Distillation

Date: Sep 9, 2026

• 🔴 [requested-review] (23:26) User requested a fresh, independent, READ-ONLY correctness and security review of the exact current worktree at /home/byk/Code/getsentry/publish, covering every relevant tracked and untracked changed file.
• 🔴 (23:26) User directed: “Never edit files.”
• 🔴 (23:26) User directed: “Never return empty”; the review must produce a NON-EMPTY final response.
• 🔴 (23:26) User stated automated approval must require request-bound github-actions[bot] proof posted before sentry-internal-app[bot] adds accepted; proofless Internal App labels and direct getsantry[bot]/sentry-release-bot[bot] labels must fail closed.
• 🔴 (23:26) User stated a human requester can never self-approve; only effective write, maintain, or admin roles on the target repository authorize approval.
• 🔴 (23:26) User stated live open state, title, body, dry-run, latest accepted event, and CI-ready provenance must remain bound; rename, mutation, closure, or reapproval never reaches ci-ready.
• 🔴 (23:26) User stated the poller always adds ci-ready after CI passes and directed never to introduce an idempotence skip.
• 🔴 (23:26) User stated approval must be revalidated immediately before immutable Craft execution.
• 🔴 (23:26) User stated every failure or cancellation path must remove accepted, even when publish inputs are missing or malformed.
• 🔴 (23:26) User stated manual workflow_dispatch recovery must use only the protected relay; privileged poller execution requires a successful main-branch workflow_run; repository_dispatch attempt input must be canonical bounded base-10 before token use or arithmetic.
• 🔴 (23:26) User stated GitHub Actions and Craft references must be immutable.
• 🔴 (23:26) User stated tests must materially enforce the publishing security boundaries.
• 🔴 (23:26) User accepted organization-wide availability of SENTRY_INTERNAL_APP_PRIVATE_KEY and SENTRY_RELEASE_BOT_PRIVATE_KEY as a pre-existing organization Security issue; it is not a merge blocker unless the current diff worsens exposure.
• 🔴 [requested-tests] (23:26) User required running yarn test --printConsoleTrace, yarn lint, and git diff --check.
• 🔴 (23:26) User required findings first, ordered by severity, with each finding marked MUST-FIX, CONCERN, or PASS and backed by exact current file:line evidence, followed by compact test evidence.
• 🔴 (23:26) User required the review to end with a separate final line containing exactly MERGE or DO-NOT-MERGE.
• 🔴 (23:26) User required that if any tool or artifact blocks review, the response begin with BLOCKED, identify the exact failure, and end exactly DO-NOT-MERGE.
• 🟡 (23:27) Current repository state reported as main...origin/main [behind 1].
• 🟡 (23:27) Modified tracked files reported: .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js.
• 🟡 (23:27) Untracked files/directories reported: .github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.
• 🟡 (23:27) Enumerated untracked tests under src/publish/__tests__/: authorize-approval.js, auto-approval-workflow.js, ci-poller-workflow.js, current-accepted-event.js, publish-workflow.js, record-auto-approval-attestation.js, record-ci-ready-attestation.js, validate-approval-attestation.js, and workflow-action-pinning.js.
• 🟡 (23:28) Tracked diff summary reported 21 files changed, with 499 insertions and 117 deletions.
• 🟡 (23:29) .github/workflows/auto-approve.yml currently triggers on opened issues, limits permissions to contents: read and issues: write, and runs only when the actor is sentry-release-bot[bot] or getsantry[bot] and the title starts with publish: (.github/workflows/auto-approve.yml:2-16).
• 🟡 (23:29) .github/workflows/auto-approve.yml pins actions/checkout@11d5960a326750d5838078e36cf38b85af677262 and actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 (.github/workflows/auto-approve.yml:18-27).
• 🟡 (23:29) .github/workflows/auto-approve.yml runs node src/publish/record-auto-approval-attestation.js, posts steps.attestation.outputs.auto_approval_attestation using ${{ github.token }}, and only afterward uses the Internal App token to add accepted when the parsed repository exactly matches a line in auto-approve-repos.txt (.github/workflows/auto-approve.yml:28-54).
• 🔴 (23:29) User stated: “Always run trusted code.”
• 🟡 (23:29) The current .github/workflows/ci-poller.yml includes a comment that workflow_dispatch can target any ref and therefore publish code must always be trusted; it also contains logic concerning workflow_run, repository_dispatch, accepted-event validation, removal of accepted, CI-ready attestation, pending-state synchronization, self-dispatch, and decimal arithmetic via attempt=$((10#$ATTEMPT + 1)).
• 🟡 (23:30) The current .github/workflows/publish.yml includes approval authorization and validation, removal of accepted on invalid approval, an explicit revalidation step named Revalidate approval attestation, REQUIRE_CI_READY_ATTESTATION: "true", Node 24 setup, target-repository checkout, Craft execution configuration, and post-publish issue updates.
• 🟡 (23:31) New .github/workflows/ci-poller-dispatch.yml defines Run CI Status Poller, triggers only on workflow_dispatch, sets permissions: {}, uses the production environment, runs on ubuntu-latest, and has only a run: ":" step (.github/workflows/ci-poller-dispatch.yml:1-16). Its comments state that production permits deployments only from main and that repository secrets must never be used by this workflow (.github/workflows/ci-poller-dispatch.yml:10-12).
• 🟡 (23:31) .github/workflows/test.yml triggers on pushes to main and pull requests, grants only contents: read, uses Bash, and runs unit tests on ubuntu-latest (.github/workflows/test.yml:1-17).
• 🟡 (23:31) .github/workflows/test.yml pins actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, and actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830; it configures Node 24, caches node_modules, installs via yarn install --frozen-lockfile only on a cache miss, and runs yarn test (.github/workflows/test.yml:19-34).