Dashboard › publish › Distillation
e8e41dee-ca08-4c80-ab53-30b2f1621f1f["lore_tm_v1_Fj4H8O4WDzaBzk7ewmmb9vhez7QZf4aZJm91OcBDtC0","lore_tm_v1_nmBIiWhpSQBoovWYPKmbGF8wDrYquBmcdVZquFhwIy0","lore_tm_v1_kDOcbJOhVFgdmO9bnWkZbql_xdf1QVHvdAe6DNLeyrs","lore_tm_v1_NXqKzeRsK9f_zvCIa4uCRiSMAfc7vuXrP53o3rXUUIA","lore_tm_v1_WvIcqDrJyJJnRHsOGKFQmaMOdvIh06EkHXpU5kUrym0","lore_tm_v1_njtyXoJwcpJ4qFRFxZN-F3kpHDQ3rIpnDOxpsDTor48","lore_tm_v1_pTLAkm8_9OizTK80eRWBL7XxO5aOTTrH7No0epNyoC4"]
Date: September 10, 2026
/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js is 263 lines and defines three Base64URL-encoded HTML-comment attestations: approval prefix <!-- publish-approval , auto-approval prefix <!-- publish-auto-approval , CI-ready prefix <!-- publish-ci-ready , all ending with -->.requestDigest({ body, labels, title }) in src/modules/approval-attestation.js rejects a non-string body, non-array labels, or non-string title with Invalid publish request; it computes a SHA-256 hex digest over JSON containing exact body, title, and dryRun: labels.some((label) => label.name === "dry-run").actor, stringified eventId, requestDigest, and title; auto-approval attestations contain autoApprover, requestDigest, and title; CI-ready attestations contain acceptedActor, stringified acceptedEventId, ciReadyActor, requestDigest, and title.parseAttestation(body, prefix) finds the first matching prefix and subsequent -->, decodes Base64URL JSON as UTF-8, and returns null for a missing prefix/suffix or decoding/parsing failure. parseApprovalAttestation(), parseAutoApprovalAttestation(), and parseCiReadyAttestation() additionally require every expected field to be a string.compareEventIds(left, right) strips leading zeroes, normalizes an empty result to "0", throws Invalid issue event ID unless both values are decimal digits, then compares by digit length and localeCompare, avoiding JavaScript numeric precision loss.currentLabeledEvent(events, labelName) filters for labeled events with the exact label, string/number id, and actor.login; it selects the greatest event ID via compareEventIds() and returns { actor, eventId }, or null for no valid events or any comparison error. currentAcceptedEvent() targets accepted; currentCiReadyEvent() targets ci-ready.hasApprovalAttestation(), hasAutoApprovalAttestation(), and hasCiReadyAttestation() only accept comments authored by the supplied attestationAuthor and require the attestation’s actors/event IDs, current request digest, and title to match live values; CI-ready validation binds both the accepted event and the actor who added the current ci-ready event./home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js is 57 lines. ALLOWED_ROLE_NAMES is write, maintain, and admin; AUTO_APPROVAL_LABELER is sentry-internal-app[bot]; AUTO_APPROVERS contains exactly getsantry[bot] and sentry-release-bot[bot].isAutoApprovedRepository({ actor, autoApprovedRepositories, issueTitle }) requires the actor to be in AUTO_APPROVERS, requires parsePublishTitle(issueTitle) to succeed, and checks the allowlisted key getsentry/${title.repo}${title.path || ""}.authorizeApproval({ actor, issueTitle, getPermission }) returns { authorized: false, repository: null } for an invalid publish title; rejects actors in AUTO_APPROVERS and the sentry-internal-app[bot] labeler; otherwise requests the actor’s permission on getsentry/${title.repo} and authorizes only role_name values write, maintain, or admin./home/byk/Code/getsentry/publish/src/publish/authorize-approval.js is 249 lines. getAutoApprovedRepositories() reads nonempty lines from auto-approve-repos.txt; GitHub API requests use APPROVAL_TOKEN, media type application/vnd.github+json, and API version 2026-03-10.authorize-approval.js retrieves collaborator permissions from repos/{owner}/{repository}/collaborators/{username}/permission; issue events and comments are independently paginated with per_page=100&page=${page} until a page contains fewer than 100 records.authorize-approval.js requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, and EXPECTED_REQUEST_DIGEST; it reads APPROVAL_ACTOR, APPROVAL_ISSUE_TITLE, and the auto-approved repository set for authorization.sentry-internal-app[bot], authorize-approval.js concurrently reloads the live issue, all events, and all comments, then authorizes only if: the issue is open; title and request digest match expected values; requester is a string and belongs to AUTO_APPROVERS; the parsed repository/path is allowlisted; the current accepted event actor is the labeler; and a matching auto-approval attestation authored by github-actions[bot] exists.authorize-approval.js first calls authorizeApproval(), then reloads the issue and events and requires: open issue; unchanged title and digest; string requester; requester is not the approving actor under case-insensitive comparison; a current accepted event exists; and that event’s actor exactly equals the approving actor.authorized=false\n to GITHUB_OUTPUT; successful paths append authorized=true\napproval_attestation=${attestation}\n, where the attestation binds the current accepted event’s actor and event ID to the live issue./home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js is 158 lines. Its GitHub requests also use APPROVAL_TOKEN and API version 2026-03-10; generic getAllPages() paginates issue events or comments in pages of 100.validateApprovalAttestation() concurrently loads the live issue, all events, and all comments, then requires: issue state open; exact title; matching requestDigest; a currently present accepted label; a current accepted event; an optional exact expectedAcceptedEvent actor/event-ID match; and a matching approval attestation from attestationAuthor.requireCiReadyAttestation is true, validateApprovalAttestation() additionally requires a current CI-ready labeled event, a currently present ci-ready label, and a matching CI-ready attestation binding that CI-ready actor to the validated accepted event and live issue.validate-approval-attestation.js requires environment variables APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, APPROVAL_ATTESTATION_AUTHOR, and EXPECTED_REQUEST_DIGEST; optional EXPECTED_ACCEPTED_ACTOR plus EXPECTED_ACCEPTED_EVENT_ID pin the accepted event, and REQUIRE_CI_READY_ATTESTATION === "true" enables CI-ready validation. Failure throws The current accepted label has no matching approval attestation./home/byk/Code/getsentry/publish/src/publish/current-accepted-event.js is 48 lines. getCurrentAcceptedEvent() obtains all issue events through injected getIssueEvents, selects currentAcceptedEvent(), and throws The issue has no current accepted label event when absent; its CLI requires APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, and APPROVAL_ISSUE_REPOSITORY, then writes the event as JSON to stdout./home/byk/Code/getsentry/publish/src/publish/record-auto-approval-attestation.js is 66 lines. recordAutoApprovalAttestation() reloads the issue and requires it to remain open, retain the expected title and digest, and have a requester login equal to autoApprover case-insensitively; otherwise it throws The automated approval request changed before approval.record-auto-approval-attestation.js requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, AUTO_APPROVER, and EXPECTED_REQUEST_DIGEST; success appends auto_approval_attestation=${attestation}\n to GITHUB_OUTPUT./home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js is 114 lines. getAuthenticatedLogin() calls the GitHub user endpoint, rejects non-OK responses, and throws GitHub returned no authenticated user login unless the response contains a string login.recordCiReadyAttestation() concurrently reloads the live issue, all issue events, and the authenticated token login; it requires an open issue, exact expected title and digest, a currently present accepted label, a current accepted event, and—when supplied—an exact expectedAcceptedEvent actor/event-ID match. Failure throws The approval changed before CI could be marked ready.recordCiReadyAttestation() creates a CI-ready attestation binding the current accepted event and live issue to ciReadyActor, the authenticated login associated with APPROVAL_TOKEN.record-ci-ready-attestation.js requires GITHUB_OUTPUT, APPROVAL_TOKEN, APPROVAL_ISSUE_NUMBER, APPROVAL_ISSUE_REPOSITORY, APPROVAL_ISSUE_TITLE, and EXPECTED_REQUEST_DIGEST; optional paired variables EXPECTED_ACCEPTED_ACTOR and EXPECTED_ACCEPTED_EVENT_ID pin the accepted event. Success appends ci_ready_attestation=${attestation}\n to GITHUB_OUTPUT.