Distillation

Current State

• Current task (Sep 10, 2026, 06:52): Finish regression-proof validation of the integrated approval/publishing security hardening in /home/byk/Code/getsentry/publish.
  • The repository was fast-forwarded from 83d210b29553ea6f4d97508821724a834c43856e to origin/main commit 7c60ddb7f43040fe8fbfea70efc833f689c04e75 (feat: accept workspace publish requests) and the security changes were reapplied/integrated.
  • All six merge conflicts have been resolved; the tree was conflict-free as of 06:47.
  • Current validation is deliberately mutating one guard at a time, proving its regression test fails, and restoring it immediately.
  • At 06:52, the final approval-rejection branch’s exit 0 was being restored after a successful mutation proof of the old invalid continue behavior. A clean post-restoration run has not yet been recorded.
• Latest completed local gates before the current mutation cycle:
  • Sep 10, 04:11: yarn check:generated && vitest run --printConsoleTrace passed 27 files, 184 tests under Vitest v4.1.0.
  • Sep 10, 03:02: ESLint passed and git diff --check produced no output.
  • Sep 10, 02:28: generated parser byte-for-byte verification passed after formatting.
  • Sep 10, 04:09: focused publication-lifecycle suite passed 5 files, 24 tests.
  • Sep 10, 03:51: focused poller suites passed 2 files, 18 tests.
  • These gates predate the temporary mutation at 06:51–06:52, so they must be rerun after restoration.
• Current validation plan:
  1. Bind every event-triggered approval and publish path to its exact request snapshot digest — completed.
  2. Reproduce/fix CI-poller rejection, malformed-input, activation, and ci-ready transition failures — completed.
  3. Reproduce/fix publish success/failure reconciliation and dependency-independent approval cleanup — completed.
  4. Make terminal reporting tolerate missing/malformed publish inputs — completed.
  5. Run mutation regressions, 10-run focused stability checks, generated checks, full tests, lint, formatting, and whitespace checks — in progress.
  6. Obtain a substantive independent correctness/security review against the exact final tree — pending.
• Remaining mutation proofs after the two completed poller mutations: success-close ordering, activation fallback, and dependency-free pre/post terminal reconciliation. Also verify exactly one terminal status is emitted.
• Independent review state:
  • The most recent substantive review at Sep 10, 01:49 correctly returned DO-NOT-MERGE because the worktree was one commit behind origin/main; that blocker was accepted and the upstream workspace feature has since been integrated.
  • Later release-path reviewers repeatedly returned empty results and were rejected as unusable.
  • The cleanup lifecycle auditor returned substantive blockers at 03:24; those drove the current fixes.
  • A new exact-final-tree independent review is still required after all mutation and local validation work completes.
• Organization-secret scope is no longer a merge blocker for this repository change:
  • User stated Sep 9, 09:07–09:25 that SENTRY_INTERNAL_APP_PRIVATE_KEY is an organization-level secret exposed to all repositories, cannot be moved by this change, and its overly broad scope is a separate Security workstream.
  • README.md was corrected so it no longer claims this repository can migrate/isolate that key.
  • The existing organization-wide exposure remains a documented security risk but is an accepted out-of-scope boundary for this change.
• Protected environment remains:
  • GitHub environment production, ID 9871907870.
  • Sole custom branch policy: main, ID 38207111.
  • protected_branches: false, custom_branch_policies: true.
  • can_admins_bypass: false, set at 2026-09-08T20:55:15Z.
• Key user invariants that must not regress:
  • 🔴 Manual CI-poller recovery must remain available through workflow_dispatch.
    • One Sep 10, 02:10 statement specifically named .github/workflows/ci-poller.yml, but the currently hardened design and tests expose workflow_dispatch only through secret-free .github/workflows/ci-poller-dispatch.yml; the privileged poller wakes via trusted default-branch workflow_run.
  • 🔴 “Always run trusted code”: arbitrary-ref dispatch must not execute controller code before privileged credentials. The poller controller checkout must use ${{ github.event.repository.default_branch }} and persist-credentials: false.
  • 🔴 The poller always performs the final ci-ready add after passing CI. It must first remove stale ci-ready, revalidate, then re-add it so a fresh issues:labeled event fires.
  • 🔴 “Never move a release to ci-ready after it changes.” A renamed, body-mutated, dry-run-mutated, revision-changed, or re-approved issue must terminate the stale processing cycle.
  • 🔴 Direct labels from getsantry[bot], sentry-release-bot[bot], or the Internal App generic path must not fall through to collaborator permissions.
  • 🔴 Automated approval is valid only when a trusted github-actions[bot] request-bound pre-label proof precedes sentry-internal-app[bot] adding accepted.
  • 🔴 Approval must never be regenerated automatically after a canonical revision change. Either publish the already approved SHA, or rewrite only the canonical SHA, remove accepted and ci-pending, and require fresh approval.
  • 🔴 Approval, CI, and publication must share one non-throwing validated title parser backed by the generated Peggy grammar; the old regex must not remain as a second parser.
  • 🔴 src/modules/publish-issue-title.js is generated and must never be hand-merged.
  • 🔴 Malformed/missing PUBLISH_ARGS must never prevent removal of authorization labels or terminal reporting.
  • 🔴 Successful publication must close and deauthorize the issue independently of comments, dependency installation, workflow lookup, or telemetry.
• Current working tree remains heavily modified; preserve unrelated/in-progress work.
  • Modified paths shown at Sep 10, 06:47: .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, docs/key_rotation_vault_changes.md, docs/rfc.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/ci-poller-input.js, src/modules/__tests__/ci-poller-workflow.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/process-end-state.js, src/modules/__tests__/publish-location.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/release-revision.js, src/modules/__tests__/update-issue.js, src/modules/ci-poller-input.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/publish-location.js, src/modules/release-revision.js, src/publish/__tests__/discover-location.js, src/publish/__tests__/resolve-release-revision.js, src/publish/discover-location.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, src/publish/resolve-ci-poller-input.js, and src/publish/update-issue.js.
  • Untracked paths shown at Sep 10, 06:47: .github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/authorize-approval.js, src/publish/__tests__/auto-approval-workflow.js, src/publish/__tests__/ci-poller-workflow.js, src/publish/__tests__/current-accepted-event.js, src/publish/__tests__/post-result.js, src/publish/__tests__/publish-workflow.js, src/publish/__tests__/record-auto-approval-attestation.js, src/publish/__tests__/record-ci-ready-attestation.js, src/publish/__tests__/request-digest-from-event.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/workflow-action-pinning.js, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, src/publish/request-digest-from-event.js, and src/publish/validate-approval-attestation.js.
  • At 06:47, the unstaged diff summary covered 19 files, 503 insertions, 146 deletions.
  • Git autostash aa5efe2 was created during the fast-forward; the reapplication conflicted, and the original changes remained safely in the stash. Do not drop it without verifying it is no longer needed.

Key Decisions

• Canonical request identity is a SHA-256 digest of exact request state.
  • requestDigest({ body, labels, title }) hashes:

    JSON.stringify({  body,  dryRun: labels.some((label) => label.name === "dry-run"),  title,})
    

  • body and title must be strings; labels must be an array. Invalid snapshots throw Error("Invalid publish request").
  • Raw title/body and dry-run state are bound; transient workflow labels are excluded.
• Every event-triggered proof operation must bind immutable event state to live state.
  • Added src/publish/request-digest-from-event.js, implemented with Node built-ins because issue-triggered workflows run it before dependency installation.
  • EXPECTED_REQUEST_DIGEST is mandatory at executable and exported validation boundaries; optional live-only fallback behavior was rejected.
  • Human authorization, automated proof creation, poller validation, CI-ready proof generation, and both publication validation fences require the exact triggering/listed snapshot digest.
  • .github/workflows/publish.yml carries the event digest through exactly four relevant validation/proof points.
  • The CI poller resolver computes the digest from its exact listed title, body, and labels; labels are mandatory so a dry-run mutation fails closed.
• One canonical title parser is shared by approval, CI, and publication.
  • parsePublishTitle() remains a non-throwing compatibility API for authorization but delegates to generated parsePublishIssueTitle() and shared validators.
  • PUBLISH_TITLE_REGEX was removed entirely.
  • Publication may retain precise validation errors, while authorization returns null/unauthorized on parse or validation failure before collaborator lookup.
  • Generated parser source is src/modules/publish-issue-title.peggy; generated output is src/modules/publish-issue-title.js.
• Workspace publish behavior from upstream is integrated rather than overwritten.
  • Baseline commit: 7c60ddb7f43040fe8fbfea70efc833f689c04e75, feat: accept workspace publish requests.
  • The integration preserves:
    1. workspace-qualified title parsing;
    2. canonical release-revision extraction;
    3. exact CI-approved revision checkout;
    4. path containment;
    5. workspace-aware Craft state naming;
    6. explicit workflow-provided state-file restoration.
  • Symbol-level conflict resolution was chosen over blindly replacing hardened files.
• Revision movement requires reapproval.
  • Upstream’s behavior of rewriting a moved check-runs SHA and continuing was incompatible with request-digest approval.
  • The poller now rewrites only the canonical SHA, removes accepted and ci-pending, posts a diagnostic, and terminates that issue’s current cycle before CI inspection or ci-ready.
• Trusted controller checkout remains before credentials.
  • A single default-branch controller checkout at .__publish__ is used for canonical resolver and attestation scripts.
  • Duplicate/mutable controller checkout was rejected.
  • Checkout v7 is pinned to: 3d3c42e5aac5ba805825da76410c181273ba90b1.
• Craft is pinned consistently in publication and workspace discovery.
  • Manifest-list digest: docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b.
  • Mutable getsentry/craft:latest in src/publish/discover-location.js was rejected.
• CI-ready transition is intentionally non-idempotent and now race-safe.
  • Waiting-for-CI removes stale ci-ready.
  • After successful CI, the poller explicitly removes ci-ready again, revalidates the exact approval snapshot, then unconditionally adds ci-ready.
  • This guarantees a fresh event even if another actor/race re-added the label while ci-pending remained.
• Per-issue poller rejection must terminate the subshell.
  • continue inside the piped-loop per-issue subshell is invalid Bash and does not terminate processing.
  • Chosen fix: replace rejection-path continue statements with exit 0.
  • Alternative considered: remove the subshell and use a real loop-level continue; not selected.
• Deterministically malformed poller requests fail closed.
  • Resolver or rewrite-output failures remove accepted and ci-pending and post a diagnostic.
  • Indefinite retry is reserved for genuinely transient failures; deterministic invalid input must not remain pending forever.
• Publication authorization is reconciled independently of Node/dependencies/reporting.
  • After Craft, shell-only gh reconciliation removes accepted, ci-pending, and ci-ready.
  • On Craft success it also closes the issue.
  • Reconciliation runs immediately after publication and again after terminal reporting, using if: always() and continue-on-error: true.
  • Successful issue closure in processEndState() occurs before workflow-run lookup, comments, or Sentry telemetry.
• Poller activation is independent of non-critical comments.
  • Required ordering is Mark ci-pending → Trigger CI poller → comment and variable synchronization.
  • Trigger, comment, and cron-enablement paths are best-effort.
  • If both immediate dispatch and cron activation fail, the workflow revokes ci-pending and accepted.
• Terminal reporting is fail-safe.
  • src/publish/post-result.js now exports async main(), moves GitHub setup and input parsing inside it, defaults missing/malformed PUBLISH_ARGS to {}, and supports explicit injected dependencies for direct testing.
  • Malformed input logs: Could not parse publish inputs; reporting without them.
  • Module-load side effects were rejected.
• Organization secret handling was re-scoped.
  • A protected environment cannot technically constrain an organization secret exposed to every workflow.
  • User classified SENTRY_INTERNAL_APP_PRIVATE_KEY scope as a pre-existing organization Security issue outside this repository change.
  • The previous operational migration blocker was reversed; documentation now distinguishes accepted organization-wide exposure from environment-scoped publishing secrets.
• Manual recovery design remains a protected relay.
  • .github/workflows/ci-poller-dispatch.yml provides unconditional workflow_dispatch, permissions: {}, no secret references, and environment: production.
  • The privileged poller wakes only from a successful default-branch workflow_run; self-retries use repository_dispatch type ci-poller.
  • Direct privileged arbitrary-ref workflow_dispatch remains rejected as incompatible with “always run trusted code.”
• Action and retry-input pinning remains mandatory.
  • Every actions/... reference must be a lowercase full 40-character SHA.
  • Repository-dispatch attempts accept canonical decimal strings 0–59, including 1–9; reject "", 00, 01, 60, -1, 1x, and $(id).
  • Arithmetic uses attempt=$((10#$ATTEMPT + 1)).
• Alternatives rejected:
  • Retaining the old title regex beside the generated parser.
  • Hand-merging the 1,473-line generated Peggy artifact.
  • Allowing missing snapshot digests to fall back to live-only validation.
  • Continuing after automatic revision rewrite.
  • Using stale gh issue list body while validating a newer live request.
  • Weakening approval checks to satisfy an incomplete workflow test harness.
  • Treating comments/telemetry as prerequisites for cleanup.
  • Depending on @actions/github or installed dependencies for final authorization revocation.
  • Omitting the final ci-ready re-add.
  • Accepting empty independent-review task output as satisfying the merge gate.

Technical Changes

• Upstream workspace feature integrated:
  • Fast-forwarded 83d210b..7c60ddb; upstream diff had 32 files, 3,257 insertions, 115 deletions.
  • Commit metadata:
    • SHA: 7c60ddb7f43040fe8fbfea70efc833f689c04e75
    • Title: feat: accept workspace publish requests
    • Author: Burak Yigit Kaya <byk@sentry.io>
    • Committer: GitHub <noreply@github.com>
  • Six conflicts resolved:
    1. .github/workflows/ci-poller.yml
    2. .github/workflows/publish.yml
    3. src/modules/__tests__/update-issue.js
    4. src/modules/details-from-context.js
    5. src/modules/update-issue.js
    6. src/publish/inputs.js
• Canonical parser and validation:
  • src/modules/details-from-context.js
    • Uses generated parsePublishIssueTitle.
    • Validates repository with isPublishRepository(), version with isReleaseVersion(), and path with isPublishPath().
    • parsePublishTitle() returns null on parse/validation failure.
    • detailsFromContext() retains specific invalid-title/repository/version/path errors.
  • src/modules/publish-issue-validation.js
    • Rejects repository ".", "..", "__proto__", leading -, and values outside /^[A-Za-z0-9_.-]+$/.
    • Requires a three-component semantic release version with optional prerelease/build metadata.
  • src/modules/publish-location.js
    • Root remains { path: "." }.
    • Exact case-sensitive workspace match becomes { path: ".", workspace }.
    • Other safe suffixes remain checkout paths.
    • Workspace names are never normalized.
  • src/modules/release-revision.js
    • Requires exactly one canonical View check runs link.
    • Requires canonical-link repository to match parsed title repository.
    • Lowercase 40-character SHA only.
    • Invalid replacement throws: Release revision must be a lowercase 40-character SHA.
• Generated parser tooling:
  • package.json/yarn.lock add peggy 5.1.0.
  • scripts/generate-publish-issue-title-parser.js generates:
    • src/modules/publish-issue-title.js
    • title documentation in docs/publish-issue-format.md
  • Scripts:
    • generate
    • check:generated
    • test now runs generated verification before Vitest.
  • Node/Yarn remain 24.0.0 / 1.22.22; Vitest upgraded through merged lockfile to v4.1.0.
• Auto-approval checkout and retry parsing review fixes:
  • .github/workflows/auto-approve.yml changed from sparse-checking out only auto-approve-repos.txt to a full trusted checkout because record-auto-approval-attestation.js and dependencies were otherwise absent (MODULE_NOT_FOUND risk).
  • .github/workflows/ci-poller.yml retry regex fixed to accept single-digit attempts 1–9, not only 0 and 10–59.
  • Mutation-verified self-approval, title mutation, and accepted-event replacement fixtures were repaired to include state: "open" so they exercise intended guards.
• Approval/event snapshot binding:
  • Added src/publish/request-digest-from-event.js.
  • Modified:
    • src/modules/approval-attestation.js
    • src/modules/ci-poller-input.js
    • src/publish/resolve-ci-poller-input.js
    • src/publish/authorize-approval.js
    • src/publish/record-auto-approval-attestation.js
    • src/publish/validate-approval-attestation.js
    • src/publish/record-ci-ready-attestation.js
    • .github/workflows/auto-approve.yml
    • .github/workflows/ci-poller.yml
    • .github/workflows/publish.yml
  • validateApprovalAttestation() and recordCiReadyAttestation() no longer permit omitted expectedRequestDigest.
  • Poller carries one canonical snapshot digest through all four approval fences.
  • Publication carries the triggering event digest through four proof/validation points.
  • Added/updated tests:
    • src/publish/__tests__/request-digest-from-event.js
    • src/publish/__tests__/authorize-approval.js
    • src/publish/__tests__/record-auto-approval-attestation.js
    • src/publish/__tests__/record-ci-ready-attestation.js
    • src/publish/__tests__/validate-approval-attestation.js
    • src/publish/__tests__/auto-approval-workflow.js
    • src/publish/__tests__/ci-poller-workflow.js
    • src/publish/__tests__/publish-workflow.js
    • src/modules/__tests__/ci-poller-input.js
• TOCTOU flaws found and fixed:
  1. Poller validated live issue state but parsed an older gh issue list body.
  2. Publish validation could accept newer live state while Craft consumed older triggering-event PUBLISH_ARGS.
  3. Human approval could mint proof for changed live state under an older label event.
  4. Auto-approval could mint proof for changed live state under an older opened event.
  • All now require exact snapshot digest equality before minting or consuming proofs.
• CI-poller lifecycle fixes:
  • Replaced invalid rejection-path continue calls in the per-issue subshell with exit 0.
  • Resolver and malformed rewrite results revoke accepted and ci-pending.
  • Canonical revision movement rewrites only the canonical revision, revokes approval/pending state, performs no CI API request, and does not add ci-ready.
  • Successful CI transition:
    1. remove stale ci-ready;
    2. run final live approval validation;
    3. add fresh ci-ready;
    4. post publishing-start comment.
  • Strengthened src/modules/__tests__/ci-poller-workflow.js harness:
    • dispatches mocked Node responses by script name;
    • supports independent control of all approval fences and branch head;
    • normalizes ${{ github.token }} before Bash execution;
    • writes Node and gh calls into one shared event log for cross-command ordering.
  • The suite now exercises full success, all approval rejection branches, malformed resolver/rewrite behavior, moved revision, and stale-label removal/revalidation/re-add.
• Publication lifecycle fixes:
  • .github/workflows/publish.yml
    • Poller activation no longer depends on comments.
    • If both immediate trigger and cron activation fail, removes ci-pending and accepted.
    • Adds shell-only Reconcile publish issue after Craft and Verify publish issue reconciliation after terminal reporting.
    • Both run under if: always(), tolerate errors for retry/final reconciliation, remove accepted, ci-pending, and ci-ready, and close the issue on Craft success.
    • Reconciliation uses built-in gh, not Node or installed project dependencies.
  • src/modules/process-end-state.js
    • Defaults inputs = {}.
    • Validates terminal status first.
    • On success, closes the issue before workflow-run lookup, comments, or Sentry reporting.
  • src/publish/post-result.js
    • Refactored to exported async main().
    • GitHub client creation and PUBLISH_ARGS parsing occur inside main().
    • Missing/malformed inputs become {}.
    • Supports dependency injection for direct tests.
  • Added src/publish/__tests__/post-result.js.
• Cleanup state-file contract:
  • src/modules/update-issue.js uses explicit process.env.CRAFT_STATE_FILE_PATH.
  • updateTargets() returns before fs.existsSync() when the path is absent.
  • Label revocation remains possible with missing/malformed PUBLISH_ARGS.
  • Target restoration uses the workflow-created Craft state file rather than deriving .craft-publish-${version}.json from parsed inputs.
• Workspace checkout/publication wiring:
  • .github/workflows/publish.yml checks out the exact CI-approved revision.
  • Location discovery is repository-contained and supplies:
    • CRAFT_PUBLISH_PATH
    • CRAFT_PUBLISH_WORKSPACE
    • CRAFT_PUBLISH_STATE_GITHUB_REPO
  • Workspace-aware state filenames preserve case-sensitive version/workspace identity.
  • Checkout v7 pin: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1.
• Fail-first and mutation evidence:
  • Sep 10, 02:37: three snapshot-race suites each failed exactly one new regression before fixes.
  • Sep 10, 03:46/03:49: poller lifecycle suite had 13 failures/14 tests, demonstrating resolver cleanup, invalid continue, and stale-ci-ready gaps.
  • Sep 10, 03:59: success-close-order test proved issues.update had 0 calls when workflow lookup failed.
  • Sep 10, 06:49: removing stale-ci-ready fence caused: expect(removeReady).toBeGreaterThanOrEqual(0) to receive -1 at src/modules/__tests__/ci-poller-workflow.js:328.
  • Sep 10, 06:52: restoring old continue caused: expect(poller.log).not.toContain("--add-label ci-ready") to fail at src/modules/__tests__/ci-poller-workflow.js:310. The mutated poller revoked approval, then still added ci-ready and announced publication.
• Approval provenance and authorization remain intact:
  • Allowed human roles: write, maintain, admin.
  • Automated requesters: getsantry[bot], sentry-release-bot[bot].
  • Automated labeler: sentry-internal-app[bot].
  • Direct special-bot labels fail closed before collaborator lookup.
  • Automated path requires current Internal App accepted event plus matching github-actions[bot] auto-approval proof and exact allowlisted path.
• Attestation formats remain:
  • <!-- publish-approval ... -->
  • <!-- publish-auto-approval ... -->
  • <!-- publish-ci-ready ... -->
  • Base64url JSON parsers fail closed on malformed content or incorrect field types.
  • compareEventIds() handles decimal strings without precision loss and throws Invalid issue event ID for invalid IDs.
• Auto-approval allowlist remains 46 exact paths:
  1. getsentry/arroyo
  2. getsentry/auto-type-annotate
  3. getsentry/devenv
  4. getsentry/infra-event-notifier
  5. getsentry/jest-sentry-environment
  6. getsentry/json-schema-diff
  7. getsentry/js-source-scopes
  8. getsentry/objectstore/clients
  9. getsentry/ophio
  10. getsentry/pdb
  11. getsentry/pyo3-python-tracing-subscriber
  12. getsentry/pytest-sentry
  13. getsentry/relay/py
  14. getsentry/responses
  15. getsentry/rust-proguard
  16. getsentry/rust-sourcemap
  17. getsentry/rust-usage-accountant
  18. getsentry/script-runner
  19. getsentry/sentry-api-schema
  20. getsentry/sentry-forked-djangorestframework-stubs
  21. getsentry/sentry-forked-django-stubs
  22. getsentry/sentry-forked-jsonnet
  23. getsentry/sentry-infra-tools
  24. getsentry/sentry-kafka-management
  25. getsentry/sentry-kafka-schemas
  26. getsentry/sentry-protos
  27. getsentry/sentry-redis-tools
  28. getsentry/service-registry
  29. getsentry/skrooge
  30. getsentry/snuba-sdk
  31. getsentry/statsdproxy
  32. getsentry/status-page-list
  33. getsentry/streams/sentry_streams
  34. getsentry/symbolic
  35. getsentry/taskbroker/clients
  36. getsentry/usage-accountant
  37. getsentry/watto
  38. getsentry/sentry
  39. getsentry/snuba
  40. getsentry/vroom
  41. getsentry/relay
  42. getsentry/symbolicator
  43. getsentry/taskbroker
  44. getsentry/uptime-checker
  45. getsentry/launchpad
  46. getsentry/self-hosted
• Secret inventory context retained:
  • Sep 8 repository inventory contained 23 secrets; SENTRY_INTERNAL_APP_PRIVATE_KEY was not among them because it is organization-scoped.
  • Organization-secret listing returned HTTP 403; secret values are not available through GitHub APIs.
  • README.md originally listed 24 migration targets including the Internal App key; it now documents that key as an existing Security-owned organization risk instead.
• Current project tooling:
  • Node 24.0.0
  • Yarn 1.22.22
  • Peggy 5.1.0
  • Vitest v4.1.0
  • yarn install emitted [DEP0169] for url.parse() and an unmet Vitest peer warning for vite@^6.0.0 || ^7.0.0 || ^8.0.0-0.

Session Timeline

• Sep 4–5, 2026
  • Sep 4, 23:53–23:58: Resumed approval-pipeline security work.
  • Sep 5, 00:04–02:32: Found title-only proof binding while body controlled release inputs.
  • 01:36–01:40: Added fail-first body-mutation regression; Vitest rejected unsupported --runInBand with CACError: Unknown option --runInBand.
  • 17:15–18:56: Implemented request-digest binding and cleanup hardening; reached 11 files/53 tests.
• Sep 8, 2026
  • 10:05–10:39: Fixed trusted-checkout ordering and requester self-approval; review then found missing automated provenance, pre-Craft revocation window, and mutable Craft.
  • 18:58–19:34: Added open-state validation, automated pre-label attestations, explicit Internal App authorization path, final Craft fence, and digest pin; reached 15 files/63 tests.
  • 20:04–20:07: Found/fixed direct-bot allowlist bypass; reached 15 files/65 tests.
  • 20:18–20:39: Fixed untrusted dispatch arithmetic, pinned all actions, replaced privileged manual dispatch with relay, and corrected canonical 0–59 parsing; reached 16 files/72 tests.
  • 20:48–21:22: Protected secret-bearing jobs with production, disabled admin bypass, documented migration, fixed CocoaPods lint, and reached 16 files/84 tests. Review initially blocked on Internal App secret migration.
• Sep 9, 2026
  • 09:07: User clarified SENTRY_INTERNAL_APP_PRIVATE_KEY is organization-level, cannot be moved, and is available to all workflows. Assistant identified the resulting organization-wide boundary problem.
  • 09:25–09:26: User classified broad key scope as a separate Security issue. Assistant removed the incorrect migration claim from README.md and reversed the repository merge blocker.
  • 09:28–09:29: Tests passed 16 files/84 tests; lint and whitespace passed; independent task ses_f7a7fe83cffeSqKZWJTgg0G1Jv launched.
  • 12:27–18:30: Multiple retries of ses_f7a7fe83cffeSqKZWJTgg0G1Jv and replacement ses_f78c92caeffetj22OvOusYbRL7 returned empty results.
  • 23:06: Server restart reported; reviewer was nudged/resumed.
• Sep 10, 2026, 00:29–01:25
  • More reviewer tasks (ses_f77479685ffeHCeoZNVl50vFeS, ses_f772c23a9ffe0p7UJWZ161cSAH) repeatedly returned empty output.
  • 00:52–00:59: A substantive review found two real bugs—auto-approval sparse checkout omitted executable source, and retry regex rejected attempts 1–9—plus three tests passing for the wrong reason.
  • 00:55–00:59: Added fail-first coverage, fixed both workflows, mutation-verified self-approval/title/event guards, ran focused tests 10 times, and reached 16 files/85 tests with lint/whitespace clean.
• Sep 10, 01:49–02:28
  • 01:49: Reviewer task ses_f77148e81ffeLZigv1qXUEEOCi returned substantive DO-NOT-MERGE: worktree was one commit behind origin/main and lacked workspace parsing, exact revision checkout, containment, and state-file changes.
  • 02:11: Fast-forwarded to 7c60ddb, created autostash aa5efe2, and encountered six conflicts.
  • 02:12–02:20: Resolved parser/state/workflow conflicts using generated grammar, exact revision checkout, workspace discovery, and pinned Craft.
  • 02:23–02:28: Installed merged dependencies, repaired upstream harness assumptions, added moved-revision regression, passed generated checks and 25 files/163 tests, lint, formatting, and whitespace; all conflicts cleared.
• Sep 10, 02:29–03:02
  • 02:31: Found poller TOCTOU: live approval validation used a different snapshot from CI parsing.
  • 02:37: Three fail-first regressions reproduced missing snapshot binding.
  • 02:39–02:41: Threaded mandatory digest through resolver, validator, CI-ready recorder, and all poller fences; focused 32 tests passed.
  • 02:42–02:51: Found equivalent stale-event races in publication, human approval, and auto-approval; added fail-first tests and mandatory EXPECTED_REQUEST_DIGEST.
  • 02:55–03:00: Added request-digest-from-event.js, updated workflows and direct fixtures; focused 10 files/56 tests passed.
  • 03:02: Full generated check and suite passed 26 files/171 tests; lint and whitespace passed.
• Sep 10, 03:03–03:39
  • Release-path and cleanup auditors initially returned empty outputs.
  • 03:24: Cleanup auditor returned substantive DO-NOT-MERGE with six lifecycle blockers:
    1. invalid subshell continue;
    2. successful publish not closed before reporting;
    3. dependency-dependent cleanup;
    4. poller activation stranded by comment/variable failures;
    5. malformed requests retried indefinitely;
    6. stale ci-ready race suppressing fresh publish event.
    • Additional concern: post-result.js crashed on missing PUBLISH_ARGS.
  • 03:39: Assistant began executable fail-first reproduction.
• Sep 10, 03:40–04:11
  • 03:44–03:49: Exact Bash behavior confirmed invalid continue proceeds; 13 fail-first poller regressions reproduced lifecycle defects.
  • 03:49–03:51: Replaced rejection continue with exit 0, added fail-closed malformed-input cleanup and stale-label remove/revalidate/re-add; 18 focused tests passed.
  • 03:54–03:59: Added publication activation/reconciliation and success-close-order regressions; correctly placed success test proved workflow lookup failure prevented issue closure.
  • 04:02: Implemented shell-only dual reconciliation and close-before-reporting.
  • 04:03–04:09: Refactored post-result.js, added missing/malformed input tests, and reached 5 files/24 tests passing.
  • 04:11: Full generated check and suite passed 27 files/184 tests. Strengthened poller ordering test to use one combined Node/gh event log.
• Sep 10, 06:47–06:52
  • 06:47: User asked to continue regression-proof validation; tree remained conflict-free and heavily modified.
  • 06:48–06:49: Strengthened stale-ci-ready ordering test passed; removing the stale-label fence made the test fail as intended at line 328; fence restored.
  • 06:51–06:52: Temporarily changed the final rejection exit 0 back to old continue. Regression failed as intended at line 310 and showed the stale issue still received ci-ready after approval revocation.
  • 06:52: Began restoring exit 0. Next work: verify restoration, mutation-test success-close ordering, activation fallback, dependency-free reconciliation, and terminal-status uniqueness; then run 10-run stability, generated/full tests, formatting, lint, whitespace, and exact-final-tree independent review.