Distillation

Date: Aug 28, 2026

• 🟡 [requested-read-only-investigation] (09:49) User requested a read-only investigation in /home/byk/Code/getsentry/publish-workspace-acceptance; explicitly requested no file edits and no implementation.
• 🟡 (09:49) User asked for the exact smallest safe change to classify a compact single trailing title segment as a Craft workspace only after checkout of the CI-approved release revision; requested inspection of .github/workflows/publish.yml, ci-poller.yml, relevant JS inputs/parser/tests, exact approved-SHA acquisition without changing the issue body, needed workflow reordering, exact file:line ranges, concrete regression tests, and a concise adversarial design report with blockers.
• 🔴 (09:53) User stated repository agent guideline: always throw for unexpected values; example switch handles "failure", "cancelled", and "success", while default throws new Error(\Unknown status: '${status}'`)`.
• 🟡 (09:53) Repository guidance in AGENTS.md: project is the Sentry Publish Repository, a GitHub Actions approval system for multi-project Craft releases; pure CommonJS JavaScript on Node.js 24.0.0.
• 🟡 (09:53) Repository guidance in AGENTS.md: package manager is Yarn classic 1.22.22 via Volta; do not use npm. Commands: yarn install, yarn test, yarn test:watch, yarn test src/modules/__tests__/update-issue.js, yarn test -t "pattern", yarn lint, and yarn prettier.
• 🟡 (09:53) Repository structure documented in AGENTS.md: src/libs/ shared utilities, src/modules/ reusable core business logic, and src/publish/ GitHub Actions entry points.
• 🟡 (09:53) Repository coding conventions in AGENTS.md: kebab-case filenames; tests in __tests__/ matching source names; camelCase variables/functions; UPPER_SNAKE_CASE constants/regexes; CommonJS source and ESM tests; import order Node built-ins → external packages → local modules; Prettier defaults, double-quoted strings, semicolons, and run yarn prettier before commits.
• 🟡 (09:53) Repository testing guidance in AGENTS.md: Vitest v4.0.0 with globals enabled and auto-cleared mocks; mock external modules before requiring the module under test.
• 🟡 (09:53) Repository dependencies documented in AGENTS.md: @actions/core, @actions/github, and @sentry/node; issue-based workflows are triggered by labels and comments; code ownership is @getsentry/releng.
• 🟡 (09:53) Two attempted file lookups returned “No files found.”
• 🟡 (09:55) Repository .github/ contains CODEOWNERS and workflows/; .github/workflows/ contains auto-approve.yml, ci-poller.yml, cocoapods-keepalive.yml, publish.yml, and test.yml.
• 🟡 (09:56) Repository src/ contains libs/, modules/, and publish/.
• 🟡 (09:57) Enumerated relevant files: src/publish/update-issue.js, src/publish/post-workflow-details.js, src/publish/post-result.js, src/publish/inputs.js, src/modules/update-issue.js, src/modules/process-end-state.js, src/modules/post-workflow-details.js, src/modules/details-from-context.js, src/modules/__tests__/publish-workflow.js, src/modules/__tests__/update-issue.js, src/modules/__tests__/process-end-state.js, src/modules/__tests__/post-workflow-details.js, src/modules/__tests__/details-from-context.js, src/libs/github.js, and src/libs/__tests__/github.js.
• 🔴 (09:58) User stated ci-poller.yml always adds ci-ready.
• 🟡 (09:58) Partial publish.yml evidence: waiting-for-ci applies when an open issue title starts with publish: ; comments say it adds ci-pending and removes ci-failed on retry, comments that the poller always adds ci-ready, and a publish job is named “Publish a new version.” The workflow uses actions/checkout with fetch-depth: 0, src/publish/inputs.js output (steps.inputs.outputs.result), CRAFT_PUBLISH_REPO: ${{ fromJSON(steps.inputs.outputs.result).repo }}, and CRAFT_PUBLISH_WORKSPACE for Craft state handling.
• 🔴 (09:59) User stated: “Always allow workflow_dispatch for manual recovery.”
• 🟡 (09:59) Partial ci-poller.yml evidence: scheduled every 5 minutes (cron: "*/5 * * * *"); check-ci concurrency group is ci-status-poller; it considers only issues with both ci-pending and accepted; queries up to 200 issues; parses repo from title with sed -n 's|^publish: \([^/]*/[^/@]*\).*@.*|\1|p'; resolves/checks a commit SHA with GitHub APIs repos/${repo}/commits/${sha}/status and paginated check runs; CI success adds ci-ready; failures remove/retry-gate labels and require the author to fix CI and re-add accepted; retry limit is 60.
• 🟡 (10:00) src/publish/inputs.js:1-13 imports @actions/github, @actions/core, and detailsFromContext from ../modules/details-from-context; inputs() calls detailsFromContext({ context: github.context }) and emits its result through core.setOutput('result', result).
• 🟡 (10:01) src/modules/details-from-context.js:24-25 parses publish titles with titleParser: ^publish: (?:getsentry\/)?(?<repo>[A-Za-z0-9_.-]+)(?<path>\/[\w./-]+)?(?: \[workspace: (?<workspace>"(?:[^"\\]|\\.)*")\] )?@(?<version>[\w.+-]+)$; workspace is optional only in explicit [workspace: "<JSON string>"] syntax before @version.
• 🟡 (10:01) src/modules/details-from-context.js:26-30 throws Invalid publish issue title: '<title>' when the issue title fails parsing.
• 🟡 (10:01) src/modules/details-from-context.js:32-47 JSON-parses an explicit workspace, throws Invalid publish workspace JSON in title: '<title>' for invalid JSON, and rejects empty workspace names or names containing Unicode control (\p{Cc}), format (\p{Cf}), line separator (\p{Zl}), or paragraph separator (\p{Zp}) characters with Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters.
• 🟡 (10:01) src/modules/details-from-context.js:48-53 sets dry_run to "1" only when an issue label has name === "dry-run"; derives path as "." + (titleDetails.path || ""); rejects paths whose slash-separated components include ".." with Invalid publish issue path: '<path>'.
• 🟡 (10:01) src/modules/details-from-context.js:56-80 optionally extracts merge_target from body line Merge target: (?<merge_target>[\w.\-/]+); extracts checked targets from a Targets section; returns repo, version, optional title path, dry_run, merge_target, path, targets, and includes workspace only when nonempty.
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:37-47 verifies legacy title publish: getsentry/sentry@21.3.1 produces { dry_run: "", merge_target: "custom-branch", path: ".", repo: "sentry", targets: ["github", "npm[@sentry/node]", "docker[latest]"], version: "21.3.1" }.
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:49-64 verifies version 4.2.6+sentry1 parses from publish: getsentry/sentry-forked-django-stubs@4.2.6+sentry1.
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:92-102 verifies Merge target: (default) yields merge_target: "".
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:104-123 verifies explicit human-readable workspace title publish: getsentry/toolkit [workspace: "cli/v2"] @1.2.3 parses workspace: "cli/v2".
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:126-143 verifies escaped explicit workspace title publish: getsentry/toolkit [workspace: "cli [preview] \\"next\\""] @1.2.3 parses workspace: 'cli [preview] "next"'.
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:145-162 verifies Unicode workspace cli-日本語 parses successfully.
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:164-179 verifies legacy-looking title publish: getsentry/toolkit @1.2.3 is rejected as Invalid publish issue title.
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:181-197 verifies invalid JSON escape in workspace cli\\qnext is rejected with Invalid publish workspace JSON in title.
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:199-311 verifies explicit workspaces are rejected when empty or when decoding to newline, NUL, tab, bidi \u202e, line separator \u2028, or paragraph separator \u2029.
• 🟡 (10:02) src/modules/__tests__/details-from-context.js:313-328 verifies publish: getsentry/toolkit/../other@1.2.3 is rejected as Invalid publish issue path; lines 330-333 verify missing context.payload.issue throws Issue context is not defined.