Distillation

Date: Sep 8, 2026

• 🔴 (03:56) User directed a final strict, read-only, evidence-based audit of current uncommitted changes in /home/byk/Code/getsentry/publish-workspace-acceptance against baseline a81ab03; instructed not to modify files and to inspect the complete diff, source, workflows, docs, and tests.
• 🔴 [requested-review] (03:56) User required verification that earlier blockers are fixed: canonical header parsing/revision security/merge target; poller skipping every malformed resolver result including empty body; cleanup; exact-byte-preserving issue-body update; malformed/duplicate generated-doc markers rejection; output JSON serialization and fallback parsing; both scoped Publish checkout actions at actions/checkout@v7 and ci-poller checkout at v7 while unrelated workflows remain intentionally untouched; title docs/parser parity; exact-SHA checkout; fail-closed workspace discovery; craft:latest; fresh CI gating and workflow_dispatch; and no unrelated CocoaPods churn.
• 🔴 [requested-review] (03:56) User instructed that only non-mutating checks may be run if useful; requested precise severity-ordered file:line findings, explicit PASS/FAIL status for requested constraints, and test gaps. User required the audit response to end exactly MERGE or DO-NOT-MERGE, and to state why if blocked before DO-NOT-MERGE.
• 🔴 (03:56) User's repository guidance states this is the Sentry Publish Repository, a GitHub Actions-based multi-project release approval system using Craft; it is a pure JavaScript CommonJS project on Node.js 24.0.0.
• 🔴 (03:56) User's repository convention: use Yarn classic 1.22.22 via Volta; do not use npm.
• 🔴 (03:56) User's repository test/lint commands are yarn test, yarn test:watch, yarn test src/modules/__tests__/update-issue.js, yarn test -t "pattern", and yarn lint; formatting command is yarn prettier.
• 🔴 (03:56) User's repository conventions: kebab-case files; tests in __tests__/ matching source filename; camelCase variables/functions; UPPER_SNAKE_CASE constants/regex; CommonJS source and ES Modules test files; import order is Node built-ins, external packages, then local modules; Prettier defaults, double quotes, and required semicolons.
• 🔴 (03:56) User preference/directive: Always throw for unexpected values.
• 🔴 (03:56) User's repository error-handling conventions: throw descriptive errors with context/potential fixes; validate early using guard clauses; check file existence before reading.
• 🔴 (03:56) User's repository testing convention: Vitest v4.0.0 with globals enabled and mocks auto-cleared between tests; mock external dependencies before importing the module under test.
• 🟡 (03:57) Audit target working tree had modified files: .github/workflows/ci-poller.yml, .github/workflows/publish.yml, docs/publish-issue-format.md, scripts/generate-publish-issue-title-parser.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/details-from-context.js, src/modules/publish-issue-title.js, src/modules/publish-issue-title.peggy, src/modules/release-revision.js, src/publish/inputs.js, src/publish/resolve-ci-poller-input.js, src/publish/resolve-location.js, and src/publish/resolve-release-revision.js; untracked paths were src/modules/__tests__/ci-poller-workflow.js, src/modules/__tests__/generate-publish-issue-title-parser.js, src/publish/__tests__/, and src/publish/discover-location.js.
• 🟡 (03:57) Baseline is full SHA a81ab033098f151fbc291b7b0c934901405bb162 (a81ab03, subject feat: resolve workspace publish paths). Diffstat reported 15 tracked files changed, 1097 insertions(+), and 96 deletions(-); repository history shown also included 52ef600 feat: resolve compact workspace publish requests, b658ffa fix: validate publish workspace JSON, 33de3f1 feat: accept workspace publish requests, and 83d210b build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174).
• 🟡 (03:57) src/publish/__tests__/ contains discover-location.js, resolve-location.js, and resolve-release-revision.js.
• 🔴 (03:57) User preference/directive: Always allow workflow_dispatch for manual recovery.
• 🟡 (03:57) .github/workflows/ci-poller.yml defines scheduled execution every 5 minutes (cron: "*/5 * * * *") plus workflow_dispatch with optional attempt input defaulting to "0". Job check-ci runs only when vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch', uses concurrency group ci-status-poller with cancel-in-progress: false, and checks out the publish controller with actions/checkout@v7 to .__publish__.
• 🟡 (03:57) ci-poller.yml retrieves sentry-internal-app and sentry-release-bot tokens using actions/create-github-app-token@v3; it uses the internal-app token for label changes and RELEASE_TOKEN through gh_api_release() for cross-repository API calls, preserving API failure status and warning on failure.
• 🟡 (03:57) ci-poller.yml polls open issues with both ci-pending and accepted labels (limit 200), writes each issue body exactly using printf '%s' "$issue" | jq -jr '.body' > "$body_file", and invokes node .__publish__/src/publish/resolve-ci-poller-input.js with PUBLISH_ISSUE_BODY_FILE, PUBLISH_TITLE, and optionally PUBLISH_REVISION.
• 🟡 (03:57) ci-poller.yml skips an issue when canonical input parsing fails, when canonical issue-body update resolution fails, or when resolved .issueBody is not a nonempty string; temporary files body_file, resolver_output_file, and updated_body_file are removed by an EXIT trap.
• 🟡 (03:57) ci-poller.yml resolves a release branch from repos/${repo}/commits/${issue_sha}/check-suites and then resolves its head through repos/${repo}/git/ref/heads/${branch}; API failures or empty results fall back to issue_sha. If the branch SHA differs, it regenerates the canonical body and updates via gh issue edit --body-file.
• 🟡 (03:57) ci-poller.yml retrieves combined commit status and paginated check runs for ${sha}; it skips the issue on API failures and waits if both total_checks and total_statuses are 0. It treats commit status success, or zero statuses when check runs exist, as status-OK; check-run conclusions success, neutral, and skipped as passing; and other completed conclusions as unsuccessful.
• 🔴 (03:57) User stated the poller always adds ci-ready when CI passes.
• 🟡 (03:57) In ci-poller.yml, CI pass requires status_ok == "true", pending_checks == "0", and unsuccessful_checks == "0"; it removes ci-pending, adds ci-ready, and comments that publishing is starting. Check-run failures or commit-status failures remove ci-pending and accepted, add ci-failed, and comment failed checks/status contexts plus a commit checks link.
• 🟡 (03:57) ci-poller.yml cleanup runs with if: always(), counts remaining open issues with both ci-pending and accepted, then—if app token creation succeeds—sets CI_POLLER_HAS_PENDING to "false" when count is 0, otherwise "true". It self-dispatches ci-poller.yml while items remain pending using attempt + 1, capped at 60; after cap it relies on cron fallback.
• 🟡 (03:57) Partial publish.yml evidence indicates two scoped checkout actions use actions/checkout@v7; it checks out a target repository, uses fetch-depth: 0, runs node .__publish__/src/publish/discover-location.js, invokes Craft through craft:latest, and configures XDG_STATE_HOME: /github/workspace/.craft-state. Comments state the poller adds ci-ready and the happy path is guaranteed to trigger.
• 🟡 (03:57) src/modules/publish-issue-title.peggy defines canonical issue-title grammar: publish: followed by optional getsentry/, Repository, optional slash-delimited Path, @, and Version, followed by end-of-input. RepositoryCharacter and PathSegment permit [A-Za-z0-9_.-]; versions permit [A-Za-z0-9_.+-]; parsed output is { repo, path: path || "", version }.
• 🟡 (03:57) src/modules/publish-issue-title.peggy defines ReleaseRevision from a request header requiring Requested by: @…, Merge target: with (default) or [A-Za-z0-9_./-]+, Quick links:, a View changes link, and a https://github.com/getsentry/${repo}/commit/${revision}/checks View check runs link. CheckRunsRevision accepts lowercase hexadecimal only and requires exactly 40 characters, returning { value, start, end }; newlines accept \r\n or \n.