Distillation

Date: Sep 10, 2026

• 🟡 (02:40) Updated src/modules/__tests__/ci-poller-input.js so valid resolver fixtures include complete issue snapshots with labels and separately assert the request digest for each title; coverage binds the raw title, body, and dry-run state so future changes cannot omit dry-run or normalize the title before hashing.
• 🟡 (02:41) Targeted verification passed: yarn vitest run src/modules/__tests__/ci-poller-input.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace completed with 4 test files passed and 32 tests passed in 661ms; Yarn completed in 1.27s.
• 🟡 (02:41) Snapshot-race regressions now pass across the shared resolver, live approval validator, CI-ready proof generation, and CI-poller workflow wiring.
• 🔴 (02:42) User stated the poller always adds ci-ready after checking CI, even if ci-ready was already present; waiting-for-CI may concurrently remove it.
• 🟡 (02:42) Publication review found a stale-snapshot race: both live attestation checks may validate a newer issue request while Craft consumes the triggering event’s older body and dry-run state through PUBLISH_ARGS.
• 🟡 (02:42) Planned fix for publication race: extend the request-digest contract so both publish validation fences are bound to the exact triggering-event snapshot that supplies PUBLISH_ARGS.
• 🟡 (02:42) src/publish/inputs.js calls detailsFromContext({ context: github.context }) and writes the JSON result to the result GitHub Actions output.
• 🟡 (02:42) Approval creation has the same stale-snapshot race: editing the issue body or dry-run state after the accepted label event but before authorization can create an attestation for the changed request under the older label event.
• 🟡 (02:42) Pipeline invariant chosen: every event-triggered approval or publication step must prove its immutable event snapshot matches current live GitHub issue state before minting or consuming an attestation.
• 🟡 (02:44) The snapshot-binding invariant applies to human approval and automated approval paths, as well as publication. Planned design: one shared snapshot-binding helper for issue-opened, accepted-labeled, and ci-ready-labeled events, avoiding duplicated digest logic.
• 🟡 (02:44) src/publish/authorize-approval.js currently fetches live issue state and issue events before minting approval attestations. For automated approval it additionally fetches comments and requires: open issue, exact live title match, approved requester, allowlisted parsed path, current accepted event actor matching AUTO_APPROVAL_LABELER, and a valid automated approval attestation authored by github-actions[bot].
• 🟡 (02:44) For human authorization, src/publish/authorize-approval.js first calls authorizeApproval(), then fetches the live issue and events; it denies closed/title-changed issues, invalid requesters, case-insensitive self-approval, missing accepted events, or event actors differing from the approver. On success it calls createApprovalAttestation({ actor: event.actor, eventId: event.eventId, issue }).
• 🟡 (02:44) .github/workflows/auto-approve.yml runs on issues: types: [opened] only when the actor is sentry-release-bot[bot] or getsantry[bot] and the title starts with publish: . It checks out with actions/checkout@11d5960a326750d5838078e36cf38b85af677262, creates an Internal App token with actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, executes node src/publish/record-auto-approval-attestation.js, posts the resulting proof as an issue comment, and adds accepted only when the exact parsed release path exists in auto-approve-repos.txt.
• 🟡 (02:45) recordAutoApprovalAttestation() in src/publish/record-auto-approval-attestation.js fetches the live issue and rejects with "The automated approval request changed before approval" unless the issue is open, its title exactly equals issueTitle, and the opener login case-insensitively equals autoApprover; success calls createAutoApprovalAttestation({ autoApprover, issue }).
• 🟡 (02:45) Chosen shared mechanism: a small trusted script will hash the issue object read from GITHUB_EVENT_PATH; untrusted issue text will not be interpolated into shell syntax.
• 🟡 [requested-tests] (02:45) Planned fail-first coverage for snapshot binding in 4 areas: human authorization, automated proof creation, and both affected event workflows.
• 🟡 (02:46) Decided event-snapshot verification must be mandatory rather than an optional caller-provided defense. Planned contract change: identify every attestation entry-point call, then require EXPECTED_REQUEST_DIGEST at every entry point.