Session 0znBJ2ZDBdIk

## main...origin/main
MM .github/workflows/auto-approve.yml
MM .github/workflows/ci-poller.yml
M  .github/workflows/cocoapods-keepalive.yml
MM .github/workflows/publish.yml
M  .github/workflows/test.yml
M  AGENTS.md
M  README.md
M  docs/key_rotation_vault_changes.md
M  docs/rfc.md
M  src/libs/__tests__/github.js
M  src/libs/github.js
 M src/modules/__tests__/ci-poller-input.js
 M src/modules/__tests__/ci-poller-workflow.js
MM src/modules/__tests__/details-from-context.js
 M src/modules/__tests__/process-end-state.js
 M src/modules/__tests__/publish-location.js
 M src/modules/__tests__/publish-workflow.js
 M src/modules/__tests__/release-revision.js
MM src/modules/__tests__/update-issue.js
 M src/modules/ci-poller-input.js
M  src/modules/details-from-context.js
M  src/modules/post-workflow-details.js
MM src/modules/process-end-state.js
 M src/modules/publish-location.js
 M src/modules/release-revision.js
 M src/modules/update-issue.js
 M src/publish/__tests__/discover-location.js
 M ...

a4cccb7ec721c017ed38b75686bea932b0e14c4c9298c240a9db9bd1c043fa11  -

7c60ddb7f43040fe8fbfea70efc833f689c04e75
7c60ddb7f43040fe8fbfea70efc833f689c04e75

<path>/home/byk/Code/getsentry/publish/src/modules/process-end-state.js</path>
<type>file</type>
<content>
1: const Sentry = require("@sentry/node");
2: 
3: async function processEndState({ context, octokit, inputs = {}, status }) {
4:   const { repo, version } = inputs;
5:   const { repo: publishRepo, runId: run_id } = context;
6:   const { number: issue_number } = context.payload.issue;
7: 
8:   // Validate the status before applying any terminal state transition.
9:   sentryInfoFromDetails({ status, repo });
10: 
11:   if (status === "success") {
12:     await octokit.rest.issues.update({
13:       ...publishRepo,
14:       issue_number,
15:       state: "closed",
16:     });
17:   }
18: 
19:   const workflowInfo = (
20:     await octokit.rest.actions.getWorkflowRun({
21:       ...publishRepo,
22:       run_id,
23:     })
24:   ).data;
25: 
26:   const details = {
27:     repo,
28:     version,
29:     publishRepo,
30:     run_id,
31:     issue_number,
32:     workflowInfo,
33:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/post-result.js</path>
<type>file</type>
<content>
1: const processEndState = require("../modules/process-end-state.js");
2: const { getGitHubToken } = require("../libs/github.js");
3: const github = require("@actions/github");
4: 
5: async function main({
6:   context = github.context,
7:   octokit = github.getOctokit(getGitHubToken()),
8:   report = processEndState,
9:   status = process.argv.slice(2)[0],
10: } = {}) {
11:   let inputs = {};
12: 
13:   if (process.env.PUBLISH_ARGS) {
14:     try {
15:       inputs = JSON.parse(process.env.PUBLISH_ARGS);
16:     } catch {
17:       console.warn("Could not parse publish inputs; reporting without them");
18:     }
19:   }
20: 
21:   await report({ context, octokit, inputs, status });
22: }
23: 
24: if (require.main === module) {
25:   main().catch((error) => {
26:     console.error(error);
27:     process.exitCode = 1;
28:   });
29: }
30: 
31: module.exports = { main };

(End of file - ...

<path>/home/byk/Code/getsentry/publish/src/publish/update-issue.js</path>
<type>file</type>
<content>
1: const { updateIssue } = require("../modules/update-issue.js");
2: const { getGitHubToken } = require("../libs/github");
3: const github = require("@actions/github");
4: 
5: async function main() {
6:   const context = github.context;
7:   const octokit = github.getOctokit(getGitHubToken());
8:   let inputs;
9: 
10:   if (process.env.PUBLISH_ARGS) {
11:     try {
12:       inputs = JSON.parse(process.env.PUBLISH_ARGS);
13:     } catch {
14:       console.warn("Could not parse publish inputs; skipping target update");
15:     }
16:   }
17: 
18:   await updateIssue({ context, octokit, inputs });
19: }
20: 
21: if (require.main === module) {
22:   main().catch((error) => {
23:     console.error(error);
24:     process.exitCode = 1;
25:   });
26: }
27: 
28: module.exports = { main };

(End of file - total 28 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/publish/post-workflow-details.js</path>
<type>file</type>
<content>
1: const postWorkflowDetails = require("../modules/post-workflow-details.js");
2: const { getGitHubToken } = require("../libs/github");
3: const github = require("@actions/github");
4: 
5: const context = github.context;
6: const octokit = github.getOctokit(getGitHubToken());
7: 
8: postWorkflowDetails({ context, octokit });

(End of file - total 8 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/modules/post-workflow-details.js</path>
<type>file</type>
<content>
1: async function postWorkflowDetails({ context, octokit }) {
2:   const { repo: publishRepo, runId: run_id } = context;
3:   const { number: issue_number } = context.payload.issue;
4: 
5:   const workflowInfo = (
6:     await octokit.rest.actions.getWorkflowRun({
7:       ...publishRepo,
8:       run_id,
9:     })
10:   ).data;
11: 
12:   return octokit.rest.issues.createComment({
13:     ...publishRepo,
14:     issue_number,
15:     body: `Publishing: [run#${run_id}](${workflowInfo.html_url})`,
16:   });
17: }
18: 
19: module.exports = postWorkflowDetails;

(End of file - total 19 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/publish.yml", "utf8");
5: 
6: describe("publish workflow", () => {
7:   test("binds approval and publication to the triggering issue snapshot", () => {
8:     expect(workflow).toContain("node src/publish/request-digest-from-event.js");
9:     expect(
10:       workflow.match(
11:         /EXPECTED_REQUEST_DIGEST: \$\{\{ steps\.request-digest\.outputs\.request_digest \}\}/g
12:       )
13:     ).toHaveLength(4);
14:   });
15: 
16:   test("revalidates approval immediately before Craft", () => {
17:     const fence = workflow.indexOf("Revalidate approval attestation");
18: 
19:     expect(fence).toBeGreaterThan(workflow.indexOf("Set targets"));
20:     expect(fence).toBeLessThan(workflow.indexOf("Publish using Craft"));
21:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/ci-poller.yml", "utf8");
5: const manualDispatchWorkflow = readFileSync(
6:   ".github/workflows/ci-poller-dispatch.yml",
7:   "utf8"
8: );
9: 
10: describe("CI poller workflow", () => {
11:   test("checks out trusted code before requesting app tokens", () => {
12:     expect(workflow).toMatch(
13:       /- name: Get publish code\n\s+uses: actions\/checkout@[a-f0-9]{40}\n\s+with:\n(?:\s+#.*\n)*\s+ref: \$\{\{ github\.event\.repository\.default_branch \}\}/
14:     );
15: 
16:     expect(workflow.indexOf("Get publish code")).toBeLessThan(
17:       workflow.indexOf("Get auth token")
18:     );
19:   });
20: 
21:   test("uses a protected workflow dispatch relay for manual recovery", () => {
22:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/workflow-action-pinning.js</path>
<type>file</type>
<content>
1: import { readFileSync, readdirSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflowPaths = readdirSync(".github/workflows")
5:   .filter((path) => path.endsWith(".yml"))
6:   .map((path) => `.github/workflows/${path}`);
7: const workflows = workflowPaths.map((path) => ({
8:   path,
9:   contents: readFileSync(path, "utf8"),
10: }));
11: const SECRET_BEARING_JOBS = {
12:   ".github/workflows/auto-approve.yml": ["auto-approve"],
13:   ".github/workflows/ci-poller.yml": ["check-ci"],
14:   ".github/workflows/cocoapods-keepalive.yml": ["keepalive"],
15:   ".github/workflows/publish.yml": ["waiting-for-ci", "publish"],
16: };
17: 
18: function jobContents(workflow, jobName) {
19:   const header = `  ${jobName}:`;
20:   const jobStart = workflow.indexOf(header);
21:   const nextJobOffset = workflow
22:     .slice(jobStart + ...

Found 18 matches
/home/byk/Code/getsentry/publish/.github/workflows/test.yml:
  Line 19:       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803

  Line 20:       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38

  Line 23:       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830


/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 36:         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803

  Line 42:         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1

  Line 56:         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1

  Line 167:         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1

  Line 220:         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

  Line 256:         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38

  Line 285:         uses: ...

Found 34 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 9:   group: ${{ github.event.issue.title }}

  Line 68:           APPROVAL_ISSUE_NUMBER: ${{ github.event.issue.number }}

  Line 70:           APPROVAL_ISSUE_TITLE: ${{ github.event.issue.title }}

  Line 82:           gh issue comment "${{ github.event.issue.number }}" \

  Line 93:           APPROVAL_ISSUE_NUMBER: ${{ github.event.issue.number }}

  Line 95:           APPROVAL_ISSUE_TITLE: ${{ github.event.issue.title }}

  Line 111:           gh issue edit "${{ github.event.issue.number }}" \

  Line 114:           gh issue comment "${{ github.event.issue.number }}" \

  Line 131:           gh issue edit "${{ github.event.issue.number }}" \

  Line 158:           gh issue comment "${{ github.event.issue.number }}" \

  Line 189:           gh issue edit "${{ github.event.issue.number }}" \

  Line 193:           gh issue comment "${{ github.event.issue.number }}" \

  Line 235:           ...

<path>/home/byk/Code/getsentry/publish/src/publish/discover-location.js</path>
<type>file</type>
<content>
1: const { execFileSync } = require("child_process");
2: const { existsSync } = require("fs");
3: const path = require("path");
4: 
5: const core = require("@actions/core");
6: 
7: const { resolvePublishLocation } = require("../modules/publish-location");
8: 
9: const CRAFT_IMAGE =
10:   "getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b";
11: 
12: function getWorkspaceNames({
13:   repositoryDirectory,
14:   exists = existsSync,
15:   execFile = execFileSync,
16: }) {
17:   if (!exists(path.join(repositoryDirectory, ".craft.yml"))) {
18:     return [];
19:   }
20: 
21:   const output = execFile(
22:     "docker",
23:     [
24:       "run",
25:       "--rm",
26:       "--volume",
27:       `${path.resolve(repositoryDirectory)}:/github/workspace/__repo__`,
28:       "--workdir",
29:       "/github/workspace/__repo__",
30:       ...

<path>/home/byk/Code/getsentry/publish/src/libs/github.js</path>
<type>file</type>
<content>
1: /**
2:  * This is a helper function that throws a useful error message if the
3:  * workflow environment is not configured correctly.
4:  *
5:  * @returns string
6:  */
7: function getGitHubToken() {
8:   if (!process.env.GITHUB_TOKEN) {
9:     throw new Error(
10:       'No "GITHUB_TOKEN" environment variable found. ' +
11:         "Please ensure the workflow is configured correctly"
12:     );
13:   }
14:   return process.env.GITHUB_TOKEN;
15: }
16: 
17: module.exports = {
18:   getGitHubToken,
19: };

(End of file - total 19 lines)
</content>

Found 16 matches
/home/byk/Code/getsentry/publish/src/modules/publish-issue-title.peggy:
  Line 38: ReleaseRevision

  Line 46:     Indent "- [View check runs](https://github.com/getsentry/" repo:Repository "/commit/" revision:CheckRunsRevision "/checks" "/"? ")" LineBoundary {

  Line 50: CheckRunsRevision

  Line 52:       return value.length === 40;


/home/byk/Code/getsentry/publish/src/modules/publish-issue-title.js:
  Line 61:     function hex(ch) {

  Line 73:         return s.replace(nonPrintable, (ch) => "\\u{" + hex(ch) + "}");

  Line 87:           .replace(/[\x00-\x0F]/g, (ch) => "\\x0" + hex(ch))

  Line 88:           .replace(/[\x10-\x1F\x7F-\x9F]/g, (ch) => "\\x" + hex(ch))

  Line 103:           .replace(/[\x00-\x0F]/g, (ch) => "\\x0" + hex(ch))

  Line 104:           .replace(/[\x10-\x1F\x7F-\x9F]/g, (ch) => "\\x" + hex(ch))

  Line 199:     ReleaseRevision: peg$parseReleaseRevision,

  Line 309:     return value.length === 40;

  Line 760:   function ...

<path>/home/byk/Code/getsentry/publish/src/modules/publish-issue-title.peggy</path>
<type>file</type>
<content>
1: {
2:   function join(characters) {
3:     return characters.join("");
4:   }
5: }
6: 
7: // BEGIN TITLE GRAMMAR
8: // Canonical grammar for publish issue titles. A path suffix is syntactic only:
9: // the controller resolves the complete suffix as a workspace after checking
10: // out the CI-approved revision.
11: PublishIssueTitle
12:   = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. {
13:       return {
14:         repo,
15:         path: path || "",
16:         version,
17:       };
18:     }
19: 
20: Repository
21:   = characters:RepositoryCharacter+ { return join(characters); }
22: 
23: RepositoryCharacter
24:   = [A-Za-z0-9_.-]
25: 
26: Path
27:   = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
28: 
29: PathSegment
30:   = characters:RepositoryCharacter+ { return join(characters); }
31: 
32: ...

...output truncated...

Full output saved to: /home/byk/.local/share/opencode/tool-output/tool_09fd9e735001RXVMdvDl4DuKz5

               echo "::warning::gh api failed: $output" >&2
               return $exit_code
             fi
             printf '%s' "$output"
           }
           # Only check issues that have BOTH ci-pending AND accepted labels.
           # This avoids polling for abandoned releases that nobody approved.
           issues=$(gh issue list -R "$GITHUB_REPOSITORY" \
             --state open \
             --label ci-pending \
             --label accepted \
             --limit 200 \
             --json number,title,labels,body)
 
           count=$(echo "$issues" | jq length)
           if [[ "$count" == "0" ]]; then
             echo "No ci-pending + accepted issues found."
             exit 0
           fi
           echo "Found ${count} ci-pending + accepted issue(s)."
 
           # Check each issue's CI status
           echo "$issues" | jq -c '.[]' | ...

<path>/home/byk/Code/getsentry/publish/README.md</path>
<type>file</type>
<content>
90: Packages we release into the wider world that our customers install, require an explicit approval. This for instance applies to
91: `sentry-cli`, our SDKs or the `symbolicator` distributed utilities. Internal dependencies such as `arroyo` can be published
92: with an auto approval. The reasoning here is that the bump of the dependency requires an explicit approval again in Sentry
93: proper. In theory if an independent package gets sufficient independent use of Sentry we might want to reconsider an auto
94: approval process for such package as it might become an interesting target for an attacker.
95: 
96: Automatic approvals are managed in the [`auto-approve.yml`](https://github.com/getsentry/publish/blob/main/.github/workflows/auto-approve.yml) workflow.
97: 
98: ## Under the hood
99: 
100: The system uses [Craft](https://github.com/getsentry/craft) under the hood to prepare and publish releases. ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-input.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { join } from "path";
3: 
4: import { expect, test } from "vitest";
5: 
6: const { getCiPollerInput } = require("../ci-poller-input.js");
7: const { requestDigest } = require("../approval-attestation.js");
8: 
9: const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
10: const labels = [{ name: "accepted" }, { name: "dry-run" }];
11: const issueBody = `Requested by: @byk
12: 
13: Merge target: (default)
14: 
15: Quick links:
16: - [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
17: - [View check runs](https://github.com/getsentry/toolkit/commit/${REVISION}/checks/)`;
18: 
19: test("parses root and full-path publish titles", () => {
20:   const rootTitle = "publish: getsentry/toolkit/cli@1.2.3";
21:   expect(
22:     getCiPollerInput({
23:       issueBody,
24:       labels,
25:       ...

Edit one or more issues within the same repository.

Editing issues' projects requires authorization with the `project` scope.
To authorize, run `gh auth refresh -s project`.

Use `--attach` to upload an image or video to a single issue. Without a body
flag the issue keeps the body it already has and the attachment is appended to it.
If the body references an attached file, such as `![alt](./login.png)`, that
reference is rewritten to point at the uploaded asset instead.
You can attach up to 50 files per command.

Alt text for an image follows the path after `#`, as in
`--attach './login.png#The login error state'`. Without it the filename is used.
A reference already in the body keeps the alt text written there. Video renders
as a player and has no alt text, so it cannot be given any.

If some attachments upload and others fail, the issue is still updated with the
ones that succeeded. The command then exits with a non-zero status, but the edited
issue URLs are still printed to ...