Distillation

🔴 (11:57) updateTargets({ octokit, stateFilePath, publishRepo, issue_number }) in src/modules/update-issue.js returns without making API calls when stateFilePath is absent or fs.existsSync(stateFilePath) is false. 🔴 (11:57) When a state file exists, updateTargets() concurrently fetches the issue via octokit.rest.issues.get({ ...publishRepo, issue_number }) and reads/parses the UTF-8 JSON file with fs.promises.readFile(stateFilePath, { encoding: "utf-8" }).then((data) => JSON.parse(data)); it then transforms issue.body with transformIssueBody(craftState, issue.body) and updates the issue body via octokit.rest.issues.update. 🔴 (11:57) transformIssueBody(craftState, issueBody) in src/modules/update-issue.js replaces the section matched by TARGETS_SECTION_PARSER_REGEX; within it, targets matched by TARGETS_PARSER_REGEX are tracked in a Set and rewritten as - [x] ${targetId} when craftState.published[targetId] is truthy or - [ ] ${targetId} otherwise. 🔴 (11:57) transformIssueBody() appends every key in craftState.published not already declared in the targets section, preserving Object.keys(craftState.published) order and formatting each as - [x] ${target} or - [ ] ${target}; the appended block includes surrounding newlines. 🔴 (11:57) updateIssue({ context, octokit }) in src/modules/update-issue.js derives publishRepo from context.repo and issue_number from context.payload.issue.number, then concurrently calls updateTargets() with process.env.CRAFT_STATE_FILE_PATH and removes the "accepted" label via octokit.rest.issues.removeLabel. 🔴 (11:57) src/modules/update-issue.js exports { updateIssue, transformIssueBody }; updateTargets is not exported. 🔴 (11:57) src/modules/__tests__/approval-attestation.js contains 5 Vitest tests for approval attestations and imports createApprovalAttestation, createCiReadyAttestation, currentAcceptedEvent, hasApprovalAttestation, hasCiReadyAttestation, parseApprovalAttestation, and requestDigest from ../approval-attestation.js. 🔴 (11:57) The approval-attestation test helper issue(title, { body = "", dryRun = false } = {}) returns { body, labels, title }, where labels is [{ name: "dry-run" }] when dryRun is true and [] otherwise. 🔴 (11:57) Test "matches the latest accepted event to a trusted attestation" verifies that currentAcceptedEvent() chooses the latest "accepted" labeled event—{ actor: "contractor", eventId: "200" } rather than event ID "100"—and that an attestation authored in a comment by "github-actions[bot]" matches that event and the issue titled "publish: getsentry/relay/py@1.2.3". 🔴 (11:57) Test "accepts numeric event IDs returned by GitHub's issue events API" verifies that numeric GitHub event ID 29503999078 is normalized by currentAcceptedEvent() to string event ID "29503999078" with actor "contractor". 🔴 (11:57) Test "matches a CI-ready attestation to the current accepted event" creates an attestation for accepted event { actor: "contractor", eventId: "200" } and CI-ready actor "sentry-internal-app[bot]"; hasCiReadyAttestation() returns true for CI-ready event { actor: "sentry-internal-app[bot]", eventId: "300" }, false when the current accepted event changes to event ID "201", and false when the CI-ready event actor is "contractor" with event ID "301". 🔴 (11:57) Test "rejects malformed or stale attestations" verifies rejection when an approval attestation comment is authored by "contractor" instead of the required "sentry-internal-app[bot]", rejection when the expected event changes from ID "200" to "201" and the issue title changes from version 1.2.3 to 1.2.4, and parseApprovalAttestation("<!-- publish-approval not-base64 -->") returning null. 🔴 (11:57) Test "rejects a request after its dry-run state changes" verifies that an attestation’s parsed requestDigest equals requestDigest(attestedIssue) and that hasApprovalAttestation() returns false if the otherwise matching issue later gains the "dry-run" label.