Distillation

Date: Aug 29, 2026

• 🟡 (13:13) src/modules/approval-authorizer.js defines ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]) and AUTO_APPROVER = "getsantry[bot]". authorizeApproval({ actor, issueTitle, getPermission, autoApprovedRepositories = new Set() }) parses issueTitle via parsePublishTitle(); malformed titles return { authorized: false, repository: null }.
• 🟡 (13:13) authorizeApproval() derives repository = \getsentry/${title.repo}`andreleasePath = `${repository}${title.path || ""}`. It authorizes getsantry[bot]only whenautoApprovedRepositories.has(releasePath)without callinggetPermission; otherwise the bot is rejected. Non-bot actors are checked through getPermission({ owner: "getsentry", repository: title.repo, username: actor })and authorized only for roles"write", "maintain", or "admin"`.
• 🟡 (13:13) src/modules/__tests__/approval-authorizer.js tests: allowlisted getsantry[bot] approval for getsentry/sentry-javascript with no target-repository permission lookup; bot rejection outside the allowlist; collaborator authorization for "write", "maintain", and "admin"; unqualified publish: sentry-javascript/packages/core@10.0.0 titles resolving to getsentry/sentry-javascript; rejection for "none", "read", "triage", "Elevated Bot", and undefined; malformed titles publish: @1.0.0 and publish: getsentry/sentry-javascript rejected without GitHub queries; and propagation of GitHub permission error "Not Found".
• 🟡 (13:13) src/modules/__tests__/approval-attestation.js verifies currentAcceptedEvent() selects the latest "accepted" label event, normalizes numeric GitHub event ID 29503999078 to string "29503999078", and requires CI-ready attestations to match both the current accepted event and the "ci-ready" label actor. It rejects attestations authored by an untrusted commenter, stale title/event combinations, and malformed <!-- publish-approval not-base64 --> data.
• 🟡 (13:13) src/publish/__tests__/authorize-approval.js verifies getAutoApprovedRepositories() loads exact allowlist paths getsentry/sentry-javascript and getsentry/objectstore/clients; successful authorization writes authorized=true and an <!-- publish-approval ... --> attestation; and a GitHub 404 permission response throws Could not retrieve contractor's permission for getsentry/sentry-javascript: GitHub returned 404 without writing GITHUB_OUTPUT.
• 🟡 (13:13) src/publish/__tests__/current-accepted-event.js verifies getCurrentAcceptedEvent() returns the latest accepted event { actor: "contractor", eventId: "200" } and throws "The issue has no current accepted label event" for an issue with no valid accepted-label events.
• 🟡 (13:13) src/publish/__tests__/record-ci-ready-attestation.js verifies recordCiReadyAttestation() binds accepted event { actor: "contractor", eventId: "100" }, title publish: getsentry/sentry-javascript@10.0.0, and authenticated actor "sentry-internal-app[bot]" into a CI-ready attestation. It rejects changed titles/no current accepted event and re-approval to event "200" when the poller expected event "100", with "The approval changed before CI could be marked ready".
• 🟡 (13:13) src/publish/__tests__/validate-approval-attestation.js verifies validation accepts a trusted current approval attestation, but rejects it after issue-title changes, removal of the "accepted" label, re-addition of "accepted" with a newer event, or a mismatch between expected accepted event "100" and current event "200". With requireCiReadyAttestation: true, it accepts only a CI-ready proof bound to current accepted event "100" and "sentry-internal-app[bot]"; it rejects a manually added "ci-ready" label by "contractor".
• 🔴 [enforced-workflow] (13:14) User directed: “Never move a release to ci-ready after it changes.”
• 🔴 [enforced-workflow] (13:14) User directed that a renamed or re-approved issue never reaches ci-ready.
• 🟡 (13:14) .github/workflows/ci-poller.yml changes issues permission from read to write, adds an actions/checkout@v6 “Get publish code” step with persist-credentials: false, and adds approval/attestation checks intended to remove "accepted" when approval cannot be bound, is invalid, or changes during CI; the workflow warns respectively that it could not bind an approval event or that approval changed during CI.
• 🟡 (13:14) The working tree contains modified .github/workflows/ci-poller.yml, .github/workflows/publish.yml, AGENTS.md, src/libs/__tests__/github.js, src/libs/github.js, src/modules/__tests__/details-from-context.js, src/modules/details-from-context.js, src/modules/post-workflow-details.js, src/modules/process-end-state.js, src/modules/update-issue.js, src/publish/inputs.js, src/publish/post-result.js, src/publish/post-workflow-details.js, and src/publish/update-issue.js.
• 🟡 (13:14) Newly untracked worktree artifacts are .lore.md, src/modules/__tests__/approval-attestation.js, src/modules/__tests__/approval-authorizer.js, src/modules/approval-attestation.js, src/modules/approval-authorizer.js, src/publish/__tests__/, src/publish/authorize-approval.js, src/publish/current-accepted-event.js, src/publish/record-ci-ready-attestation.js, and src/publish/validate-approval-attestation.js.