Distillation

🟡 (17:03) [requested-review] User requested resumption and completion of the interrupted exact-worktree security audit for /home/byk/Code/getsentry/publish, preserving the prior nine-area scope and requiring current file:line evidence plus PASS, CONCERN, or MUST-FIX for every area. 🔴 (17:03) [enforced-read-only] User required the resumed audit to remain strictly read-only and prohibited editing or mutating files. 🔴 (17:03) User required a non-empty report ending exactly MERGE or DO-NOT-MERGE; if blocked, it must begin with BLOCKED and quote the exact blocker. 🔴 (17:03) User stated arbitrary-ref workflow_dispatch must always run trusted code. 🔴 (17:03) User stated a release must never be moved to ci-ready after it changes. 🔴 (17:03) User stated a renamed or re-approved issue must never reach ci-ready. 🔴 (17:03) User stated the poller always adds ci-ready. 🟡 (17:03) .github/workflows/auto-approve.yml lines 14-16 restrict the auto-approve job to issue titles beginning publish: where github.actor is exactly sentry-release-bot[bot] or getsantry[bot]; the job runs in the production environment at line 13. 🟡 (17:03) .github/workflows/auto-approve.yml lines 18-20 use actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with persist-credentials: false; lines 23-26 use actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 with vars.SENTRY_INTERNAL_APP_ID and secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY. 🟡 (17:03) .github/workflows/auto-approve.yml lines 27-39 bind the request snapshot with node src/publish/request-digest-from-event.js, then invoke node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN=${{ github.token }}, issue number/repository/title, AUTO_APPROVER=${{ github.actor }}, and EXPECTED_REQUEST_DIGEST=${{ steps.request-digest.outputs.request_digest }}. 🟡 (17:03) .github/workflows/auto-approve.yml lines 40-46 post steps.attestation.outputs.auto_approval_attestation as an issue comment using github.token only when steps.attestation.outcome == 'success'. 🟡 (17:03) .github/workflows/auto-approve.yml lines 47-57 use the generated app token to add accepted only after successful attestation and only when a repository parsed from ISSUE_TITLE via sed -n 's/^publish: \(.*\)@.*/\1/p' exactly matches a line in auto-approve-repos.txt through grep -qxF. 🟡 (17:03) The displayed .github/workflows/ci-poller.yml excerpt validates repository_dispatch attempt as an integer from 0 through 59, states at line 51 that arbitrary-ref workflow_dispatch must run trusted code, and checks only issues carrying both ci-pending and accepted. 🟡 (17:03) The displayed .github/workflows/ci-poller.yml excerpt says invalid publish requests are commented with The publish request is invalid and could not be checked. Fix the request and re-add the accepted label to retry. and includes approval revalidation before CI inspection with the invariant Never move a release to ci-ready after it changes. 🟡 (17:03) The displayed .github/workflows/ci-poller.yml excerpt extracts accepted_event_id using jq -r '.eventId'; when approval is invalid it emits Approval for issue #${number} is invalid. Removing accepted. 🟡 (17:03) The displayed .github/workflows/ci-poller.yml excerpt performs final revalidation after CI checks so a renamed or re-approved issue never reaches ci-ready, removes stale ci-ready, records a CI-ready attestation using EXPECTED_ACCEPTED_EVENT_ID="$accepted_event_id", and then reports CI passed! Adding ci-ready label. 🟡 (17:03) The displayed .github/workflows/ci-poller.yml excerpt treats completed checks as failures when .conclusion is not success, neutral, or skipped; it caps redispatch at 60 attempts, described as approximately 30 min. 🟡 (17:03) The displayed .github/workflows/publish.yml excerpt states the poller always adds ci-ready, gates publication on the issue containing ci-ready, runs its publication job in the production environment, and uses APPROVAL_ATTESTATION_AUTHOR: github-actions[bot]. 🟡 (17:03) The displayed .github/workflows/publish.yml excerpt pins actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, writes Craft state into a designated safe location, discusses allowed workspace roots /github/workspace/__repo__ and its contained paths, and supplies EXPECTED_REQUEST_DIGEST=${{ steps.request-digest.outputs.request_digest }} for final validation. 🟡 (17:03) The displayed .github/workflows/publish.yml excerpt documents cleanup intended to execute independently so setup, dependency, parsing, checkout, and Craft failures cannot prevent deauthorization/label cleanup; cleanup removes authorization labels including accepted, ci-pending, and ci-ready.