Distillation

Date: Sep 9, 2026

• 🟡 (23:33) .github/workflows/cocoapods-keepalive.yml defines a daily 0 0 * * * CocoaPods token keep-alive on macos-15 in the production environment, with contents: read and COCOAPODS_TRUNK_TOKEN; it installs CocoaPods using unversioned gem install cocoapods, prints pod --version, then runs pod trunk me > /dev/null 2>&1 (.github/workflows/cocoapods-keepalive.yml:1-27).
• 🟡 (23:34) src/modules/approval-attestation.js defines base64url HTML-comment attestations with prefixes <!-- publish-approval , <!-- publish-auto-approval , and <!-- publish-ci-ready ; requestDigest() hashes JSON containing exact issue body, whether labels include dry-run, and title using SHA-256 (src/modules/approval-attestation.js:1-55).
• 🟡 (23:34) src/modules/approval-attestation.js parses and validates approval, automated-approval, and CI-ready attestations; compareEventIds() compares arbitrarily large decimal event IDs after removing leading zeroes and rejects non-decimal IDs (src/modules/approval-attestation.js:58-142).
• 🟡 (23:34) currentLabeledEvent() selects the greatest-ID matching labeled event but does not process later unlabeled events; currentAcceptedEvent() and currentCiReadyEvent() use it for accepted and ci-ready respectively (src/modules/approval-attestation.js:144-174).
• 🟡 (23:34) Attestation checks require the comment author to equal attestationAuthor and bind approval proof to actor, event ID, request digest, and title; automated proof to auto-approver, request digest, and title; and CI-ready proof to accepted actor/event ID, CI-ready actor, request digest, and title (src/modules/approval-attestation.js:176-241).
• 🟡 (23:35) src/modules/approval-authorizer.js allows human approval only for exact GitHub role_name values write, maintain, or admin; rejects direct approval by getsantry[bot], sentry-release-bot[bot], and sentry-internal-app[bot]; parses publish titles and checks automated requests against exact getsentry/${title.repo}${title.path || ""} entries in auto-approve-repos.txt (src/modules/approval-authorizer.js:1-57).
• 🟡 (23:35) src/publish/authorize-approval.js reads auto-approve-repos.txt, retrieves repository collaborator permission plus paginated issue events/comments at 100 records per page, and uses APPROVAL_TOKEN with GitHub API version 2026-03-10 (src/publish/authorize-approval.js:14-107).
• 🟡 (23:35) For an accepted label added by sentry-internal-app[bot], src/publish/authorize-approval.js requires the live issue to remain open with the expected title, the requester to be getsantry[bot] or sentry-release-bot[bot], the parsed target to be allowlisted, the latest selected accepted event actor to be the Internal App, and a matching request-bound automated-approval attestation authored by github-actions[bot] (src/publish/authorize-approval.js:128-171).
• 🟡 (23:35) For human approval, src/publish/authorize-approval.js calls authorizeApproval(), then re-fetches the live issue and events and rejects unless the issue is open, its title is unchanged, its requester differs case-insensitively from the approver, an accepted event exists, and that event actor equals the approver; success emits authorized=true plus approval_attestation, while rejection emits authorized=false (src/publish/authorize-approval.js:172-223).
• 🟡 (23:36) src/publish/validate-approval-attestation.js retrieves the live issue plus all event/comment pages and validates that the issue remains open, the title matches, the live labels contain accepted, a selected accepted event exists and optionally matches EXPECTED_ACCEPTED_ACTOR/EXPECTED_ACCEPTED_EVENT_ID, and a matching approval attestation exists (src/publish/validate-approval-attestation.js:18-87).
• 🟡 (23:36) When REQUIRE_CI_READY_ATTESTATION === "true", src/publish/validate-approval-attestation.js additionally requires a selected CI-ready event, a live ci-ready label, and a matching CI-ready attestation bound to the current accepted event and CI-ready label actor (src/publish/validate-approval-attestation.js:90-136).
• 🟡 (23:36) src/publish/record-auto-approval-attestation.js re-fetches the issue and refuses proof creation unless it remains open, has the expected title, and its requester case-insensitively equals AUTO_APPROVER; it emits auto_approval_attestation through GITHUB_OUTPUT (src/publish/record-auto-approval-attestation.js:7-51).
• 🟡 (23:37) src/publish/record-ci-ready-attestation.js obtains the authenticated token login through GET /user, then refuses CI-ready proof creation unless the issue remains open with the expected title and live accepted label, an accepted event exists, and that event optionally matches the expected accepted actor/event ID; its attestation binds the accepted event, authenticated CI-ready actor, and request digest (src/publish/record-ci-ready-attestation.js:12-95).
• 🟡 (23:37) src/publish/current-accepted-event.js retrieves all issue events, derives currentAcceptedEvent(), errors with The issue has no current accepted label event if absent, and otherwise writes the event JSON to stdout (src/publish/current-accepted-event.js:1-48).
• 🟡 (23:38) Test inventory showed explicit coverage for: request-bound automated proof before adding accepted; proof posted by github-actions[bot] before Internal App labeling; trusted-code checkout before app-token requests; canonical repository-dispatch attempt validation before app-token requests; approval revalidation immediately before Craft; rejection of automated approval without proof; rejection of direct approval by an automated opener; rejection after title/body/dry-run/closure changes; rejection after accepted is re-added; CI-ready proof binding to current approval and label actor; and rejection when approval changes or is reapproved before CI-ready recording.
• 🔴 (23:39) User stated: “Replace {/privacy} with /public to retrieve only public events.”
• 🟡 (23:39) GitHub REST documentation supplied by the user states that omitting {/privacy} from a user’s events_url retrieves public events and, when authenticated as that user, private events; replacing it with /public limits retrieval to public events.