Dashboard › publish › Distillation
fdcfe2eb-4809-4430-8564-26dee22793f4["lore_tm_v1_9eMJGT22SOmwyp4xwUPyFSv37Smvtkjvul1aJmsn864","lore_tm_v1_dR-LUnrPyzbLsWm096QkwuhkvfpvVl1ZUpkotnAsvxY","lore_tm_v1_-0AqAIQyF2G6slIrsJ_nJvZ5nIb3E0qDUcsp61aqAlo","lore_tm_v1_z4UADfQJntzURpCNeGK7yxo1rE8hebaIzRqPX2vd1zw","lore_tm_v1_rYFC8L5JZiFPHfGfslnF2Ha7LRFKqtEWzrAd8VD8LP8","lore_tm_v1_MK-ep6PZ64HvXMadmjOIGXg1eDMe9NMwY1Xt_ay0q80"]
Date: Sep 8, 2026
/home/byk/Code/getsentry/publish; top-level entries include .github/, src/, docs/, node_modules/, package.json, yarn.lock, vitest.config.js, AGENTS.md, auto-approve-repos.txt, .lore.md, README.md, and LICENSE..github/workflows/publish.yml, .github/workflows/ci-poller.yml, .github/workflows/auto-approve.yml, .github/workflows/test.yml, .github/workflows/cocoapods-keepalive.yml; ownership file: .github/CODEOWNERS.src/publish/record-auto-approval-attestation.js, current-accepted-event.js, record-ci-ready-attestation.js, validate-approval-attestation.js, authorize-approval.js; modules src/modules/approval-attestation.js, approval-authorizer.js; associated workflow/unit tests under src/publish/__tests__/ and src/modules/__tests__/..github/workflows/auto-approve.yml, .github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/github.js, src/libs/__tests__/github.js, src/modules/details-from-context.js, post-workflow-details.js, process-end-state.js, update-issue.js, their specified tests, and src/publish/inputs.js, post-result.js, post-workflow-details.js, update-issue.js; untracked additions include .lore.md, approval-attestation/authorizer modules and tests, all src/publish/__tests__/, and five approval-flow scripts. Diff stat for tracked changes: 16 files, 419 insertions, 62 deletions.workflow_dispatch: always run trusted code; .github/workflows/ci-poller.yml checks out github.event.repository.default_branch via actions/checkout@v6 with persist-credentials: false, rather than the dispatcher-selected ref.ci-ready after it changes; the CI poller binds each cycle to current-accepted-event.js, validates approval attestations before CI inspection, after CI success, before recording CI-ready proof, and immediately before applying ci-ready; failures remove ci-pending and accepted, comment an invalid-approval message, and continue.ci-ready..github/workflows/auto-approve.yml now grants issues: write; after creating a sentry-internal-app token, it runs node src/publish/record-auto-approval-attestation.js with APPROVAL_TOKEN=${{ github.token }}, issue number/repository/title, and AUTO_APPROVER=${{ github.actor }}, posts steps.attestation.outputs.auto_approval_attestation as an issue comment using github.token, and only runs “Auto-approve if repo is in the list” if steps.attestation.outcome == 'success'..github/workflows/ci-poller.yml changes issues permission from read to write; parses titles through parsePublishTitle from ./src/modules/details-from-context.js, reconstructs repo as getsentry/ plus parsed .repo, and reads parsed .version, so CI polling and publishing use the same title parser.ci_ready_attestation using node src/publish/record-ci-ready-attestation.js, with expected accepted actor and event ID; it requires output prefix ci_ready_attestation=, posts the proof using ${{ github.token }}, and requires resulting CI-ready proof plus final revalidation before gh issue edit removes ci-pending and adds ci-ready..github/workflows/publish.yml waiting-for-ci job executes only for an accepted label on an open issue with title beginning publish: ; it checks out publish code using actions/checkout@v6 with persist-credentials: false, obtains internal-app and release-bot app tokens, and authorizes ${{ github.actor }} via node src/publish/authorize-approval.js using target-repository RBAC.authorized == 'true'; workflow posts approval_attestation with github.token; validate-approval-attestation.js must validate a comment authored by github-actions[bot]; otherwise “Reject invalid approval” removes accepted, posts “Approval is invalid or could not be verified. Re-add the accepted label to retry after resolving the issue.”, and exits 1.ci-failed and ci-ready and adding ci-pending, then comments either retry or approved/CI-check status; it best-effort enables CI_POLLER_HAS_PENDING=true using CI_POLLER_APP_CLIENT_ID/CI_POLLER_APP_PRIVATE_KEY, and triggers ci-poller.yml using the internal-app token because GITHUB_TOKEN-originated workflow_dispatch events are suppressed.ci-ready label event where labels include accepted and ci-ready and exclude ci-pending and ci-failed; timeout is 90 minutes. It initially validates a github-actions[bot] approval attestation with REQUIRE_CI_READY_ATTESTATION: "true" and removes accepted/fails if validation fails..__publish__ with persist-credentials: false, uses Node 24 and yarn install --cwd ".__publish__", parses issue inputs via src/publish/inputs.js, and conditionally checks out specific protected target branches for sentry-migr8/tmp-merge-target, sentry-javascript versions v10, v9, v8, v7, master, sentry-python/alpha, and sentry-wizard/1.x.$GITHUB_WORKSPACE/.craft-state/craft/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json; it hashes the canonical container cwd with sha1sum | cut -c1-12, sanitizes owner/repo/version to lowercase [a-z0-9._-], and sets XDG_STATE_HOME=/github/workspace/.craft-state to prevent target repo contents from pre-populating state.accepted, comments the invalid-approval message, and exits 1.docker://getsentry/craft:latest to immutable docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b; it runs craft publish from __repo__/${{ fromJSON(steps.inputs.outputs.result).path }} with the parsed version.src/modules/details-from-context.js adds and exports PUBLISH_TITLE_REGEX and parsePublishTitle(title): ^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$; detailsFromContext() now throws Invalid publish issue title: ${context.payload.issue.title} when parsing fails. Test coverage includes qualified publish: getsentry/sentry-javascript/packages/core@10.0.0 → {repo: "sentry-javascript", path: "/packages/core", version: "10.0.0"} and legacy publish: sentry-javascript@10.0.0 → {repo: "sentry-javascript", path: undefined, version: "10.0.0"}.trimRight() with trimEnd(); recorded existing commit 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012).src/modules/update-issue.js now tolerates unavailable publish inputs: updateIssue() invokes updateTargets() only when inputs?.version exists while always removing accepted; src/publish/update-issue.js parses PUBLISH_ARGS conditionally, warns Could not parse publish inputs; skipping target update on invalid JSON, catches top-level errors setting process.exitCode = 1, and exports main. Added test verifies undefined inputs do not check state file/get/update issue but call removeLabel for issue "211" in getsentry/publish.src/publish/inputs.js, post-result.js, post-workflow-details.js, src/modules/post-workflow-details.js, and src/modules/process-end-state.js; src/libs/github.js error formatting changed while preserving message text No "GITHUB_TOKEN" environment variable found. Please ensure the workflow is configured correctly, but the related test now expects only No "GITHUB_TOKEN" environment variable found..83d210b build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174); 5268a23 feat: Add Vercel creds; 92eba3f feat: Add CLOUDFLARE_API_TOKEN (#9122); ada6147 build(deps): bump js-yaml from 4.1.1 to 4.3.0 (#8731); a4f961a fix: Add GITHUB_API_TOKEN for commit-on-git target (#9069); bf10f82 build(deps): bump postcss from 8.5.15 to 8.5.23 (#9017); 837edc0 docs: fix possessive apostrophe placement (#9015); 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012); 22fd64d docs: fix typo 'acces' -> 'access' (#9011); 24b9ce3 docs: fix missing article in rfc.md (#9014).