Dashboard › craft › Distillation
ed82cf2f-6ba9-43dd-8b7a-f5946ef4a7c5["lore_tm_v1_4wSDU6ffxmJqDey0bNBqQe2kqdQwyfxMFG1Y72bMBX0","lore_tm_v1__0s0vVDK9xuiPkW9kdumMk38lufKsW8QTfpbOuqnLsE","lore_tm_v1_WCmQqgo4Md5Mt2ZLNn0fa-AxDhItRLSSpgEquVa4h2E","lore_tm_v1_4j-lOX3lfPkC-M-fYd3FQOsLqGSUWGn9OQ_uYOoXkEA","lore_tm_v1_7oqdkI-tu692AoIYk25OR6XwNFXR4hXBuEvCRnz0JvY","lore_tm_v1__8eskZH10XBbb2_mYTL-joElp8SDmpPRM_ypQjwBfH8"]
Date: Sep 2, 2026
publish-workspace-acceptance/src/modules/release-revision.js:2 request-header regex could match a complete forged Requested by / Merge target / Quick links block later in an issue body because multiline matching permitted ^ beyond the body beginning; reproduction with ### Changelog followed by a forged complete block returned the attacker SHA. Required fix: anchor the authority block to the issue-body start and add a regression.b658ffa at publish-workspace-acceptance/.github/workflows/cocoapods-keepalive.yml:1; required removal from the branch. It also confirmed specified newline-only dirty changes in src/modules/post-workflow-details.js and src/publish/inputs.js were excluded from intended staging; Publish had no tracked or untracked pnpm-lock.yaml; Craft’s pre-existing root and docs lockfiles were unchanged.release-revision.js:3-16; CI poller uses shared parser and updates only canonical link in ci-poller.yml:100-107,143-147 while retaining manual workflow_dispatch in ci-poller.yml:3-12,24; legacy JSON workspace titles remain supported in details-from-context.js:34-59 while Craft action.yml:74-87 enforces safe compact names; notification follows revision resolution in publish.yml:138-149; checkout and Craft publish use resolved SHA in publish.yml:159-167,239-249; Publish state filename logic matches Craft cwd hash/workspace encoding in publish.yml:217-235 and publishState.ts:82-99; generated parser freshness is enforced by package.json:18-20 and scripts/generate-publish-issue-title-parser.js:31-37.yarn test had 50 passing tests and lint passed; Craft pnpm test had 1,156 passing tests, lint passed with 7 existing warnings, and build passed..github/workflows/cocoapods-keepalive.yml showed line 1 name: CocoaPods Token Keep-Alive; schedule comment says CocoaPods sessions expire after 3 days of inactivity; cron is "0 0 * * *" (daily at midnight UTC); workflow_dispatch remains enabled.src/modules/release-revision.js failed because expected regex text ending \r?$/m was not present.src/modules/release-revision.js:2 uses CHECK_RUNS_LINK anchored with leading ^Requested by: ... and no m flag; it accepts an Action request header with optional blank/whitespace lines, Merge target, Quick links, View changes, then canonical https://github.com/getsentry/<repo>/commit/<40 lowercase hex>/checks link followed by newline or end of body. CHECK_RUNS_LINK_COUNT remains /^[ \t]*- \[View check runs\]\(/gm, and getReleaseRevision() rejects unless exactly one check-runs entry is present and its parsed repository equals repo.