Distillation

Date: Aug 26, 2026

• 🟡 (13:56) Inspected publish-workspace-acceptance/.github/workflows/publish.yml lines 135–323. The workflow runs node .__publish__/src/publish/inputs.js (id: inputs) and, upon successful input processing, runs node .__publish__/src/publish/post-workflow-details.js with GITHUB_TOKEN.
• 🟡 (13:56) Set target repo checkout branch condition selects a protected merge-target branch only for: sentry-migr8/tmp-merge-target; sentry-javascript/v10, v9, v8, v7, or master; sentry-python/alpha; and sentry-wizard/1.x. It emits target_repo_branch=$MERGE_TARGET to $GITHUB_OUTPUT; all other repositories use the default branch.
• 🟡 (13:56) The publish workflow creates a Release Bot GitHub App token via actions/create-github-app-token@v3, using vars.SENTRY_RELEASE_BOT_CLIENT_ID, secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY, and owner: getsentry; then actions/checkout@v6 checks out getsentry/${repo} at optional selected target_repo_branch into __repo__, with fetch-depth: 0.
• 🟡 (13:56) In Set targets, container_cwd is canonicalized as realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH" and rejected unless it equals /github/workspace/__repo__ or is beneath /github/workspace/__repo__/; rejection prints ::error::Publish path must remain inside the target checkout. and exits 1.
• 🟡 (13:56) The Set-targets state-file computation explicitly hashes Craft’s container-visible cwd rather than the runner-host path: cwd_hash="$(printf %s "$container_cwd" | sha1sum | cut -c1-12)". It defines shell sanitise() using lowercase conversion and sed 's/[^a-z0-9._-]\+/_/g; s/^_\+//; s/_\+$//'; a nonempty workspace is base64-encoded with base64 -w 0 | tr '+/' '-_' | tr -d '='.
• 🟡 (13:56) The Publish using Craft Docker action (docker://getsentry/craft:latest) executes /bin/bash -e -c, exports HOME=/root, changes directory to __repo__/${path}, then exec craft publish ${version}. Its XDG_STATE_HOME is /github/workspace/.craft-state, CRAFT_WORKSPACE comes from input workspace or '', and CRAFT_PUBLISH_STATE_GITHUB_REPO is pinned to getsentry/${repo} so state follows the issue checkout identity rather than an optional workspace GitHub release-repository override.
• 🟡 (13:56) The workflow’s failure-or-cancellation handler runs node .__publish__/src/publish/update-issue.js with PUBLISH_ARGS, CRAFT_STATE_FILE_PATH from steps.craft-state.outputs.state_file, and GITHUB_TOKEN; cancellation and failure separately invoke post-result.js cancelled and post-result.js failure, while success invokes post-result.js success.
• 🟡 (13:56) Publish Docker environment includes distinct GitHub credentials for registry versus cross-repository/API operations: DOCKER_GHCR_IO_USERNAME: x-access-token and DOCKER_GHCR_IO_PASSWORD use GITHUB_TOKEN for ghcr.io; GITHUB_API_TOKEN uses the Release Bot token. It also configures release identity sentry-release-bot[bot], email 180476844+sentry-release-bot[bot]@users.noreply.github.com, TWINE_USERNAME: __token__, and TWINE_VERBOSE: "1", alongside numerous named secret-backed publishing credentials.