Distillation

Date: Aug 27, 2026

• 🔴 (20:52) User stated that jj never fails on conflict; conflicts are recorded in the resulting commit and must be checked with jj st after rebase, new, or squash.
• 🟡 (20:52) Jujutsu guidance: if .jj/ exists, use jj rather than git for mutations; never use interactive flags; pass -m "msg" for descriptions/commits; verify squash, abandon, rebase, restore, and commit with jj st and jj log; prefer stable letter-based change IDs over hexadecimal commit IDs; do not rebase or describe immutable commits; recover with jj undo, jj op log, or jj op restore <op-id>.
• 🟡 (20:53) Repository check reported no jj repo in the current directory; it is a Git repository, with optional initialization command jj git init.
• 🟡 (20:54) Uncommitted modified files in /home/byk/Code/getsentry/publish: .github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js.
• 🟡 (20:54) Untracked approval-authorization work in /home/byk/Code/getsentry/publish: .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/authorize-approval.js, src/publish/authorize-approval.js, and src/publish/validate-approval-attestation.js.
• 🔴 (20:54) User stated project history includes commit 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012).
• 🟡 (20:54) Recent visible commits include 83d210b build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174), 5268a23 feat: Add Vercel creds, 92eba3f feat: Add CLOUDFLARE_API_TOKEN (#9122), ada6147 build(deps): bump js-yaml from 4.1.1 to 4.3.0 (#8731), a4f961a fix: Add GITHUB_API_TOKEN for commit-on-git target (#9069), bf10f82 build(deps): bump postcss from 8.5.15 to 8.5.23 (#9017), 837edc0 docs: fix possessive apostrophe placement (#9015), 22fd64d docs: fix typo 'acces' -> 'access' (#9011), and 24b9ce3 docs: fix missing article in rfc.md (#9014).
• 🔴 (20:55) User stated .github/workflows/ci-poller.yml must always allow workflow_dispatch for manual recovery.
• 🔴 (20:55) User stated releases must never move to ci-ready after either approval-bound value changes.
• 🟡 (20:55) .github/workflows/ci-poller.yml logic examines issues, parses publish titles in the form "publish: owner/repo[/path]@version", extracts original issue commit SHA from issue-body /commit/<40 lowercase hex>/checks links, resolves release branches, paginates/aggregates check runs, and uses ci-pending, accepted, ci-ready, and ci-failed labels; failed CI removes accepted, swaps ci-pending to ci-failed, comments failed contexts plus a check-runs URL, and instructs users to re-add accepted after fixing CI.
• 🟡 (20:55) .github/workflows/ci-poller.yml uses actions/create-github-app-token@v3; uses a sentry-internal-app token for label changes; runs a cleanup/update step with if: always() && steps.poller-token.outcome == 'success'; and configures concurrency to prevent accumulation at one running plus one queued workflow.
• 🟡 (20:55) .github/workflows/publish.yml gates publication on label events where the issue title starts with publish: and github.event.label.name == 'ci-ready'; it obtains GitHub App tokens with actions/create-github-app-token@v3, runs authorization and invalid-approval rejection steps, removes ci-ready during approval-state changes, enables/triggers the CI poller, and executes failure reporting through node .__publish__/src/publish/post-result.js failure.
• 🔴 (20:55) User stated the CI poller always adds ci-ready; the publish workflow comments describe the poller as flipping ci-pending to ci-ready.
• 🟡 (20:55) src/modules/approval-authorizer.js defines ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]) and AUTO_APPROVER = "getsantry[bot]". authorizeApproval() validates issueTitle with PUBLISH_TITLE_REGEX, derives repository as getsentry/${title.groups.repo} and releasePath including optional path, authorizes getsantry[bot] only when autoApprovedRepositories contains releasePath, otherwise calls getPermission({ owner: "getsentry", repository: title.groups.repo, username: actor }) and authorizes only allowed role_name values.
• 🟡 (20:55) src/modules/approval-attestation.js creates hidden approval-comment attestations with prefix "<!-- publish-approval " and suffix " -->" containing base64url-encoded JSON { actor, eventId: String(eventId), title }. Parsing rejects missing/malformed attestations and requires string actor, eventId, and title.
• 🟡 (20:55) src/modules/approval-attestation.js compareEventIds() strips leading zeroes, requires decimal-only IDs, compares ID length before localeCompare, and throws Error("Invalid issue event ID") for invalid values. currentAcceptedEvent(events) considers only "labeled" events with label?.name === "accepted", string/number id, and actor?.login; it returns the greatest event ID as { actor, eventId: String(event.id) }, or null for no eligible/invalid events.
• 🟡 (20:55) hasApprovalAttestation({ comments, event, title, attestationAuthor }) in src/modules/approval-attestation.js requires a comment authored by attestationAuthor whose parsed attestation exactly binds actor, eventId, and title to the current event/title.