unsafe publish-path rejection, and discovered workspace rejection for ., .., packages/./cli, packages/../cli, packages/__proto__/cli, packages/-cli, packages/foo], packages/foo!, and packages/foo^.
• 🟡 (15:30) Publish workflow tests in src/modules/__tests__/publish-workflow.js now assert workspace discovery condition if [[ -f __repo__/.craft.yml ]]; then, fresh ci-ready event gating with accepted required and ci-pending/ci-failed absent, full-path workspace state filename encoding, and noncollision between 4.2.6+sentry1 and 4.2.6+Sentry1 state files: -version-NC4yLjYrc2VudHJ5MQ.json versus -version-NC4yLjYrU2VudHJ5MQ.json.