Dashboard › publish › Distillation
f22a92e4-22df-4025-80ef-85de1bdcd29a["lore_tm_v1_3sdQjMum7Nh8BADLcSnT-GrX7f96HUl8zzQ70jLVOx8","lore_tm_v1_-WVuWXtPql2oA-nCRQvaVI9-nLbe_I-ovHc8vd6wq10","lore_tm_v1_XwN7SD8xtHMUAdDozEsa7pZDoxovgc_5XiEAyBd8-u0","lore_tm_v1_p2Ct9mekyBK9nBbpRzHLlQ3fEjsttr35EhUV2lXARIc","lore_tm_v1_xMUW3-2FFpCrbZHB0fgQEHerdSWElrgnlXua4BEw49M","lore_tm_v1_OgaTNcyxc8jWbJFMn4_zg-GnR27Hx2zYBVeeqfXrons","lore_tm_v1_vdeHM3YmJ9LsbxQRPJt0SjpIP1TQ3yw2vATJhghYnUg","lore_tm_v1_YnCSu_nXrtZkq2aMBg03ng6VR0aD9HSNwLiqFoGVe_0","lore_tm_v1_Ec1IVitBnrUj20V-jdOC9DJMpucJwklqRNy-K_WZmAE","lore_tm_v1_2IWu4LuM8d1LT-c6ZSTyU1KdaeqGCZAj8ei585PZL0g","lore_tm_v1_pIbW7nYZ76NA74TNJ5sH-1FF12PMZ3nThbM1LKE58ko","lore_tm_v1_d2bUA9-6Sk733qBrwojr5UAnqStnC8qObf3_kcNLXcc","lore_tm_v1_tcccovIVlwBA0zG_92vl1Ck6P0RZ1RY2KlklfFO3gGE","lore_tm_v1_jmWe-03APbNatHILMiB053CodqU4HxYJh9p_ZEiFmEg","lore_tm_v1_xj024PX2vaTQR2q3OgGyBuw9LntWswg2KmrbRc7l_1s","lore_tm_v1_h3vl7ZBUrgayBFymqPEGcHCF11Dzk0YdktKiy1NZitU","lore_tm_v1_MTfLaIIIqVmagmEJIn_V7UpqgWUxG_TM-TxHBhRvvDY"]
Date: Sep 8, 2026
production, which permits only main deployments and disables administrator bypass.README.md documents a secret-migration prerequisite: add secrets to production, verify its deployment branch policy allows only main, then delete repository- or organization-level copies; since GitHub’s API cannot retrieve existing secret values, obtain each from its current owner or vault.README.md migration list contains AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, CI_POLLER_APP_PRIVATE_KEY, CLOUDFLARE_API_TOKEN, COCOAPODS_TRUNK_TOKEN, CRAFT_GCS_STORE_CREDS_JSON, CRAFT_GCS_TARGET_CREDS_JSON, CRATES_IO_TOKEN, DOCKER_PASSWORD, GEM_HOST_API_KEY, GPG_PASSPHRASE, GPG_PRIVATE_KEY, HEX_API_KEY, NPM_TOKEN, NUGET_API_TOKEN, OSSRH_PASSWORD, OSSRH_USERNAME, POWERSHELL_API_KEY, PUBDEV_ACCESS_TOKEN, PUBDEV_REFRESH_TOKEN, SENTRY_INTERNAL_APP_PRIVATE_KEY, SENTRY_RELEASE_BOT_PRIVATE_KEY, TWINE_PASSWORD, and VERCEL_TOKEN.AGENTS.md now points long-term knowledge managed by lore to root .lore.md, via a lore-maintained section.src/modules/details-from-context.js adds and exports PUBLISH_TITLE_REGEX and parsePublishTitle(title), returning regex named groups or null; detailsFromContext() now throws Invalid publish issue title: ${context.payload.issue.title} rather than dereferencing an absent title match.src/modules/__tests__/details-from-context.js adds coverage that parsePublishTitle("publish: getsentry/sentry-javascript/packages/core@10.0.0") returns { path: "/packages/core", repo: "sentry-javascript", version: "10.0.0" }, and legacy publish: sentry-javascript@10.0.0 returns path: undefined, repo: "sentry-javascript", version: "10.0.0".src/modules/update-issue.js changes updateIssue() so target-state restoration runs only when inputs?.version is present, while removal of the accepted label always occurs. src/modules/__tests__/update-issue.js verifies undefined inputs skip fs.existsSync, issue fetch, and issue-body update but call removeLabel for issue "211" in getsentry/publish.src/publish/update-issue.js now exports async main(): it parses PUBLISH_ARGS only when defined, warns Could not parse publish inputs; skipping target update on malformed JSON, still calls updateIssue({ context, octokit, inputs }), and when directly executed logs caught errors and sets process.exitCode = 1.src/libs/github.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, and src/publish/post-workflow-details.js; src/libs/__tests__/github.js expectation was shortened to 'No "GITHUB_TOKEN" environment variable found.', while implementation still appends Please ensure the workflow is configured correctly..github/workflows/cocoapods-keepalive.yml defines scheduled workflow "CocoaPods Token Keep-Alive" at 0 0 * * *, running keepalive on macos-15 in environment: production; it injects COCOAPODS_TRUNK_TOKEN: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}, installs CocoaPods, prints its version, and runs pod trunk me > /dev/null 2>&1.package.json specifies private package publish version 0.0.1, Node 24.0.0, Yarn 1.22.22, Vitest ^4.1.0, test script vitest run, lint script eslint src .github --ignore-pattern '!.github', and Prettier script prettier --write src.yarn test --printConsoleTrace passed: 16 test files and 84 tests passed in 2.24s (transform 269ms, import 1.32s, tests 315ms); command completed in 2.78s under Vitest v4.0.17.yarn lint failed with 1 error: .github/workflows/cocoapods-keepalive.yml:1:7 violates yml/plain-scalar because its workflow name must use plain scalar style; ESLint reports it is potentially fixable with --fix.src/modules/__tests__/approval-authorizer.js, src/modules/approval-authorizer.js, src/publish/__tests__/validate-approval-attestation.js, src/publish/__tests__/workflow-action-pinning.js, and src/publish/record-auto-approval-attestation.js..github/workflows/test.yml runs on pushes to main and pull requests, with contents: read, Bash default shell, and Ubuntu unit-test job; it uses SHA-pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with Node 24, and actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830, then conditionally runs yarn install --frozen-lockfile and yarn test..github/workflows/publish.yml uses checkout SHA d23441a48e516b6c34aea4fa41551a30e30af803, create-app-token SHA bcd2ba49218906704ab6c1aa796996da409d3eb1, setup-node SHA 249970729cb0ef3589644e2896645e5dc5ba9c38, and Craft image docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b; ci-poller.yml uses checkout and create-app-token at those SHAs; auto-approve.yml uses checkout SHA 11d5960a326750d5838078e36cf38b85af677262 and that create-app-token SHA; test.yml additionally uses cache SHA 0057852bfaa89a56745cba8c7296529d2fc39830.publish.yml references SENTRY_INTERNAL_APP_PRIVATE_KEY, SENTRY_RELEASE_BOT_PRIVATE_KEY, CI_POLLER_APP_PRIVATE_KEY, four GITHUB_TOKEN usages, and publishing credentials including CLOUDFLARE_API_TOKEN, COCOAPODS_TRUNK_TOKEN, CRAFT_GCS_TARGET_CREDS_JSON, CRAFT_GCS_STORE_CREDS_JSON, CRATES_IO_TOKEN, DOCKER_PASSWORD, HEX_API_KEY, TWINE_PASSWORD, NPM_TOKEN, GEM_HOST_API_KEY, AWS credentials, NUGET_API_TOKEN, POWERSHELL_API_KEY, GPG credentials, OSSRH credentials, PubDev credentials, and VERCEL_TOKEN; ci-poller.yml references internal-app, release-bot, and CI-poller private keys; auto-approve.yml references internal-app private key; keepalive references CocoaPods token.production environment deployment branch policy reports custom_branch_policies: true, protected_branches: false, with a branch_policy protection rule; its listed allowed branch is main.production environment’s listed secrets are AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, CI_POLLER_APP_PRIVATE_KEY, CLOUDFLARE_API_TOKEN, COCOAPODS_TRUNK_TOKEN, CRAFT_GCS_STORE_CREDS_JSON, CRAFT_GCS_TARGET_CREDS_JSON, CRATES_IO_TOKEN, DOCKER_PASSWORD, GEM_HOST_API_KEY, GPG_PASSPHRASE, GPG_PRIVATE_KEY, HEX_API_KEY, NPM_TOKEN, NUGET_API_TOKEN, OSSRH_PASSWORD, OSSRH_USERNAME, POWERSHELL_API_KEY, PUBDEV_ACCESS_TOKEN, PUBDEV_REFRESH_TOKEN, SENTRY_RELEASE_BOT_PRIVATE_KEY, TWINE_PASSWORD, and VERCEL_TOKEN; SENTRY_INTERNAL_APP_PRIVATE_KEY is absent.Not Found; organization-secret lookup returned HTTP 403 because org-admin or Actions-secrets fine-grained permission is required, specifically admin:org scope via gh auth refresh -h github.com -s admin:org.production environment response confirms can_admins_bypass: false, custom branch policies enabled, protected branches disabled, and a branch_policy protection rule.auto-approve.yml, ci-poller.yml, cocoapods-keepalive.yml, publish.yml, and test.yml; modified documentation and source/test files; and untracked .github/workflows/ci-poller-dispatch.yml, .lore.md, approval-attestation/authorizer modules and tests, publish authorization/attestation scripts, and 9 publish test files.SENTRY_INTERNAL_APP_PRIVATE_KEY is required by .github/workflows/auto-approve.yml:24-27, .github/workflows/ci-poller.yml:60-63, and .github/workflows/publish.yml:42-45, but absent from production; recommended adding it to production and deleting any organization-level copy before merge, because an inherited organization secret could be exposed by arbitrary-ref dispatch and an absent environment secret would break production approval/CI jobs..github/workflows/ci-poller-dispatch.yml contains only workflow_dispatch, permissions: {}, no secret references, and protected-environment use; privileged poller requires a successful default-branch relay run, checks out trusted default-branch code without persisted credentials before app-token minting, constrains repository-dispatch retry input before secrets, and uses base-10 arithmetic.ci-ready; publish revalidates on entry and directly before Craft; actions are SHA-pinned and Craft image digest-pinned.DO-NOT-MERGE because lint fails and Prettier reports 5 changed files; it noted git diff --check passes.