Dashboard › publish › Distillation
f5773f95-7159-4c45-a941-f545db1824eb["lore_tm_v1_5zzOgp4w29-0G3s42SFoWn2kENBKcHKcBpBOVNRDwB4","lore_tm_v1_7pzeRDtv3fFPUmBRCaj3dpjHtRTMqhlLwzbRJMDJtrQ","lore_tm_v1_Q2-SRC1_bDnnsRdYML-W7TZvFWn7ebAqH_RKMp4cHWc","lore_tm_v1_e0jyN7BL1iWnkiTRGeHMrPbsUsCgcqWOrelIZXGdmvE","lore_tm_v1_QcK-1i2kGY9XX1BV0A5HyVLLna2WxQxFirwVnPSxYE8","lore_tm_v1_yOUIaOkoEX8GWUK0W1oUz3hWgl3X1pSjppKGCacfRfI","lore_tm_v1_VTaTXCblaHgYPnCsJlgQjhFTV8utEgpKL488f20wjQQ","lore_tm_v1_VwI8NZM4QsaMVLEz4U8C3inDIXu3S7gg0bYcrcRb2yY","lore_tm_v1_htEHS1kHO4zEhF4KLJddKA2i_rueCoDrUuQT2JcT9lY","lore_tm_v1_7xSjSGjev1LcS2wJGSNHM4UZqKd2Gs5fBruu5ukkHNI","lore_tm_v1_ZPC7E6xb4Gh_f9qHyGgqWmDM8j3remZrAB_S2Hk7r2E","lore_tm_v1_F9OV1OwU2Iw-K2Yt2vbb9nwo9q_FjrZL_20EgeD4Su0","lore_tm_v1_irRsELQ5_JgOG4UY4ASqpVTvxS8MsNoDfUdKmOsCaDw","lore_tm_v1_NV2IRpXLlBSLLNNyFBLDJtxHwKXUnEf478T4QOefni8","lore_tm_v1_Q-DkMpKeSOLpZMYNJM0gCX1K9Ckva-f768zSwL5Le_s"]
Date: Sep 9, 2026
.github/workflows/auto-approve.yml +21/-2; .github/workflows/ci-poller.yml +172/-23; .github/workflows/cocoapods-keepalive.yml +1/-2; .github/workflows/publish.yml +131/-8; .github/workflows/test.yml +3/-3; AGENTS.md +6/-0; README.md +3/-1; docs/key_rotation_vault_changes.md +20/-20; docs/rfc.md +5/-4; src/libs/__tests__/github.js +1/-1; src/libs/github.js +4/-2; src/modules/__tests__/details-from-context.js +21/-1; src/modules/__tests__/update-issue.js +28/-0; src/modules/details-from-context.js +14/-3; src/modules/post-workflow-details.js +2/-2; src/modules/process-end-state.js +2/-2; src/modules/update-issue.js +23/-19; src/publish/inputs.js +8/-9; src/publish/post-result.js +4/-4; src/publish/post-workflow-details.js +4/-4; src/publish/update-issue.js +26/-7..github/workflows/cocoapods-keepalive.yml changed its display name from quoted "CocoaPods Token Keep-Alive" to unquoted CocoaPods Token Keep-Alive and removed the workflow_dispatch trigger; its daily cron remains "0 0 * * *" at midnight UTC..github/workflows/test.yml pinned three actions from mutable version tags to full commit SHAs: actions/checkout@v6 → actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node@v6 → actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, and actions/cache@v4 → actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830; Node remains version 24.AGENTS.md gained a lore-managed ## Long-term Knowledge section linking .lore.md and identifying https://github.com/BYK/loreai, bounded by lore maintenance comments.README.md security documentation now states the repository is read-only except for release managers; secret-bearing jobs use the protected production environment, permit only main deployments, and disallow administrator bypass. It also states SENTRY_INTERNAL_APP_PRIVATE_KEY and SENTRY_RELEASE_BOT_PRIVATE_KEY are organization-level secrets whose cross-repository availability must be managed separately by Security.docs/key_rotation_vault_changes.md reformatted the OSS credential hierarchy while preserving entries: user _redacted_; keys PyPI Bot — OSS, Crates.io — OSS, DockerHub — OSS, Github (getsentry-bot) — OSS, NPM Bot — SDKs, Cocoapods — SDKs, Nexus — SDKs, Packagist — SDKs, RubyGems — SDKs + Ops, Code Signing Certificate — SDKs, Bintray — SDKs, Bot Apple ITC — Shared, and clojars.org → SDKs; SDK Low Security retains user SDK Team and Remaining items in SDKs vault.docs/rfc.md received Markdown indentation/blank-line normalization and a final newline; its release workflow still lists repository name and version to release as issue information.src/modules/details-from-context.js introduced exported PUBLISH_TITLE_REGEX = /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/ and exported parsePublishTitle(title), which returns matched named groups or null.detailsFromContext({ context }) now calls parsePublishTitle(context.payload.issue.title) and explicitly throws Invalid publish issue title: ${context.payload.issue.title} when the title does not match, replacing direct access to .match(...).groups that could fail without a targeted error.src/modules/update-issue.js changed updateIssue({ context, octokit, inputs }) so updateTargets(...) runs only when inputs?.version is present; removal of the accepted label still runs when inputs are absent. transformIssueBody() was reformatted and continues adding unlisted published targets with a trailing newline.src/publish/update-issue.js was refactored into exported async main(): it obtains github.context and an Octokit client, conditionally parses process.env.PUBLISH_ARGS, warns Could not parse publish inputs; skipping target update on malformed JSON, awaits updateIssue({ context, octokit, inputs }), and when run directly catches errors, logs them, and sets process.exitCode = 1.src/modules/__tests__/details-from-context.js added parses qualified and legacy publish titles, verifying parsePublishTitle("publish: getsentry/sentry-javascript/packages/core@10.0.0") returns { path: "/packages/core", repo: "sentry-javascript", version: "10.0.0" } and parsePublishTitle("publish: sentry-javascript@10.0.0") returns { path: undefined, repo: "sentry-javascript", version: "10.0.0" }.src/modules/__tests__/update-issue.js added removes accepted without parsed publish inputs: with inputs: undefined, it verifies fs.existsSync, issue get, and issue update are not called, while removeLabel is called with { issue_number: "211", name: "accepted", owner: "getsentry", repo: "publish" }.src/libs/__tests__/github.js, src/libs/github.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/publish/inputs.js, src/publish/post-result.js, and src/publish/post-workflow-details.js; getGitHubToken() retains error text No "GITHUB_TOKEN" environment variable found. Please ensure the workflow is configured correctly.CHANGELOG.md, api.github.com.2022-11-28.json, api.github.com.2022-11-28.yaml, api.github.com.2026-03-10.json, api.github.com.2026-03-10.yaml, api.github.com.json, api.github.com.yaml, and dereferenced.https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.2026-03-10.json; fetching/displaying it produced Response too large (exceeds 5MB limit) at 13:33.dereferenced directory contained api.github.com.2022-11-28.deref.json, api.github.com.2022-11-28.deref.yaml, api.github.com.2026-03-10.deref.json, api.github.com.2026-03-10.deref.yaml, api.github.com.deref.json, and api.github.com.deref.yaml.Get the authenticated user, security: null, and xGithub values githubCloudOnly: false, enabledForGitHubApps: false, category: "users", and subcategory: "users"..github/workflows/test.yml configuration: triggers on pushes to main and all pull requests; permissions are contents: read; default shell is bash; job unit-test runs on ubuntu-latest; it uses the three pinned action SHAs, Node 24, caches node_modules under key ${{ runner.os }}-node_modules-${{ hashFiles('package.json', 'yarn.lock') }}, runs yarn install --frozen-lockfile only when steps.cache.outputs.cache-hit != 'true', then runs yarn test.src/publish/__tests__/ci-poller-workflow.js contains 3 tests: 1. verifies trusted default-branch checkout via a 40-character SHA occurs before Get auth token; 2. verifies the privileged workflow uses repository_dispatch type [ci-poller] plus a successful default-branch workflow_run, has no workflow_dispatch, while .github/workflows/ci-poller-dispatch.yml has workflow_dispatch, permissions: {}, environment: production, no secrets., and no repository_dispatch; 3. verifies Validate dispatch attempt precedes token acquisition, accepts only ^(0|[1-5][0-9])$, defaults attempts to '0', increments with attempt=$((10#$ATTEMPT + 1)), and dispatches using gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -.b2b489b4e6427c0dece46fd79a25de419ecdc868; 2. 17d5e91f956f3b5d8018d11d1a5f07499941b02d; 3. 781bd0850f4ea15ae89417acabdd353fc98b6bd0; 4. ffa59824a15397dee70c1f85255d813d08c52c01; 5. 9ff9a9d55b07734dcbb33e7d3f4fa69178edb39c; 6. da7f78e280490ead1558d6db6d752677c643fd2f; 7. 096024af8c999595952a6f029cdb06794be23e11; 8. d64534399a1a23a4d5578e2fc1c7d6f98c17c0f7; 9. 69f70a434528fa2adf1333d5045ad6b473304118; 10. 42bcf376d395dafbc410b704f0bed5544cf6d024; 11. 3ea8bb7bc2b76c5ae4ea2ba0d2bc9325b2bc8582; 12. baa0ef86bfc0d7fc0db974197cc7a227833eb271; 13. 5c0baa5457a54f9c444de3cd1bf1b473c065f9b7; 14. 4989a1966b38b32111a8e9d1471caa1c81e5dff6; 15. 28ed176707f937156903fd82acbfa7d712efeba4; 16. 9009a04c9746fe800c3d7f490595d1c6dff3d69f; 17. d5c1f254e9610e0832a775dbea366939344beb0b.yarn run v1.22.22 command vitest run --run --printConsoleTrace with Vitest v4.0.17 in /home/byk/Code/getsentry/publish; all 16 test files and all 84 tests passed. Start time was 13:39:35; Vitest duration was 3.92s (transform 476ms, setup 0ms, import 2.64s, tests 602ms, environment 9ms), and Yarn completed in 5.27s.src/publish/__tests__/current-accepted-event.js — 2 tests, 31ms; 2. src/publish/__tests__/validate-approval-attestation.js — 9 tests, 44ms; 3. src/modules/__tests__/approval-attestation.js — 5 tests, 75ms; 4. src/publish/__tests__/authorize-approval.js — 7 tests, 55ms; 5. src/modules/__tests__/approval-authorizer.js — 15 tests, 49ms; 6. src/publish/__tests__/record-ci-ready-attestation.js — 3 tests, 23ms; 7. src/modules/__tests__/process-end-state.js — 4 tests, 143ms; 8. src/modules/__tests__/post-workflow-details.js — 1 test, 36ms; 9. src/modules/__tests__/update-issue.js — 6 tests, 28ms; 10. src/publish/__tests__/ci-poller-workflow.js — 3 tests, 13ms; 11. src/publish/__tests__/record-auto-approval-attestation.js — 2 tests, 34ms; 12. src/modules/__tests__/details-from-context.js — 5 tests, 17ms; 13. src/publish/__tests__/workflow-action-pinning.js — 16 tests, 28ms; 14. src/publish/__tests__/publish-workflow.js — 2 tests, 7ms; 15. src/publish/__tests__/auto-approval-workflow.js — 2 tests, 7ms; 16. src/libs/__tests__/github.js — 2 tests, 11ms.yarn run v1.22.22 command eslint src .github --ignore-pattern '!.github'; lint completed successfully in 3.25s.d0ec32e8a417ba16e7de5ad8f975ff6252ef751607ff7e214f0d24063b72f129 and d861d7b470bfeb8a0c3caf03d2d92ed670fe93381b87de1bb6961636e48d231a, followed by the same two hashes again in the same order.