Distillation

Date: Sep 8, 2026

• 🔴 [requested-security-review] (21:06) User requested an independent, read-only security and correctness review of the exact current worktree, focused on the approval pipeline, protected production-environment secret boundary, manual CI-poller dispatch relay, workflow_run semantics, action/image pinning, request-bound attestations, and regressions.
• 🔴 [enforced-read-only] (21:06) User directed that the review inspect every relevant changed file, verify tests/static contracts, and not edit files.
• 🔴 [requested-evidence] (21:06) User required evidence with file:line references and classification of every point as PASS, CONCERN, or MUST-FIX.
• 🔴 (21:06) User required the review response to end exactly MERGE or DO-NOT-MERGE.
• 🔴 (21:06) User directed that, if blocked, the response start with BLOCKED and name the exact tool/error.
• 🔴 (21:06) User stated: “never return empty.”
• 🔴 (21:06) User stated that jj never fails on conflict.
• 🔴 (21:06) User stated decision to replace deprecated trimRight() with trimEnd() (#9012).
• 🔴 (21:06) User stated: “Always allow workflow_dispatch for manual recovery.”
• 🔴 (21:06) User stated: “Always run trusted code.”
• 🟡 (21:06) jj inspection was blocked: exact error was There is no jj repo in "."; tool indicated the directory is a Git repository and suggested jj git init. No mutation was performed.
• 🟡 (21:06) Current Git worktree was on branch main, at 83d210b (HEAD -> main, opencode/tidy-orchid), commit message build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174).
• 🟡 (21:06) Recent history included 5268a23 feat: Add Vercel creds; 92eba3f feat: Add CLOUDFLARE_API_TOKEN (#9122); ada6147 build(deps): bump js-yaml from 4.1.1 to 4.3.0 (#8731); a4f961a fix: Add GITHUB_API_TOKEN for commit-on-git target (#9069); bf10f82 build(deps): bump postcss from 8.5.15 to 8.5.23 (#9017); 837edc0 docs: fix possessive apostrophe placement (#9015); 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012); 22fd64d docs: fix typo 'acces' -> 'access' (#9011); 24b9ce3 docs: fix missing article in rfc.md (#9014).
• 🟡 (21:06) Modified tracked files were .github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/cocoapods-keepalive.yml, .github/workflows/publish.yml, .github/workflows/test.yml, AGENTS.md, README.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/__tests__/update-issue.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js.
• 🟡 (21:06) Untracked files/directories were .github/workflows/ci-poller-dispatch.yml, .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-auto-approval-attestation.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.
• 🟡 (21:06) Diff statistics for the 19 tracked changed files were 502 insertions and 92 deletions. Per-file totals: .github/workflows/auto-approve.yml +21/-2; .github/workflows/ci-poller.yml +172/-23; .github/workflows/cocoapods-keepalive.yml +0/-1; .github/workflows/publish.yml +131/-8; .github/workflows/test.yml +3/-3; AGENTS.md +6/-0; README.md +32/-1; src/libs/__tests__/github.js +1/-1; src/libs/github.js +4/-2; src/modules/__tests__/details-from-context.js +21/-1; src/modules/__tests__/update-issue.js +28/-0; src/modules/details-from-context.js +14/-3; src/modules/post-workflow-details.js +2/-2; src/modules/process-end-state.js +2/-2; src/modules/update-issue.js +23/-19; src/publish/inputs.js +8/-9; src/publish/post-result.js +4/-4; src/publish/post-workflow-details.js +4/-4; src/publish/update-issue.js +26/-7.
• 🟡 (21:06) .github/workflows/auto-approve.yml changes: workflow permissions add issues: write; auto-approve job adds environment: production; pins actions/checkout to 11d5960a326750d5838078e36cf38b85af677262 and actions/create-github-app-token to bcd2ba49218906704ab6c1aa796996da409d3eb1; adds Record automated approval attestation running node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN=${{ github.token }}, issue number/repository/title, and AUTO_APPROVER=${{ github.actor }}; posts steps.attestation.outputs.auto_approval_attestation through gh issue comment; and gates posting and auto-approval on steps.attestation.outcome == 'success'.
• 🟡 (21:06) .github/workflows/ci-poller.yml replaces direct workflow_dispatch (with an attempt input) with repository_dispatch type ci-poller and workflow_run for completed Run CI Status Poller; workflow permission changes from issues: read to issues: write.
• 🟡 (21:06) .github/workflows/ci-poller.yml changes check-ci job gate to permit execution when vars.CI_POLLER_HAS_PENDING == 'true', event is repository_dispatch, or event is a successful workflow_run whose head_branch is github.event.repository.default_branch; comments identify repository dispatch and a successful main-branch protected workflow_dispatch relay as trusted manual-recovery paths.
• 🟡 (21:06) .github/workflows/ci-poller.yml adds repository-dispatch attempt validation: ${{ github.event.client_payload.attempt || '0' }} must match ^(0|[1-5][0-9])$; otherwise emits ::error::repository_dispatch attempt must be an integer from 0 through 59; validated value is written to $GITHUB_OUTPUT.
• 🟡 (21:06) .github/workflows/ci-poller.yml adds Get publish code, using pinned actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, ref: ${{ github.event.repository.default_branch }}, and persist-credentials: false; comment states that workflow_dispatch can target any ref and trusted code must always run.
• 🟡 (21:06) .github/workflows/ci-poller.yml pins all actions/create-github-app-token invocations to bcd2ba49218906704ab6c1aa796996da409d3eb1.
• 🟡 (21:06) .github/workflows/ci-poller.yml replaces shell title parsing with parsePublishTitle from ./src/modules/details-from-context.js; derives repo as "getsentry/" + .repo and version as .version, to keep CI target parsing aligned with Publish.
• 🟡 (21:06) .github/workflows/ci-poller.yml binds each poll cycle to current-accepted-event.js; on failure it removes ci-pending and accepted, comments that approval is invalid/unverifiable, and continues. It extracts accepted_actor and accepted_event_id, then validates github-actions[bot] approval attestations through validate-approval-attestation.js before checking CI, after CI succeeds, and immediately before ci-ready.
• 🟡 (21:06) .github/workflows/ci-poller.yml records a CI-ready attestation using record-ci-ready-attestation.js, writing to a temporary GITHUB_OUTPUT file; requires output beginning ci_ready_attestation=, posts the proof with ${{ github.token }}, and removes ci-pending/accepted with an invalid-approval comment on any failure.
• 🟡 (21:06) .github/workflows/ci-poller.yml replaces self-dispatch gh workflow run ci-poller.yml ... -f attempt=... with repository dispatch POST to repos/$GITHUB_REPOSITORY/dispatches, payload {event_type: "ci-poller", client_payload: {attempt: $attempt}}; computes attempt=$((10#$ATTEMPT + 1)), caps at 60, and retains cron fallback.
• 🟡 (21:06) .github/workflows/cocoapods-keepalive.yml removes workflow_dispatch, leaving only daily cron 0 0 * * *.
• 🟡 (21:06) .github/workflows/publish.yml adds a pinned checkout of publish code via actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 with persist-credentials: false.
• 🟡 (21:06) .github/workflows/publish.yml pins actions/create-github-app-token to bcd2ba49218906704ab6c1aa796996da409d3eb1; adds a release-bot token step with owner: getsentry and continue-on-error: true; adds Authorize approval, running node src/publish/authorize-approval.js with release-token, actor, issue number/repository/title, also continue-on-error: true.
• 🟡 (21:06) .github/workflows/publish.yml records an approval attestation only if authorization succeeds and output authorized == 'true'; it posts ${{ steps.authorization.outputs.approval_attestation }} using gh issue comment.
• 🟡 (21:06) .github/workflows/publish.yml validates approval attestation as github-actions[bot] using validate-approval-attestation.js; on authorization, attestation-recording, or validation failure, Reject invalid approval removes accepted, posts Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue., and exits 1.
• 🟡 (21:06) .github/workflows/publish.yml changes CI-poller triggering from gh workflow run ci-poller.yml to gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" -f event_type=ci-poller.
• 🟡 (21:06) .github/workflows/publish.yml pins actions/checkout to d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node to 249970729cb0ef3589644e2896645e5dc5ba9c38, and docker://getsentry/craft:latest to docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b.
• 🟡 (21:06) .github/workflows/publish.yml validates approval attestations before publishing and immediately before Craft execution using node .__publish__/src/publish/validate-approval-attestation.js, with REQUIRE_CI_READY_ATTESTATION: "true"; failures remove accepted, post the invalid-approval retry comment, and exit 1.
• 🟡 (21:06) .github/workflows/test.yml pins actions/checkout to d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node to 249970729cb0ef3589644e2896645e5dc5ba9c38, and actions/cache to 0057852bfaa89a56745cba8c7296529d2fc39830; Node version remains 24.
• 🟡 (21:07) New .github/workflows/ci-poller-dispatch.yml defines workflow name Run CI Status Poller, trigger workflow_dispatch, permissions: {}, and a dispatch job on ubuntu-latest in environment: production.
• 🟡 (21:07) .github/workflows/ci-poller-dispatch.yml:10-12 documents that production only permits deployments from main, repository secrets must never be used by this workflow, and protected-environment secrets enforce that an arbitrary dispatched ref cannot add them.
• 🟡 (21:07) .github/workflows/ci-poller-dispatch.yml:15-16 contains only a no-op step, - run: ":".