Session 11zPXPpYfE8Q

<path>/home/byk/Code/getsentry/publish</path>
<type>directory</type>
<entries>
.eslintrc.js
.git/
.github/
.gitignore
.lore.md
AGENTS.md
auto-approve-repos.txt
docs/
LICENSE
node_modules/
package.json
README.md
src/
vitest.config.js
yarn.lock

(15 entries)
</entries>

 M .github/workflows/publish.yml
 M AGENTS.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .lore.md
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? src/publish/authorize-approval.js
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cff6bc3..081a17b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,6 +32,11 @@ jobs:
       && github.event.issue.state == 'open'
       && startsWith(github.event.issue.title, 'publish: ')
     steps:
+      - name: Get publish code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       - name: Get auth token
         id: token
         uses: ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

 .github/workflows/publish.yml        | 40 ++++++++++++++++++++++++++++++++++++
 AGENTS.md                            |  6 ++++++
 src/libs/__tests__/github.js         |  2 +-
 src/libs/github.js                   |  6 ++++--
 src/modules/post-workflow-details.js |  4 ++--
 src/modules/process-end-state.js     |  4 ++--
 src/modules/update-issue.js          | 35 +++++++++++++++----------------
 src/publish/inputs.js                | 17 ++++++++-------
 src/publish/post-result.js           |  8 ++++----
 src/publish/post-workflow-details.js |  8 ++++----
 src/publish/update-issue.js          |  6 +++---
 11 files changed, 91 insertions(+), 45 deletions(-)
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cff6bc3..081a17b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,6 +32,11 @@ jobs:
       && github.event.issue.state == 'open'
       && startsWith(github.event.issue.title, 'publish: ')
     steps:
+      - name: ...

<path>/home/byk/Code/getsentry/publish/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: /**
2:  * Matches the entire "Targets" section of a github publish issue body.
3:  */
4: const TARGETS_SECTION_PARSER_REGEX =
5:   /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
6: 
7: /**
8:  * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
9:  * The "id" of the targets is captured within a capture group.
10:  */
11: const TARGETS_PARSER_REGEX = /^\s*- \[[ x]\] (\S+)/gim;
12: 
13: /**
14:  * Matches checked targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
15:  * The "id" of the targets is captured within a capture group.
16:  */
17: const CHECKED_TARGETS_PARSER_REGEX = /^\s*- \[x\] (\S+)/gim;
18: 
19: async function detailsFromContext({ context }) {
20:   if (!context || !context.payload || ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   workflow_dispatch:
7:     inputs:
8:       attempt:
9:         description: Self-dispatch attempt counter (internal use)
10:         required: false
11:         default: "0"
12: 
13: permissions:
14:   contents: read
15:   issues: read
16: 
17: jobs:
18:   check-ci:
19:     runs-on: ubuntu-latest
20:     environment: production
21:     # Skip entirely (no runner provisioned) when there's nothing to check.
22:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
23:     # Always allow workflow_dispatch for manual recovery.
24:     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
25:     concurrency:
26:       group: ci-status-poller
27:       cancel-in-progress: false
28:     steps:
29:       # sentry-internal-app token for label changes on ...

# Repository roles for an organization

You can customize access to each repository in your organization by assigning granular roles, giving people access to the features and tasks they need.

## Repository roles for organizations

You can give organization members, outside collaborators, and teams of people different levels of access to repositories owned by an organization by assigning them to roles. Choose the role that best fits each person or team's function in your project without giving people more access to the project than they need. ...

Found 53 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 18:   # When accepted is added to a publish issue:

  Line 19:   #   - Add ci-pending (and remove ci-failed if retrying)

  Line 23:   # The publish job below requires ci-ready, so it will not fire until the

  Line 24:   # poller flips ci-pending → ci-ready (which also prevents publishing without

  Line 25:   # CI verification in the auto-approve race).

  Line 31:       github.event.label.name == 'accepted'

  Line 76:             --remove-label "accepted"

  Line 82:       # Reset to a clean ci-pending state:

  Line 84:       # - Remove ci-ready (retries after a publish failure — if we leave

  Line 85:       #   ci-ready, the poller's later --add-label won't generate a

  Line 87:       # - Add ci-pending

  Line 90:       - name: Mark ci-pending

  Line 97:             --remove-label "ci-ready" \

  Line 98:             --add-label "ci-pending"

  Line 142:     # Publish when ci-ready is ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

yarn run v1.22.22
$ vitest run src/modules/__tests__/approval-authorizer.js src/publish/__tests__/authorize-approval.js

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/authorize-approval.js (3 tests) 14ms
 ✓ src/modules/__tests__/approval-authorizer.js (14 tests) 20ms

 Test Files  2 passed (2)
      Tests  17 passed (17)
   Start at  15:55:28
   Duration  334ms (transform 57ms, setup 0ms, import 141ms, tests 33ms, environment 0ms)

Done in 0.84s.

<path>/home/byk/Code/getsentry/publish/auto-approve-repos.txt</path>
<type>file</type>
<content>
1: getsentry/arroyo
2: getsentry/auto-type-annotate
3: getsentry/devenv
4: getsentry/infra-event-notifier
5: getsentry/jest-sentry-environment
6: getsentry/json-schema-diff
7: getsentry/js-source-scopes
8: getsentry/objectstore/clients
9: getsentry/ophio
10: getsentry/pdb
11: getsentry/pyo3-python-tracing-subscriber
12: getsentry/pytest-sentry
13: getsentry/relay/py
14: getsentry/responses
15: getsentry/rust-proguard
16: getsentry/rust-sourcemap
17: getsentry/rust-usage-accountant
18: getsentry/script-runner
19: getsentry/sentry-api-schema
20: getsentry/sentry-forked-djangorestframework-stubs
21: getsentry/sentry-forked-django-stubs
22: getsentry/sentry-forked-jsonnet
23: getsentry/sentry-infra-tools
24: getsentry/sentry-kafka-management
25: getsentry/sentry-kafka-schemas
26: getsentry/sentry-protos
27: getsentry/sentry-redis-tools
28: getsentry/service-registry
29: getsentry/skrooge
30: ...

Found 56 matches
/home/byk/Code/getsentry/publish/.lore.md:
  Line 13: * **approval-authorizer legacy titles**: Trap: requiring only \`publish: getsentry/repo@version\` looks safer, but Publish accepts legacy unqualified titles such as \`publish: sentry@version\`, including valid release paths. Fix: use Publish’s exact title grammar for authorization, map qualified and unqualified forms to the \`getsentry\` owner, and reject malformed or unsupported titles before querying GitHub. A broader authorization regex looks flexible, but it can authorize an issue Publish later cannot parse.

  Line 16: * **auto-approve.yml label actor**: Trap: creating an internal-app token to add \`accepted\` looks appropriate because it has label permission, but GitHub records the app as the label-event actor rather than \`getsantry\[bot]\`. An approval gate that authorizes \`github.actor\` can reject legitimate allowlisted automation or check the app’s target-repository role instead. ...

yarn run v1.22.22
$ vitest run

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/modules/__tests__/update-issue.js (5 tests) 13ms
 ✓ src/modules/__tests__/post-workflow-details.js (1 test) 19ms
 ✓ src/modules/__tests__/approval-authorizer.js (14 tests) 33ms
 ✓ src/publish/__tests__/authorize-approval.js (3 tests) 14ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 61ms
 ✓ src/modules/__tests__/details-from-context.js (4 tests) 9ms
 ✓ src/libs/__tests__/github.js (2 tests) 6ms

 Test Files  7 passed (7)
    ...

# REST API endpoints for collaborators

Use the REST API to manage collaborators for a repository.

> [!NOTE]
> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity.

## List repository collaborators

```
GET /repos/{owner}/{repo}/collaborators
```

For organization-owned repositories, the list of collaborators includes outside collaborators, organization members that are direct collaborators, organization members with access through team memberships, organization members with access through default organization permissions, and organization owners.
The permissions hash returned in the response contains the base role permissions of the collaborator. The role_name is the highest role assigned to the collaborator after considering all sources of grants, including: repo, teams, organization, and enterprise. ...