Distillation

Date: Sep 14, 2026

• 🟡 (12:12) src/publish/__tests__/workflow-action-pinning.js enumerates every .yml file under .github/workflows and defines workflow-security tests using Vitest; helper jobContents(workflow, jobName) extracts an individual YAML job section by locating its ${jobName}: header and the next two-space-indented top-level key.
• 🟡 (12:12) src/publish/__tests__/workflow-action-pinning.js defines SECRET_BEARING_JOBS as: .github/workflows/auto-approve.yml → ["auto-approve"]; .github/workflows/ci-poller.yml → ["check-ci"]; .github/workflows/cocoapods-keepalive.yml → ["keepalive"]; .github/workflows/publish.yml → ["waiting-for-ci", "publish"].
• 🟡 (12:12) src/publish/__tests__/workflow-action-pinning.js tests: 1. every actions/* reference matched by /^\s+(?:- )?uses: actions\/[^\s@]+@([^\s]+)$/gm must use a 40-character lowercase hexadecimal revision (/^[a-f0-9]{40}$/); 2. every workflow except .github/workflows/ci-poller-dispatch.yml must omit workflow_dispatch:; 3. every job listed in SECRET_BEARING_JOBS must contain environment: production; 4. .github/workflows/ci-poller-dispatch.yml alone must contain workflow_dispatch:, permissions: {}, and environment: production, and must not contain secrets..
• 🟡 (12:13) Workflow action search found exactly 18 references. .github/workflows/test.yml: line 19 actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, line 20 actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, line 23 actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830.
• 🟡 (12:13) .github/workflows/publish.yml action references: line 36 actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803; lines 42, 56, 167, and 285 actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1; lines 220 and 291 actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1; line 256 actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38; line 400 docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b.
• 🟡 (12:13) .github/workflows/ci-poller.yml action references: line 49 actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803; lines 61, 72, and 466 actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1. .github/workflows/auto-approve.yml: line 18 actions/checkout@11d5960a326750d5838078e36cf38b85af677262; line 23 actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1.
• 🟡 (12:13) Search found exactly 34 ${{ github.event... }}-related references across workflows. In .github/workflows/publish.yml, github.event.issue.title appears at lines 9, 70, 95, 237, and 372; github.event.issue.number appears at lines 68, 82, 93, 111, 114, 131, 158, 189, 193, 235, 247, 250, 370, 382, 385, 394, 471, 478, 516, and 523; github.event.issue.body appears at line 273.
• 🟡 (12:13) In .github/workflows/ci-poller.yml, event-derived expressions include line 40 ATTEMPT: ${{ github.event.client_payload.attempt || '0' }}, line 52 ref: ${{ github.event.repository.default_branch }}, and line 499 ATTEMPT: ${{ github.event_name == 'repository_dispatch' && steps.dispatch-attempt.outputs.value || '0' }}.
• 🟡 (12:13) In .github/workflows/auto-approve.yml, github.event.issue.number appears at line 34; github.event.issue.title at lines 36 and 51; and github.event.issue.html_url at lines 45 and 52.
• 🟡 (12:14) src/publish/discover-location.js defines immutable CRAFT_IMAGE as getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b, matching the Craft digest used by .github/workflows/publish.yml.
• 🟡 (12:14) getWorkspaceNames({ repositoryDirectory, exists = existsSync, execFile = execFileSync }) in src/publish/discover-location.js returns [] when ${repositoryDirectory}/.craft.yml does not exist. Otherwise it invokes docker run --rm --volume ${path.resolve(repositoryDirectory)}:/github/workspace/__repo__ --workdir /github/workspace/__repo__ ${CRAFT_IMAGE} workspace list with { encoding: "utf8" }.
• 🟡 (12:14) getWorkspaceNames() parses Craft’s output with JSON.parse; malformed JSON or a parsed value that is not an array both throw exactly Craft workspace discovery returned an invalid workspace list..
• 🟡 (12:14) discoverLocation({ input, repositoryDirectory, exists, execFile }) delegates to resolvePublishLocation({ path: input.path, workspaceNames: getWorkspaceNames(...) }), importing resolvePublishLocation from ../modules/publish-location.
• 🟡 (12:14) main() in src/publish/discover-location.js parses process.env.PUBLISH_ARGS || "{}" as JSON, throws Publish input must define a path. when input.path is absent, defaults repositoryDirectory from process.env.PUBLISH_REPOSITORY_DIRECTORY || "__repo__", and emits the JSON-stringified discovery result via core.setOutput("result", ...). The module runs main() only under require.main === module and exports { discoverLocation, getWorkspaceNames }.