Dashboard › publish › Distillation
e12429e7-ade7-4f80-97ef-9510ab0a9c14["lore_tm_v1_2qzE4-DLdH3IUV3L30-QVi2RVvkUbt5GmeKX1QHvic0","lore_tm_v1_Sa11IPGQAd3EZ58XYY8DWbxNQjFoG5rCx3unFMRxtzg","lore_tm_v1_tWa1juracBf-qjIhh3Cx_LYsE8EqKmfnTBkf3gX25EE","lore_tm_v1_Q7sifLFzBcBmd-h-LqhtyH5hmqWUxUL7fBEwamsBnFA","lore_tm_v1_l2TjLLISBOaMwfp_yelYk_NQJwuzsbb2hRfCj1DI1gE","lore_tm_v1_RuQycYQsZ2iEWw1c1W7iuWKAQbx0ey5INOjGpFLWwz0","lore_tm_v1_-3EwSKJaBMlMqe76A7I8cLYaMUxc25WgXZxxmYhsh04","lore_tm_v1_-N5tVG_3LW0IbKULsEFm_vKuBWvh1KNTPDoYHGSxQHU","lore_tm_v1_n-gwBQhx363LgXRTsAQcl9wPi1eO-cSd01prosY9zng"]
Date: Sep 9, 2026
/home/byk/Code/getsentry/publish; files must not be edited.github-actions[bot] proof created before the Internal App’s accepted event.ci-ready.ci-ready after CI passes.accepted, even when parsed inputs are unavailable.workflow_dispatch manual recovery to invoke only a successful main-branch relay before privileged poller work.repository_dispatch attempt and immutable action references and Craft image.SENTRY_INTERNAL_APP_PRIVATE_KEY and SENTRY_RELEASE_BOT_PRIVATE_KEY as a pre-existing organization Security issue; it is not a merge blocker unless the current change worsens it.yarn test --printConsoleTrace, yarn lint, and git diff --check as appropriate.MUST-FIX, CONCERN, or PASS, provide exact current file:line evidence, then give test evidence, and end with a line containing exactly MERGE or DO-NOT-MERGE.BLOCKED, name the exact tool/error, and end with DO-NOT-MERGE./home/byk/Code/getsentry/publish contains .eslintrc.js, .git/, .github/, .gitignore, .lore.md, AGENTS.md, auto-approve-repos.txt, docs/, LICENSE, node_modules/, package.json, README.md, src/, vitest.config.js, and yarn.lock.main...origin/main [behind 1]..github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js..github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.83d210b29553ea6f4d97508821724a834c43856e, 8ca4aa7afcb6a1c171f695d488a06b8cf4d08436a414a3223a18b33a08db4fc6 -, and e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 -.src/publish/__tests__/: authorize-approval.js, auto-approval-workflow.js, ci-poller-workflow.js, current-accepted-event.js, publish-workflow.js, record-auto-approval-attestation.js, record-ci-ready-attestation.js, validate-approval-attestation.js, and workflow-action-pinning.js..github/workflows/auto-approve.yml:14-16 gates auto-approval to issue-open events from sentry-release-bot[bot] or getsantry[bot] whose title starts with publish: ..github/workflows/auto-approve.yml:28-43 records an automated approval attestation using github.token and posts it with github-actions[bot] credentials before .github/workflows/auto-approve.yml:44-54 uses the Internal App token to add accepted when the repository exactly matches auto-approve-repos.txt..github/workflows/ci-poller.yml:48-53 checks out ${{ github.event.repository.default_branch }} with the comment: “workflow_dispatch can target any ref. Always run trusted code.”.github/workflows/ci-poller.yml:24-31 permits privileged poller work when CI_POLLER_HAS_PENDING == 'true', for any repository_dispatch, or after a successful workflow_run whose head_branch equals the repository default branch..github/workflows/ci-poller.yml:36-46 validates repository_dispatch attempt using regex ^(0|[1-5][0-9])$, accepting integer strings from 0 through 59, and writes the validated value to $GITHUB_OUTPUT..github/workflows/ci-poller.yml:99-106 polls only open issues carrying both ci-pending and accepted, with --limit 200.ci-ready after it changes; .github/workflows/ci-poller.yml:121-153 binds the poll cycle to the current accepted-label event and removes ci-pending plus accepted if current-event lookup or approval-attestation validation fails.ci-ready; .github/workflows/ci-poller.yml:272-289 revalidates approval after CI completes and before recording CI-ready proof..github/workflows/ci-poller.yml:291-335 records a CI-ready attestation, requires output prefixed ci_ready_attestation=, posts the proof using ${{ github.token }}, and removes ci-pending plus accepted if proof generation, output validation, or proof posting fails..github/workflows/ci-poller.yml:337-354 validates approval once more after posting CI-ready proof and immediately before moving forward; failure removes ci-pending and accepted.ci-ready after passing CI; .github/workflows/ci-poller.yml:356-364 removes ci-pending, adds ci-ready, and comments that publishing is starting..github/workflows/ci-poller.yml:249-270 requires at least one check run or commit status; CI passes only when commit status is success or there are zero statuses, all check runs are completed, and unsuccessful check count is zero. Conclusions success, neutral, and skipped are treated as passing..github/workflows/ci-poller.yml:395-436 runs pending-issue cleanup with if: always(), gets a dedicated poller-app token, and synchronizes CI_POLLER_HAS_PENDING to "false" or "true" according to whether an open issue still has both ci-pending and accepted..github/workflows/ci-poller.yml:438-463 self-dispatches while issues remain, increments with attempt=$((10#$ATTEMPT + 1)), caps at 60 attempts, and sends {event_type: "ci-poller", client_payload: {attempt: $attempt}}..github/workflows/ci-poller-dispatch.yml:6-16 declares permissions: {}, uses protected environment: production, and performs only run: ":"..github/workflows/ci-poller-dispatch.yml..github/workflows/ci-poller-dispatch.yml is named Run CI Status Poller, triggered by workflow_dispatch; .github/workflows/ci-poller.yml:8-10 listens for completion of that workflow via workflow_run..github/workflows/publish.yml:30-33 starts waiting-for-ci only when accepted is the triggering label, the issue is open, and its title begins with publish: ..github/workflows/publish.yml:47-110 obtains a release-bot token, runs src/publish/authorize-approval.js, posts the resulting approval attestation using github.token, validates it as authored by github-actions[bot], and removes accepted plus exits nonzero on authorization, attestation, or validation failure..github/workflows/publish.yml:113-129 resets retries by removing ci-failed and ci-ready, then adding ci-pending..github/workflows/publish.yml:161-168 immediately triggers the CI poller through repository_dispatch with event_type=ci-poller using the Internal App token.ci-ready; .github/workflows/publish.yml:174-179 explicitly relies on the poller adding ci-ready after CI, including after waiting-for-ci removes a stale ci-ready..github/workflows/publish.yml:180-187 gates publishing on an open issue whose triggering label is ci-ready, with both accepted and ci-ready present and neither ci-pending nor ci-failed; timeout is 90 minutes..github/workflows/publish.yml:197-220 validates approval and requires CI-ready attestation before setup/inputs; invalid approval removes accepted and exits nonzero..github/workflows/publish.yml:328-351 performs Revalidate approval attestation with REQUIRE_CI_READY_ATTESTATION: "true" and removes accepted on failure immediately before .github/workflows/publish.yml:353-408 invokes Craft..github/workflows/publish.yml:353 pins Craft to immutable image digest docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b.actions/checkout@11d5960a326750d5838078e36cf38b85af677262, actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, and actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38..github/workflows/publish.yml:409-414 runs src/publish/update-issue.js only on ${{ cancelled() || failure() }} and supplies PUBLISH_ARGS from steps.inputs.outputs.result; the user specifically requested verification that cleanup removes accepted even when parsed inputs are unavailable.