Distillation

🔴 (10:13) src/modules/approval-authorizer.js defines ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]), AUTO_APPROVAL_LABELER = "sentry-internal-app[bot]", and AUTO_APPROVERS = new Set(["getsantry[bot]", "sentry-release-bot[bot]"]).

🔴 (10:13) isAutoApprovedRepository({ actor, autoApprovedRepositories, issueTitle }) rejects actors outside AUTO_APPROVERS, parses the issue title with parsePublishTitle(issueTitle), rejects invalid titles, and checks membership of getsentry/${title.repo}${title.path || ""} in autoApprovedRepositories.

🔴 (10:13) authorizeApproval({ actor, issueTitle, getPermission }) returns { authorized: false, repository: null } for an invalid publish title; otherwise it sets repository to getsentry/${title.repo}.

🔴 (10:13) authorizeApproval() denies actors in AUTO_APPROVERS and denies AUTO_APPROVAL_LABELER, returning { authorized: false, repository } without checking collaborator permissions.

🔴 (10:13) For other actors, authorizeApproval() calls getPermission({ owner: "getsentry", repository: title.repo, username: actor }) and authorizes only when the returned role_name is "write", "maintain", or "admin".

🔴 (10:13) src/modules/approval-authorizer.js exports AUTO_APPROVAL_LABELER, AUTO_APPROVERS, authorizeApproval, and isAutoApprovedRepository.

🔴 (10:13) src/publish/__tests__/record-ci-ready-attestation.js contains exactly 3 Vitest tests for recordCiReadyAttestation() and imports parseCiReadyAttestation from ../../modules/approval-attestation.js.

🔴 (10:13) Test 1, "binds the current approval to the app that will add ci-ready", uses title publish: getsentry/sentry-javascript@10.0.0, issue number "123", repository "getsentry/publish", authenticated login "sentry-internal-app[bot]", an open issue with body "Merge target: main" and label "accepted", and an accepted-label event with actor "contractor" and ID "100".

🔴 (10:13) Test 1 expects parseCiReadyAttestation(attestation) to return acceptedActor: "contractor", acceptedEventId: "100", ciReadyActor: "sentry-internal-app[bot]", the original title, and requestDigest: expect.any(String).

🔴 (10:13) Test 2, "rejects an approval that changes before ci-ready is recorded", supplies expected title publish: getsentry/sentry-javascript@10.0.0 but a live title of publish: getsentry/sentry-python@10.0.0, and expects rejection with The approval changed before CI could be marked ready.

🔴 (10:13) Test 3, "rejects a re-approval after the event observed by the poller", supplies expectedAcceptedEvent: { actor: "contractor", eventId: "100" } while the current accepted event has ID "200", and expects rejection with The approval changed before CI could be marked ready.

🔴 (10:14) The environment listed credential/secret variable names AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, CI_POLLER_APP_PRIVATE_KEY, CLOUDFLARE_API_TOKEN, COCOAPODS_TRUNK_TOKEN, CRAFT_GCS_STORE_CREDS_JSON, CRAFT_GCS_TARGET_CREDS_JSON, CRATES_IO_TOKEN, DOCKER_PASSWORD, GEM_HOST_API_KEY, GPG_PASSPHRASE, GPG_PRIVATE_KEY, HEX_API_KEY, NPM_TOKEN, NUGET_API_TOKEN, OSSRH_PASSWORD, OSSRH_USERNAME, POWERSHELL_API_KEY, PUBDEV_ACCESS_TOKEN, PUBDEV_REFRESH_TOKEN, SENTRY_RELEASE_BOT_PRIVATE_KEY, TWINE_PASSWORD, and VERCEL_TOKEN; no secret values are retained.

🔴 (10:14) The environment had CI_POLLER_HAS_PENDING=false.

🔴 (10:14) The environment included CI_POLLER_APP_CLIENT_ID and VERCEL_ORG_ID identifiers; their values are omitted from the durable observation.

🔴 (10:15) A request to GitHub Docs succeeded with HTTP status metadata 200 and returned the page titled REST API endpoints for users - GitHub Docs, describing REST endpoints for public and private information about authenticated users, for API version 2022-11-28.

🔴 (10:15) The GitHub Docs HTML advertised an LLM-friendly Markdown endpoint at https://docs.github.com/api/article/body?pathname=/en/rest/users/users&apiVersion=2022-11-28, a metadata-plus-Markdown JSON endpoint at https://docs.github.com/api/article?pathname=/en/rest/users/users&apiVersion=2022-11-28, and the index https://docs.github.com/llms.txt.

🔴 (10:15) The GitHub Docs tool output was truncated after 399226 bytes; the complete response was saved to /home/byk/.local/share/opencode/tool-output/tool_085a97b3d001GHl08ZZNAUEovQ.