Distillation

Date: Aug 26, 2026

• 🟡 (13:21) Git status in /home/byk/Code/getsentry/craft-workspace-action-propagation: modified .github/workflows/release.yml, action.yml, src/commands/__tests__/publish.test.ts, and src/commands/publish.ts; untracked src/__tests__/action.test.ts.
• 🟡 (13:21) Git status in /home/byk/Code/getsentry/publish-workspace-acceptance: modified .github/workflows/publish.yml, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, and src/modules/update-issue.js.
• 🟡 (13:22) publish-workspace-acceptance/src/publish/inputs.js imports @actions/github, @actions/core, and detailsFromContext from ../modules/details-from-context; inputs() calls detailsFromContext({ context: github.context }) and writes the result as the GitHub Action output named result via core.setOutput('result', result), then invokes inputs().
• 🟡 (13:22) Craft typecheck completed successfully in /home/byk/Code/getsentry/craft-workspace-action-propagation using pnpm script tsc --noEmit.
• 🟡 (13:23) Full acceptance-project test run in /home/byk/Code/getsentry/publish-workspace-acceptance using yarn run v1.22.22 and vitest run passed: 5 test files and all 22 tests passed; duration 963ms (transform 224ms, import 894ms, tests 126ms); total Yarn completion 1.49s.
• 🟡 (13:23) The full acceptance test run repeated Vite’s warning that vitest.config.js:1:1 uses ESM syntax while loaded as CommonJS, incompatible with Vite’s planned default configLoader: 'native'; suggested .mjs, nearest package.json "type": "module", or VITE_CONFIG_NATIVE_IGNORE_WARNING=true.
• 🟡 (13:23) A Git lookup failed with fatal: invalid object name '83d210b'.
• 🟡 (13:24) In .github/workflows/publish.yml, the Set targets step runs only when fromJSON(steps.inputs.outputs.result).targets is truthy and exports CRAFT_PUBLISH_REPO, CRAFT_PUBLISH_PATH, CRAFT_PUBLISH_VERSION, and CRAFT_PUBLISH_TARGETS_JSON.
• 🟡 (13:24) .github/workflows/publish.yml Set targets constructs a prepopulated Craft publish-state payload with jq -n --argjson source "$CRAFT_PUBLISH_TARGETS_JSON" '[{($source[]): true }] | add | {"published": (. // {}) }'.
• 🟡 (13:24) .github/workflows/publish.yml maps CRAFT_PUBLISH_PATH to Craft container cwd: ././ → /github/workspace/__repo__; ./* → /github/workspace/__repo__/${CRAFT_PUBLISH_PATH#./}; otherwise → /github/workspace/__repo__/${CRAFT_PUBLISH_PATH}. It strips a trailing slash, hashes this container cwd with sha1sum | cut -c1-12, and sanitizes owner, repo, and version by lowercasing and replacing non-[a-z0-9._-] runs with _, trimming leading/trailing underscores.
• 🟡 (13:24) .github/workflows/publish.yml writes publish state outside the checked-out repository at $GITHUB_WORKSPACE/.craft-state/craft/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json; it creates the directory, writes the JSON payload, and logs the state-file path.
• 🟡 (13:24) .github/workflows/publish.yml invokes docker://getsentry/craft:latest as “Publish using Craft,” enters /bin/bash, exports HOME=/root, changes into __repo__/${{ fromJSON(steps.inputs.outputs.result).path }}, and executes craft publish ${{ fromJSON(steps.inputs.outputs.result).version }}.
• 🟡 (13:24) The Craft Docker invocation sets XDG_STATE_HOME: /github/workspace/.craft-state so publish state is outside __repo__/; it also supplies CRAFT_MERGE_TARGET, CRAFT_LOG_LEVEL, CRAFT_DRY_RUN, Git identity, GitHub/API tokens, registry credentials, and target credentials/secrets including CLOUDFLARE_API_TOKEN, COCOAPODS_TRUNK_TOKEN, CRAFT_GCS_TARGET_CREDS_JSON, CRATES_IO_TOKEN, DOCKER_PASSWORD, HEX_API_KEY, NPM_TOKEN, GEM_HOST_API_KEY, and AWS credentials.
• 🟡 (13:24) publish-workspace-acceptance/src/modules/__tests__/details-from-context.js tests parsing workspace title publish: getsentry/toolkit [workspace: "cli/v2"] @1.2.3 into repo: "toolkit", version: "1.2.3", and workspace: "cli/v2".
• 🟡 (13:24) details-from-context.js tests escaped workspace parsing: title publish: getsentry/toolkit [workspace: "cli [preview] \\"next\\""] @1.2.3 yields cli [preview] "next".
• 🟡 (13:24) details-from-context.js rejects legacy title publish: getsentry/toolkit @1.2.3 with Invalid publish issue title.
• 🟡 (13:24) details-from-context.js rejects explicit empty workspace plus escaped newline (cli\\nnext), NUL (\\u0000), tab (cli\\tnext), and bidi format character (cli\\u202enext) workspaces with Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters.
• 🟡 (13:24) details-from-context.js rejects checkout-escaping path title publish: getsentry/toolkit/../other@1.2.3 with Invalid publish issue path, and missing issue payload with Issue context is not defined.
• 🟡 (13:24) Assistant code review identified a critical action-manifest defect: craft/action.yml:173-179 puts WORKSPACE alongside rather than inside env on a composite-action step; GitHub will reject this metadata, and craft prepare would not receive the workspace if it were ignored. Assistant marked workspace-based releases blocked and “DO-NOT-MERGE.”
• 🟡 (13:24) Assistant review found src/__tests__/action.test.ts:65-83 masks the manifest defect by injecting WORKSPACE directly while executing only the shell snippet rather than validating parsed composite-action step env.
• 🟡 (13:24) Assistant review found incomplete regression coverage: src/__tests__/action.test.ts:106-115 checks only a Cf bidi character, omitting Cc, Zl, Zp, empty-title behavior, and valid non-control Unicode; publish/src/modules/__tests__/details-from-context.js:162-242 checks empty, Cc, and Cf but omits Zl, Zp, and valid non-control Unicode; craft/src/commands/__tests__/publish.test.ts tests getPublishStateGitHubConfig in isolation but not publishMain reading the exact prepopulated workflow state file; workflow filename calculation lacks executable regression coverage.
• 🟡 (13:24) Assistant review assessed state identity with workspace GitHub overrides as passing in source: workflow state filename derives from title checkout repo, container cwd, and workspace encoding (publish/.github/workflows/publish.yml:214-230), exports CRAFT_PUBLISH_STATE_GITHUB_REPO separately (:255-258), and Craft applies this override only in getPublishStatePath (craft/src/commands/publish.ts:715-731) through a state-only GitHub config without altering resolved configuration for status/artifact providers (:685-686).
• 🟡 (13:24) Assistant review assessed empty/control-Unicode workspace handling as passing in source: craft/action.yml:74-82 validates Cc, Cf, Zl, and Zp before title construction; action.yml:263-270 emits workspace title syntax only for nonempty input; absent/empty action input preserves legacy title syntax; publish/src/modules/details-from-context.js:26-31 rejects explicit empty workspace titles and the same Unicode classes while accepting valid non-control Unicode.
• 🟡 (13:24) Assistant review assessed rejection ordering as source-correct but operationally blocked by the manifest error: action.yml:74-82 validation occurs before GitHub API calls (:91-94), $GITHUB_ENV writes (:102-104), artifact download (:110-116), installation (:118-168), Git (:182), and Craft invocation.
• 🟡 (13:24) Assistant review additionally assessed no-workspace title/state compatibility as intact, workspace argv handling as a single inline --workspace=$WORKSPACE array argument in action.yml:185-213 to prevent option injection, and publish state as remaining under XDG outside __repo__; malformed titles and checkout escapes are rejected.