Distillation

🔴 (03:26) An expanded action-pin search found 18 uses across .github/workflows/test.yml, .github/workflows/publish.yml, .github/workflows/auto-approve.yml, and .github/workflows/ci-poller.yml; newly surfaced entries include .github/workflows/publish.yml line 268 using actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 and line 367 using docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b, plus .github/workflows/test.yml lines 19, 20, and 23. 🟡 (03:26) Assistant explained that the request snapshot is not trusted as authority by itself: validation recomputes a digest from the live issue, compares it with the event digest before parsing the event payload, and repeats the comparison immediately before Craft. 🟡 (03:26) Assistant investigated whether the approved SHA, publish location, and Craft state-file naming remain identical through all transformations, especially workspace mode and shell interpolation. 🔴 (03:26) /home/byk/Code/getsentry/publish/src/modules/__tests__/publish-workflow.js contains 5 workflow integration tests: (1) the CI-approved revision is used for target checkout, publish-location discovery, and craft publish ... --rev; (2) publication requires a fresh ci-ready label event with accepted and ci-ready present and ci-pending/ci-failed absent; (3) root release getsentry/sentry@21.3.1 uses legacy state filename publish-state-getsentry-sentry-c232c383e26f-21.3.1.json; (4) workspace packages/cli in toolkit@1.2.3 uses publish-state-getsentry-toolkit-c232c383e26f-workspace-cGFja2FnZXMvY2xp-1.2.3.json; (5) versions 4.2.6+sentry1 and 4.2.6+Sentry1 produce distinct base64-qualified state filenames ending -version-NC4yLjYrc2VudHJ5MQ.json and -version-NC4yLjYrU2VudHJ5MQ.json. 🔴 (03:26) /home/byk/Code/getsentry/publish/src/modules/__tests__/publish-workflow.js executes the literal Set targets shell block from .github/workflows/publish.yml via bash -e -c, passing CRAFT_PUBLISH_PATH, CRAFT_PUBLISH_REPO, CRAFT_PUBLISH_TARGETS_JSON: '["github"]', CRAFT_PUBLISH_VERSION, CRAFT_PUBLISH_WORKSPACE, GITHUB_OUTPUT, and GITHUB_WORKSPACE; it verifies generated state JSON equals { published: { github: true } }. 🔴 (03:26) /home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js verifies 4 occurrences of EXPECTED_REQUEST_DIGEST: ${{ steps.request-digest.outputs.request_digest }}, requires Revalidate approval attestation after Set targets and before Publish using Craft, checks REQUIRE_CI_READY_ATTESTATION: "true" in that final section, and requires Craft to use an immutable 64-hex-character SHA-256 digest. 🔴 (03:26) /home/byk/Code/getsentry/publish/src/modules/__tests__/details-from-context.js verifies detailsFromContext() parses canonical request headers, selected targets, qualified and legacy titles, + versions, default versus concrete merge targets, and workspace suffixes; representative outputs include repo: "sentry", version: "21.3.1", path: ".", merge_target: "custom-branch", targets ["github", "npm[@sentry/node]", "docker[latest]"], and workspace title publish: getsentry/toolkit/packages/cli@1.2.3 yielding path: "./packages/cli". 🔴 (03:26) details-from-context.js tests require the merge target to come from the canonical request header rather than a trailing Merge target: decoy, and require (default) to resolve to merge_target: "". 🔴 (03:26) details-from-context.js tests reject malformed or unsafe publish inputs: unexpected title spacing publish: getsentry/toolkit @1.2.3; paths containing ../ or ./; repository identities -toolkit, ., .., and __proto__; versions --config and 1.2; version/path syntax 1.2.3/other; and missing issue context. Expected errors include Invalid publish issue title, Invalid publish issue path, Invalid publish issue repository, Invalid publish issue version, and Issue context is not defined. 🔴 (03:26) User surfaced /home/byk/Code/getsentry/publish/src/modules/__tests__/publish-location.js; its tests require exact, case-sensitive workspace matching without normalization, e.g. path: "./packages/CLI" with workspaces ["packages/cli", "packages/CLI"] resolves to { path: ".", workspace: "packages/CLI" }. 🔴 (03:26) /home/byk/Code/getsentry/publish/src/modules/__tests__/publish-location.js keeps non-workspace paths unchanged ("./packages" and "./packages/cli"), keeps root releases at ".", rejects unsafe publish paths "./.", "./..", and "./packages/../other", and fails closed on invalid discovered workspaces. 🔴 (03:26) Invalid workspace discovery values covered by publish-location.js tests are "cli-日本語", ".", "..", "packages/./cli", "packages/../cli", "packages/__proto__/cli", "packages/-cli", "packages/foo]", "packages/foo!", and "packages/foo^"; expected errors are Invalid publish path. or Craft workspace discovery returned an invalid workspace list.. 🔴 (03:26) /home/byk/Code/getsentry/publish/src/modules/__tests__/release-revision.js verifies getReleaseRevision() extracts lowercase SHA 7e5ca7ed5581552de066e2a8bc295b8306be38ac only from the canonical request-header View check runs link for getsentry/toolkit, while accepting CRLF bodies and URLs with or without the trailing slash after /checks. 🔴 (03:26) release-revision.js tests reject check-run URLs missing /checks, links for another repository, decoy or embedded links outside the canonical request header, a complete Quick links block outside the header, and a complete request header that does not begin the issue; duplicate/decoy cases expect Expected exactly one View check runs link in Quick links. 🔴 (03:26) updateReleaseRevision() is tested to replace only the canonical request-header SHA while preserving CRLF and trailing content; replacement revisions "A".repeat(40), "a".repeat(39), and "a".repeat(41) are rejected with Release revision must be a lowercase 40-character SHA.. 🔴 (03:26) /home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-input.js verifies getCiPollerInput() parses root and full-path titles into repo: "getsentry/toolkit", revision: "7e5ca7ed5581552de066e2a8bc295b8306be38ac", version: "1.2.3", and a digest computed by requestDigest({ body, labels, title }). 🔴 (03:26) ci-poller-input.js verifies .github/workflows/ci-poller.yml checks out trusted publish code at .__publish__, invokes node .__publish__/src/publish/resolve-ci-poller-input.js, and no longer contains shell parsing with grep -oP '(?<=commit/. 🔴 (03:26) CI-poller input validation tests reject unsafe repositories -toolkit, ., .., and __proto__; invalid versions --config and 1.2; malformed titles publish: getsentry/@1.2.3 and publish: getsentry/toolkit$@1.2.3; and paths containing ../, ./, __proto__, or --config before any CI API calls. 🔴 (03:26) /home/byk/Code/getsentry/publish/src/publish/__tests__/discover-location.js verifies missing root configuration preserves checkout-path behavior, while exact workspace discovery invokes Docker with pinned image getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b and arguments containing workspace list. 🔴 (03:26) discover-location.js tests fail closed with Craft workspace discovery returned an invalid workspace list. when Craft returns object JSON "{}" or blank output "\n". 🔴 (03:26) /home/byk/Code/getsentry/publish/src/publish/__tests__/resolve-release-revision.js verifies empty PUBLISH_ARGS and PUBLISH_ISSUE_BODY fail through domain validation with Publish input must define a repository. rather than JSON parser error Unexpected end of JSON input. 🔴 (03:27) /home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js verifies approval attestations bind the trusted comment author, latest accepted actor/event ID, and request digest; numeric GitHub event ID 29503999078 is normalized to string "29503999078". 🔴 (03:27) Approval-attestation tests verify CI-ready attestations bind both the current accepted event and CI-ready actor: acceptedEvent: { actor: "contractor", eventId: "200" } with CI-ready actor sentry-internal-app[bot] succeeds, but accepted event "201" or CI-ready actor "contractor" fails. 🔴 (03:27) Approval-attestation tests reject untrusted comment authors, stale event IDs, changed titles, malformed marker <!-- publish-approval not-base64 -->, and requests whose dry-run state changed after attestation. 🔴 (03:27) /home/byk/Code/getsentry/publish/src/publish/__tests__/request-digest-from-event.js verifies requestDigestFromEvent() hashes the exact issue-event snapshot including body, title, and labels accepted and dry-run; absent issue data throws The GitHub event has no issue snapshot, while an incomplete issue snapshot throws Invalid publish request.