Session 15DLBkeeMQ5M

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

<path>/home/byk/Code/getsentry/publish/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require("@actions/github");
2: const core = require("@actions/core");
3: const { detailsFromContext } = require("../modules/details-from-context");
4: 
5: async function inputs() {
6:   const result = await detailsFromContext({
7:     context: github.context,
8:   });
9:   core.setOutput("result", result);
10: }
11: 
12: inputs();

(End of file - total 12 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { parsePublishTitle } = require("./details-from-context.js");
4: 
5: async function authorizeApproval({
6:   actor,
7:   issueTitle,
8:   getPermission,
9:   autoApprovedRepositories = new Set(),
10: }) {
11:   const title = parsePublishTitle(issueTitle);
12: 
13:   if (!title) {
14:     return { authorized: false, repository: null };
15:   }
16: 
17:   const repository = `getsentry/${title.repo}`;
18:   const releasePath = `${repository}${title.path || ""}`;
19: 
20:   if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21:     return { authorized: true, repository };
22:   }
23: 
24:   if (actor === AUTO_APPROVER) {
25:     return { authorized: false, repository };
26:   }
27: 
28:   const { role_name } = await getPermission({
29:  ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   workflow_dispatch:
7:     inputs:
8:       attempt:
9:         description: Self-dispatch attempt counter (internal use)
10:         required: false
11:         default: "0"
12: 
13: permissions:
14:   contents: read
15:   issues: write
16: 
17: jobs:
18:   check-ci:
19:     runs-on: ubuntu-latest
20:     environment: production
21:     # Skip entirely (no runner provisioned) when there's nothing to check.
22:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
23:     # Always allow workflow_dispatch for manual recovery.
24:     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
25:     concurrency:
26:       group: ci-status-poller
27:       cancel-in-progress: false
28:     steps:
29:       - name: Get publish code
30:         uses: ...

<path>/home/byk/Code/getsentry/publish/src/publish/update-issue.js</path>
<type>file</type>
<content>
1: const { updateIssue } = require("../modules/update-issue.js");
2: const { getGitHubToken } = require("../libs/github");
3: const github = require("@actions/github");
4: 
5: const context = github.context;
6: const octokit = github.getOctokit(getGitHubToken());
7: const inputs = JSON.parse(process.env.PUBLISH_ARGS);
8: 
9: updateIssue({ context, octokit, inputs });

(End of file - total 9 lines)
</content>

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
169:   publish:
170:     runs-on: ubuntu-latest
171:     environment: production
172:     name: Publish a new version
173:     # Publish when ci-ready is present (added by the poller after CI passes).
174:     # Fires ONLY on ci-ready label events — not accepted — to avoid racing
175:     # with waiting-for-ci on the same event. The poller always adds ci-ready
176:     # after checking CI (even if ci-ready was already present, waiting-for-ci
177:     # removes it first so a fresh labeled event fires), so this gate is
178:     # guaranteed to trigger on the happy path.
179:     if: >-
180:       github.event.issue.state == 'open'
181:       && github.event.label.name == 'ci-ready'
182:       && contains(github.event.issue.labels.*.name, 'accepted')
183:       && contains(github.event.issue.labels.*.name, 'ci-ready')
184:       && !contains(github.event.issue.labels.*.name, ...

No files found

/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js
/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js
/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js
/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js
/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js
/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8:   createCiReadyAttestation,
9: } = require("../../modules/approval-attestation.js");
10: 
11: afterEach(() => {
12:   vi.restoreAllMocks();
13: });
14: 
15: function jsonResponse(json) {
16:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
17: }
18: 
19: describe("validateApprovalAttestation", () => {
20:   test("accepts the current accepted event and its trusted attestation", async () => {
21:     const title = "publish: getsentry/sentry-javascript@10.0.0";
22:     const attestation = createApprovalAttestation({
23:       actor: "contractor",
24:       eventId: "100",
25:       title,
26:     });
27:     global.fetch = vi
28:       ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   getAutoApprovedRepositories,
5:   main,
6: } = require("../authorize-approval.js");
7: 
8: const originalEnvironment = { ...process.env };
9: 
10: afterEach(() => {
11:   process.env = { ...originalEnvironment };
12:   vi.restoreAllMocks();
13:   vi.resetModules();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: async function runAuthorization({ actor, issueTitle, responses }) {
21:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
22:   process.env.APPROVAL_TOKEN = "release-bot-token";
23:   process.env.APPROVAL_ACTOR = actor;
24:   process.env.APPROVAL_ISSUE_NUMBER = "123";
25:   process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26:   process.env.APPROVAL_ISSUE_TITLE = ...

/home/byk/Code/getsentry/publish/src/publish/current-accepted-event.js
/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js
/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/current-accepted-event.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js
/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js
/home/byk/Code/getsentry/publish/src/publish/update-issue.js
/home/byk/Code/getsentry/publish/src/publish/post-workflow-details.js
/home/byk/Code/getsentry/publish/src/publish/post-result.js
/home/byk/Code/getsentry/publish/src/publish/inputs.js

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordCiReadyAttestation,
8: } = require("../record-ci-ready-attestation.js");
9: 
10: describe("recordCiReadyAttestation", () => {
11:   test("binds the current approval to the app that will add ci-ready", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordCiReadyAttestation({
16:         getAuthenticatedLogin: vi
17:           .fn()
18:           .mockResolvedValue("sentry-internal-app[bot]"),
19:         getIssue: vi.fn().mockResolvedValue({
20:           labels: [{ name: "accepted" }],
21:           title,
22:         }),
23:         getIssueEvents: vi.fn().mockResolvedValue([
24:           {
25:             ...

 M .github/workflows/ci-poller.yml
 M .github/workflows/publish.yml
 M AGENTS.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/__tests__/details-from-context.js
 M src/modules/details-from-context.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? src/publish/authorize-approval.js
?? src/publish/current-accepted-event.js
?? src/publish/record-ci-ready-attestation.js
?? src/publish/validate-approval-attestation.js
 .github/workflows/ci-poller.yml               | 140 ++++++++++++++++++++++++--
 .github/workflows/publish.yml                 |  97 ++++++++++++++++++
 ...

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/modules/update-issue.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   TARGETS_SECTION_PARSER_REGEX,
4:   TARGETS_PARSER_REGEX,
5: } = require("./details-from-context");
6: 
7: async function updateTargets({ octokit, version, publishRepo, issue_number }) {
8:   const CRAFT_STATE_FILE_PATH = `${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json`;
9: 
10:   if (!fs.existsSync(CRAFT_STATE_FILE_PATH)) {
11:     return;
12:   }
13: 
14:   const issueRequest = octokit.rest.issues.get({
15:     ...publishRepo,
16:     issue_number,
17:   });
18: 
19:   const craftStateRequest = fs.promises
20:     .readFile(CRAFT_STATE_FILE_PATH, { encoding: "utf-8" })
21:     .then((data) => JSON.parse(data));
22: 
23:   const [{ data: issue }, craftState] = await Promise.all([
24:     issueRequest,
25:     craftStateRequest,
26:   ]);
27: 
28:   const newIssueBody = transformIssueBody(craftState, issue.body);
29: ...

No files found

Success. Updated the following files:
M src/publish/__tests__/validate-approval-attestation.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/validate-approval-attestation.js --runInBand --printConsoleTrace
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
file:///home/byk/Code/getsentry/publish/node_modules/vitest/dist/chunks/cac.jRCLJDDc.js:404
          throw new CACError(`Unknown option \`${name.length > 1 ? `--${name}` : `-${name}`}\``);
                ^

CACError: Unknown option `--runInBand`
    at Command.checkUnknownOptions (file:///home/byk/Code/getsentry/publish/node_modules/vitest/dist/chunks/cac.jRCLJDDc.js:404:17)
    at CAC.runMatchedCommand (file:///home/byk/Code/getsentry/publish/node_modules/vitest/dist/chunks/cac.jRCLJDDc.js:604:13)
    at CAC.parse (file:///home/byk/Code/getsentry/publish/node_modules/vitest/dist/chunks/cac.jRCLJDDc.js:545:12)
    at file:///home/byk/Code/getsentry/publish/node_modules/vitest/dist/cli.js:28:13
    at ModuleJob.run (node:internal/modules/esm/module_job:303:25)
    at async ...

yarn run v1.22.22
$ vitest run src/publish/__tests__/validate-approval-attestation.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/validate-approval-attestation.js (8 tests | 1 failed) 49ms
     ✓ accepts the current accepted event and its trusted attestation 4ms
     ✓ rejects an attestation after the issue title changes 1ms
     × rejects an attestation after the issue body changes 13ms
     ✓ rejects an attestation when accepted was removed 6ms
     ✓ rejects an attestation after accepted is re-added 20ms
     ✓ rejects a later attested approval when an earlier event was checked 1ms
     ✓ requires a CI-ready proof tied to the ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/update-issue.js</path>
<type>file</type>
<content>
1: import { vi, describe, test, expect, beforeAll, beforeEach, it } from "vitest";
2: import fs from "fs";
3: 
4: const { updateIssue, transformIssueBody } = require("../update-issue.js");
5: 
6: let mockExistsSync;
7: 
8: const updateTargetsArgs = {
9:   inputs: { repo: "sentry", version: "21.3.1" },
10:   context: {
11:     runId: "1234",
12:     repo: { owner: "getsentry", repo: "publish" },
13:     payload: { issue: { number: "211" } },
14:   },
15:   octokit: {
16:     rest: {
17:       actions: {
18:         getWorkflowRun: async () => ({
19:           data: {
20:             html_url: "https://github.com/getsentry/sentry/actions/runs/1234",
21:           },
22:         }),
23:       },
24:       issues: {
25:         get: vi.fn(),
26:         update: vi.fn(),
27:         removeLabel: vi.fn(),
28:       },
29:     },
30:   },
31:   Sentry: {
32:     Scope: class Scope ...

<path>/home/byk/Code/getsentry/publish/package.json</path>
<type>file</type>
<content>
1: {
2:   "name": "publish",
3:   "private": true,
4:   "version": "0.0.1",
5:   "description": "Approval-based publishing system for Sentry",
6:   "main": "index.js",
7:   "repository": "git@github.com:getsentry/publish.git",
8:   "author": "Sentry Open Source <oss@sentry.io>",
9:   "license": "Apache-2.0",
10:   "volta": {
11:     "node": "24.0.0",
12:     "yarn": "1.22.22"
13:   },
14:   "resolutions": {
15:     "undici": "^6.23.0"
16:   },
17:   "scripts": {
18:     "test": "vitest run",
19:     "test:watch": "vitest",
20:     "lint": "eslint src .github --ignore-pattern '!.github'",
21:     "prettier": "prettier --write src"
22:   },
23:   "devDependencies": {
24:     "eslint": "^8.9.0",
25:     "eslint-config-prettier": "^8.3.0",
26:     "eslint-plugin-yml": "^0.13.0",
27:     "prettier": "^2.2.1",
28:     "vitest": "^4.1.0"
29:   },
30:   "dependencies": {
31:     "@actions/core": ...

Found 10 matches
/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js:
  Line 55: async function validateApprovalAttestation({

  Line 115:   const valid = await validateApprovalAttestation({


/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js:
  Line 49:       validateApprovalAttestation({

  Line 88:       validateApprovalAttestation({

  Line 130:       validateApprovalAttestation({

  Line 166:       validateApprovalAttestation({

  Line 210:       validateApprovalAttestation({

  Line 254:       validateApprovalAttestation({

  Line 315:       validateApprovalAttestation({

  Line 376:       validateApprovalAttestation({

<path>/home/byk/Code/getsentry/publish/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require("@actions/github");
2: const core = require("@actions/core");
3: const { detailsFromContext } = require("../modules/details-from-context");
4: 
5: async function inputs() {
6:   const result = await detailsFromContext({
7:     context: github.context,
8:   });
9:   core.setOutput("result", result);
10: }
11: 
12: inputs();

(End of file - total 12 lines)
</content>

No files found

<path>/home/byk/Code/getsentry/publish/src/publish/current-accepted-event.js</path>
<type>file</type>
<content>
1: const { currentAcceptedEvent } = require("../modules/approval-attestation.js");
2: const { getAllPages } = require("./validate-approval-attestation.js");
3: 
4: async function getCurrentAcceptedEvent({
5:   getIssueEvents,
6:   issueNumber,
7:   repository,
8: }) {
9:   const event = currentAcceptedEvent(
10:     await getIssueEvents({ repository, issueNumber })
11:   );
12: 
13:   if (!event) {
14:     throw new Error("The issue has no current accepted label event");
15:   }
16: 
17:   return event;
18: }
19: 
20: async function main() {
21:   for (const name of [
22:     "APPROVAL_TOKEN",
23:     "APPROVAL_ISSUE_NUMBER",
24:     "APPROVAL_ISSUE_REPOSITORY",
25:   ]) {
26:     if (!process.env[name]) {
27:       throw new Error(`No "${name}" environment variable found`);
28:     }
29:   }
30: 
31:   const event = await getCurrentAcceptedEvent({
32:     getIssueEvents: ({ ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const { authorizeApproval } = require("../approval-authorizer.js");
4: 
5: const issueTitle = "publish: getsentry/sentry-javascript@10.0.0";
6: 
7: describe("authorizeApproval", () => {
8:   test("allows the auto-approval bot for an allowlisted release without a target repository lookup", async () => {
9:     const getPermission = vi.fn();
10: 
11:     await expect(
12:       authorizeApproval({
13:         actor: "getsantry[bot]",
14:         issueTitle,
15:         getPermission,
16:         autoApprovedRepositories: new Set(["getsentry/sentry-javascript"]),
17:       })
18:     ).resolves.toEqual({
19:       authorized: true,
20:       repository: "getsentry/sentry-javascript",
21:     });
22: 
23:     expect(getPermission).not.toHaveBeenCalled();
24:   });
25: 
26:   test("rejects the auto-approval bot ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
2: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
3: const ATTESTATION_SUFFIX = " -->";
4: 
5: function createAttestation(prefix, value) {
6:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
7:     "base64url"
8:   )}${ATTESTATION_SUFFIX}`;
9: }
10: 
11: function createApprovalAttestation({ actor, eventId, title }) {
12:   return createAttestation(APPROVAL_ATTESTATION_PREFIX, {
13:     actor,
14:     eventId: String(eventId),
15:     title,
16:   });
17: }
18: 
19: function createCiReadyAttestation({ acceptedEvent, ciReadyActor, title }) {
20:   return createAttestation(CI_READY_ATTESTATION_PREFIX, {
21:     acceptedActor: acceptedEvent.actor,
22:     acceptedEventId: String(acceptedEvent.eventId),
23:     ciReadyActor,
24:     title,
25:   });
26: }
27: 
28: function ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
150:         with:
151:           client-id: ${{ vars.CI_POLLER_APP_CLIENT_ID }}
152:           private-key: ${{ secrets.CI_POLLER_APP_PRIVATE_KEY }}
153: 
154:       - name: Enable cron poller
155:         if: steps.poller-token.outcome == 'success'
156:         env:
157:           GH_TOKEN: ${{ steps.poller-token.outputs.token }}
158:         run: |
159:           gh variable set CI_POLLER_HAS_PENDING -R "$GITHUB_REPOSITORY" -b "true"
160: 
161:       # Trigger the CI poller immediately instead of waiting for the next cron tick.
162:       # Uses the app token — GITHUB_TOKEN workflow_dispatch events are suppressed.
163:       - name: Trigger CI poller
164:         env:
165:           GH_TOKEN: ${{ steps.token.outputs.token }}
166:         run: |
167:           gh workflow run ci-poller.yml -R "$GITHUB_REPOSITORY"
168: 
169:   publish:
170:     runs-on: ubuntu-latest
171:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   workflow_dispatch:
7:     inputs:
8:       attempt:
9:         description: Self-dispatch attempt counter (internal use)
10:         required: false
11:         default: "0"
12: 
13: permissions:
14:   contents: read
15:   issues: write
16: 
17: jobs:
18:   check-ci:
19:     runs-on: ubuntu-latest
20:     environment: production
21:     # Skip entirely (no runner provisioned) when there's nothing to check.
22:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
23:     # Always allow workflow_dispatch for manual recovery.
24:     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
25:     concurrency:
26:       group: ci-status-poller
27:       cancel-in-progress: false
28:     steps:
29:       - name: Get publish code
30:         uses: ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createCiReadyAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const {
7:   getAllPages,
8:   getGitHubResponse,
9:   getIssue,
10: } = require("./validate-approval-attestation.js");
11: 
12: async function getAuthenticatedLogin() {
13:   const response = await getGitHubResponse("user");
14: 
15:   if (!response.ok) {
16:     throw new Error(
17:       `Could not retrieve the authenticated user: GitHub returned ${response.status}`
18:     );
19:   }
20: 
21:   const { login } = await response.json();
22: 
23:   if (typeof login !== "string") {
24:     throw new Error("GitHub returned no authenticated user login");
25:   }
26: 
27:   return login;
28: }
29: 
30: async function recordCiReadyAttestation({
31:   expectedAcceptedEvent,
32:   getAuthenticatedLogin,
33:   getIssue,
34:  ...

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: /**
2:  * Matches the entire "Targets" section of a github publish issue body.
3:  */
4: const TARGETS_SECTION_PARSER_REGEX =
5:   /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
6: 
7: /**
8:  * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
9:  * The "id" of the targets is captured within a capture group.
10:  */
11: const TARGETS_PARSER_REGEX = /^\s*- \[[ x]\] (\S+)/gim;
12: 
13: /**
14:  * Matches checked targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
15:  * The "id" of the targets is captured within a capture group.
16:  */
17: const CHECKED_TARGETS_PARSER_REGEX = /^\s*- \[x\] (\S+)/gim;
18: const PUBLISH_TITLE_REGEX =
19:   /^publish: ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test } from "vitest";
2: 
3: const {
4:   createApprovalAttestation,
5:   createCiReadyAttestation,
6:   currentAcceptedEvent,
7:   hasApprovalAttestation,
8:   hasCiReadyAttestation,
9:   parseApprovalAttestation,
10: } = require("../approval-attestation.js");
11: 
12: describe("approval attestations", () => {
13:   test("matches the latest accepted event to a trusted attestation", () => {
14:     const attestation = createApprovalAttestation({
15:       actor: "contractor",
16:       eventId: "200",
17:       title: "publish: getsentry/relay/py@1.2.3",
18:     });
19:     const event = currentAcceptedEvent([
20:       {
21:         actor: { login: "contractor" },
22:         event: "labeled",
23:         id: "100",
24:         label: { name: "accepted" },
25:       },
26:       {
27:         actor: { login: "contractor" },
28:         ...

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

No files found

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   getAutoApprovedRepositories,
5:   main,
6: } = require("../authorize-approval.js");
7: 
8: const originalEnvironment = { ...process.env };
9: 
10: afterEach(() => {
11:   process.env = { ...originalEnvironment };
12:   vi.restoreAllMocks();
13:   vi.resetModules();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: async function runAuthorization({ actor, issueTitle, responses }) {
21:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
22:   process.env.APPROVAL_TOKEN = "release-bot-token";
23:   process.env.APPROVAL_ACTOR = actor;
24:   process.env.APPROVAL_ISSUE_NUMBER = "123";
25:   process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26:   process.env.APPROVAL_ISSUE_TITLE = ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordCiReadyAttestation,
8: } = require("../record-ci-ready-attestation.js");
9: 
10: describe("recordCiReadyAttestation", () => {
11:   test("binds the current approval to the app that will add ci-ready", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordCiReadyAttestation({
16:         getAuthenticatedLogin: vi
17:           .fn()
18:           .mockResolvedValue("sentry-internal-app[bot]"),
19:         getIssue: vi.fn().mockResolvedValue({
20:           labels: [{ name: "accepted" }],
21:           title,
22:         }),
23:         getIssueEvents: vi.fn().mockResolvedValue([
24:           {
25:             ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8:   createCiReadyAttestation,
9: } = require("../../modules/approval-attestation.js");
10: 
11: afterEach(() => {
12:   vi.restoreAllMocks();
13: });
14: 
15: function jsonResponse(json) {
16:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
17: }
18: 
19: describe("validateApprovalAttestation", () => {
20:   test("accepts the current accepted event and its trusted attestation", async () => {
21:     const title = "publish: getsentry/sentry-javascript@10.0.0";
22:     const attestation = createApprovalAttestation({
23:       actor: "contractor",
24:       eventId: "100",
25:       title,
26:     });
27:     global.fetch = vi
28:       ...

<path>/home/byk/Code/getsentry/publish/src/modules/update-issue.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   TARGETS_SECTION_PARSER_REGEX,
4:   TARGETS_PARSER_REGEX,
5: } = require("./details-from-context");
6: 
7: async function updateTargets({ octokit, version, publishRepo, issue_number }) {
8:   const CRAFT_STATE_FILE_PATH = `${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json`;
9: 
10:   if (!fs.existsSync(CRAFT_STATE_FILE_PATH)) {
11:     return;
12:   }
13: 
14:   const issueRequest = octokit.rest.issues.get({
15:     ...publishRepo,
16:     issue_number,
17:   });
18: 
19:   const craftStateRequest = fs.promises
20:     .readFile(CRAFT_STATE_FILE_PATH, { encoding: "utf-8" })
21:     .then((data) => JSON.parse(data));
22: 
23:   const [{ data: issue }, craftState] = await Promise.all([
24:     issueRequest,
25:     craftStateRequest,
26:   ]);
27: 
28:   const newIssueBody = transformIssueBody(craftState, issue.body);
29: ...

File not found: /home/byk/Code/getsentry/publish/src/publish/__tests__/update-issue.js

/home/byk/Code/getsentry/publish/src/publish/update-issue.js
/home/byk/Code/getsentry/publish/src/modules/update-issue.js
/home/byk/Code/getsentry/publish/src/modules/__tests__/update-issue.js

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/update-issue.js</path>
<type>file</type>
<content>
1: import { vi, describe, test, expect, beforeAll, beforeEach, it } from "vitest";
2: import fs from "fs";
3: 
4: const { updateIssue, transformIssueBody } = require("../update-issue.js");
5: 
6: let mockExistsSync;
7: 
8: const updateTargetsArgs = {
9:   inputs: { repo: "sentry", version: "21.3.1" },
10:   context: {
11:     runId: "1234",
12:     repo: { owner: "getsentry", repo: "publish" },
13:     payload: { issue: { number: "211" } },
14:   },
15:   octokit: {
16:     rest: {
17:       actions: {
18:         getWorkflowRun: async () => ({
19:           data: {
20:             html_url: "https://github.com/getsentry/sentry/actions/runs/1234",
21:           },
22:         }),
23:       },
24:       issues: {
25:         get: vi.fn(),
26:         update: vi.fn(),
27:         removeLabel: vi.fn(),
28:       },
29:     },
30:   },
31:   Sentry: {
32:     Scope: class Scope ...

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
2: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
3: const ATTESTATION_SUFFIX = " -->";
4: 
5: function createAttestation(prefix, value) {
6:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
7:     "base64url"
8:   )}${ATTESTATION_SUFFIX}`;
9: }
10: 
11: function createApprovalAttestation({ actor, eventId, title }) {
12:   return createAttestation(APPROVAL_ATTESTATION_PREFIX, {
13:     actor,
14:     eventId: String(eventId),
15:     title,
16:   });
17: }
18: 
19: function createCiReadyAttestation({ acceptedEvent, ciReadyActor, title }) {
20:   return createAttestation(CI_READY_ATTESTATION_PREFIX, {
21:     acceptedActor: acceptedEvent.actor,
22:     acceptedEventId: String(acceptedEvent.eventId),
23:     ciReadyActor,
24:     title,
25:   });
26: }
27: 
28: function ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createCiReadyAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const {
7:   getAllPages,
8:   getGitHubResponse,
9:   getIssue,
10: } = require("./validate-approval-attestation.js");
11: 
12: async function getAuthenticatedLogin() {
13:   const response = await getGitHubResponse("user");
14: 
15:   if (!response.ok) {
16:     throw new Error(
17:       `Could not retrieve the authenticated user: GitHub returned ${response.status}`
18:     );
19:   }
20: 
21:   const { login } = await response.json();
22: 
23:   if (typeof login !== "string") {
24:     throw new Error("GitHub returned no authenticated user login");
25:   }
26: 
27:   return login;
28: }
29: 
30: async function recordCiReadyAttestation({
31:   expectedAcceptedEvent,
32:   getAuthenticatedLogin,
33:   getIssue,
34:  ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
160: 
161:       # Trigger the CI poller immediately instead of waiting for the next cron tick.
162:       # Uses the app token — GITHUB_TOKEN workflow_dispatch events are suppressed.
163:       - name: Trigger CI poller
164:         env:
165:           GH_TOKEN: ${{ steps.token.outputs.token }}
166:         run: |
167:           gh workflow run ci-poller.yml -R "$GITHUB_REPOSITORY"
168: 
169:   publish:
170:     runs-on: ubuntu-latest
171:     environment: production
172:     name: Publish a new version
173:     # Publish when ci-ready is present (added by the poller after CI passes).
174:     # Fires ONLY on ci-ready label events — not accepted — to avoid racing
175:     # with waiting-for-ci on the same event. ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

<path>/home/byk/Code/getsentry/publish/src/libs/github.js</path>
<type>file</type>
<content>
1: /**
2:  * This is a helper function that throws a useful error message if the
3:  * workflow environment is not configured correctly.
4:  *
5:  * @returns string
6:  */
7: function getGitHubToken() {
8:   if (!process.env.GITHUB_TOKEN) {
9:     throw new Error(
10:       'No "GITHUB_TOKEN" environment variable found. ' +
11:         "Please ensure the workflow is configured correctly"
12:     );
13:   }
14:   return process.env.GITHUB_TOKEN;
15: }
16: 
17: module.exports = {
18:   getGitHubToken,
19: };

(End of file - total 19 lines)
</content>

Found 41 matches
/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js:
  Line 3:   createCiReadyAttestation,

  Line 57:   return createCiReadyAttestation({ acceptedEvent, ciReadyActor, title });


/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js:
  Line 4:   hasApprovalAttestation,

  Line 5:   hasCiReadyAttestation,

  Line 78:     hasApprovalAttestation({

  Line 92:     hasCiReadyAttestation({


/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js:
  Line 7:   createApprovalAttestation,

  Line 8:   createCiReadyAttestation,

  Line 22:     const attestation = createApprovalAttestation({

  Line 61:     const attestation = createApprovalAttestation({

  Line 99:     const attestation = createApprovalAttestation({

  Line 141:     const attestation = createApprovalAttestation({

  Line 177:     const attestation = createApprovalAttestation({

  Line 221:     const attestation = ...

<path>/home/byk/Code/getsentry/publish/src/publish/update-issue.js</path>
<type>file</type>
<content>
1: const { updateIssue } = require("../modules/update-issue.js");
2: const { getGitHubToken } = require("../libs/github");
3: const github = require("@actions/github");
4: 
5: const context = github.context;
6: const octokit = github.getOctokit(getGitHubToken());
7: const inputs = JSON.parse(process.env.PUBLISH_ARGS);
8: 
9: updateIssue({ context, octokit, inputs });

(End of file - total 9 lines)
</content>

Success. Updated the following files:
M src/modules/approval-attestation.js
M src/publish/authorize-approval.js
M src/publish/record-ci-ready-attestation.js
M src/publish/validate-approval-attestation.js
M src/modules/update-issue.js
M src/publish/update-issue.js

yarn run v1.22.22
$ vitest run src/modules/__tests__/approval-attestation.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/modules/__tests__/update-issue.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/modules/__tests__/approval-attestation.js (4 tests | 3 failed) 14ms
     × matches the latest accepted event to a trusted attestation 9ms
     ✓ accepts numeric event IDs returned by GitHub's issue events API 2ms
     × matches a CI-ready attestation to the current accepted event 1ms
     × rejects malformed or stale attestations 1ms
 ❯ ...

Success. Updated the following files:
M src/modules/__tests__/approval-attestation.js
M src/publish/__tests__/authorize-approval.js
M src/publish/__tests__/record-ci-ready-attestation.js

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8:   createCiReadyAttestation,
9: } = require("../../modules/approval-attestation.js");
10: 
11: afterEach(() => {
12:   vi.restoreAllMocks();
13: });
14: 
15: function jsonResponse(json) {
16:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
17: }
18: 
19: describe("validateApprovalAttestation", () => {
20:   test("accepts the current accepted event and its trusted attestation", async () => {
21:     const title = "publish: getsentry/sentry-javascript@10.0.0";
22:     const attestation = createApprovalAttestation({
23:       actor: "contractor",
24:       eventId: "100",
25:       title,
26:     });
27:     global.fetch = vi
28:       ...

Success. Updated the following files:
M src/publish/__tests__/validate-approval-attestation.js

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
160: 
161:       # Trigger the CI poller immediately instead of waiting for the next cron tick.
162:       # Uses the app token — GITHUB_TOKEN workflow_dispatch events are suppressed.
163:       - name: Trigger CI poller
164:         env:
165:           GH_TOKEN: ${{ steps.token.outputs.token }}
166:         run: |
167:           gh workflow run ci-poller.yml -R "$GITHUB_REPOSITORY"
168: 
169:   publish:
170:     runs-on: ubuntu-latest
171:     environment: production
172:     name: Publish a new version
173:     # Publish when ci-ready is present (added by the poller after CI passes).
174:     # Fires ONLY on ci-ready label events — not accepted — to avoid racing
175:     # with waiting-for-ci on the same event. ...

yarn run v1.22.22
$ vitest run src/modules/__tests__/approval-attestation.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/modules/__tests__/update-issue.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/validate-approval-attestation.js (8 tests) 38ms
 ✓ src/publish/__tests__/authorize-approval.js (3 tests) 27ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 47ms
 ✓ src/publish/__tests__/record-ci-ready-attestation.js (3 tests) 9ms
 ✓ src/modules/__tests__/update-issue.js (5 tests) 12ms

 Test Files ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
5: const ATTESTATION_SUFFIX = " -->";
6: 
7: function createAttestation(prefix, value) {
8:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
9:     "base64url"
10:   )}${ATTESTATION_SUFFIX}`;
11: }
12: 
13: function requestDigest({ body, labels, title }) {
14:   if (typeof body !== "string" || !Array.isArray(labels)) {
15:     throw new Error("Invalid publish request");
16:   }
17: 
18:   return crypto
19:     .createHash("sha256")
20:     .update(
21:       JSON.stringify({
22:         body,
23:         dryRun: labels.some((label) => label.name === "dry-run"),
24:         title,
25:       })
26:     )
27:     .digest("hex");
28: }
29: 
30: function createApprovalAttestation({ actor, eventId, ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/update-issue.js</path>
<type>file</type>
<content>
1: import { vi, describe, test, expect, beforeAll, beforeEach, it } from "vitest";
2: import fs from "fs";
3: 
4: const { updateIssue, transformIssueBody } = require("../update-issue.js");
5: 
6: let mockExistsSync;
7: 
8: const updateTargetsArgs = {
9:   inputs: { repo: "sentry", version: "21.3.1" },
10:   context: {
11:     runId: "1234",
12:     repo: { owner: "getsentry", repo: "publish" },
13:     payload: { issue: { number: "211" } },
14:   },
15:   octokit: {
16:     rest: {
17:       actions: {
18:         getWorkflowRun: async () => ({
19:           data: {
20:             html_url: "https://github.com/getsentry/sentry/actions/runs/1234",
21:           },
22:         }),
23:       },
24:       issues: {
25:         get: vi.fn(),
26:         update: vi.fn(),
27:         removeLabel: vi.fn(),
28:       },
29:     },
30:   },
31:   Sentry: {
32:     Scope: class Scope ...

No files found

Success. Updated the following files:
M src/modules/__tests__/update-issue.js

yarn run v1.22.22
$ vitest run src/modules/__tests__/approval-attestation.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/modules/__tests__/update-issue.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/validate-approval-attestation.js (8 tests) 29ms
 ✓ src/publish/__tests__/authorize-approval.js (3 tests) 24ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 33ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 13ms
 ✓ src/publish/__tests__/record-ci-ready-attestation.js (3 tests) 10ms

 Test Files ...

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 21ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 39ms
 ✓ src/modules/__tests__/approval-authorizer.js (14 tests) 17ms
 ✓ src/modules/__tests__/details-from-context.js (5 tests) 8ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (8 tests) 52ms
 ✓ src/publish/__tests__/authorize-approval.js (3 tests) 15ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 23ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
error Command failed with exit code 1.

<task id="ses_f8d110923ffe6A1UFETiMbG5Yj" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Pin CI poller checkout to trusted default ref",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   workflow_dispatch:
7:     inputs:
8:       attempt:
9:         description: Self-dispatch attempt counter (internal use)
10:         required: false
11:         default: "0"
12: 
13: permissions:
14:   contents: read
15:   issues: write
16: 
17: jobs:
18:   check-ci:
19:     runs-on: ubuntu-latest
20:     environment: production
21:     # Skip entirely (no runner provisioned) when there's nothing to check.
22:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
23:     # Always allow workflow_dispatch for manual recovery.
24:     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
25:     concurrency:
26:       group: ci-status-poller
27:       cancel-in-progress: false
28:     steps:
29:       - name: Get publish code
30:         uses: ...

diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index a3db430..a557c2d 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -12,7 +12,7 @@ on:
 
 permissions:
   contents: read
-  issues: read
+  issues: write
 
 jobs:
   check-ci:
@@ -26,6 +26,11 @@ jobs:
       group: ci-status-poller
       cancel-in-progress: false
     steps:
+      - name: Get publish code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       # sentry-internal-app token for label changes on this repo.
       # This token is what triggers publish.yml downstream — see
       # https://github.com/getsentry/publish for why GITHUB_TOKEN can't.
@@ -92,12 +97,49 @@ jobs:
             title=$(echo "$issue" | jq -r '.title')
             body=$(echo "$issue" | jq -r '.body')
 
-            # Parse repo and version from title: "publish: owner/repo[/path]@version"
-            # Only take owner/repo (first two ...

Success. Updated the following files:
M .github/workflows/ci-poller.yml

No files found

<path>/home/byk/Code/getsentry/publish/package.json</path>
<type>file</type>
<content>
1: {
2:   "name": "publish",
3:   "private": true,
4:   "version": "0.0.1",
5:   "description": "Approval-based publishing system for Sentry",
6:   "main": "index.js",
7:   "repository": "git@github.com:getsentry/publish.git",
8:   "author": "Sentry Open Source <oss@sentry.io>",
9:   "license": "Apache-2.0",
10:   "volta": {
11:     "node": "24.0.0",
12:     "yarn": "1.22.22"
13:   },
14:   "resolutions": {
15:     "undici": "^6.23.0"
16:   },
17:   "scripts": {
18:     "test": "vitest run",
19:     "test:watch": "vitest",
20:     "lint": "eslint src .github --ignore-pattern '!.github'",
21:     "prettier": "prettier --write src"
22:   },
23:   "devDependencies": {
24:     "eslint": "^8.9.0",
25:     "eslint-config-prettier": "^8.3.0",
26:     "eslint-plugin-yml": "^0.13.0",
27:     "prettier": "^2.2.1",
28:     "vitest": "^4.1.0"
29:   },
30:   "dependencies": {
31:     "@actions/core": ...

Success. Updated the following files:
A src/publish/__tests__/ci-poller-workflow.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/ci-poller-workflow.js (1 test) 3ms

 Test Files  1 passed (1)
      Tests  1 passed (1)
   Start at  10:07:27
   Duration  196ms (transform 19ms, setup 0ms, import 29ms, tests 3ms, environment 0ms)

Done in 0.74s.

Success. Updated the following files:
M .github/workflows/ci-poller.yml

yarn run v1.22.22
$ vitest run src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/ci-poller-workflow.js (1 test | 1 failed) 12ms
     × checks out trusted code before requesting app tokens 11ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/ci-poller-workflow.js > CI poller workflow > checks out trusted code before requesting app tokens
AssertionError: expected 'name: CI Status Poller\n\non:\n  sche…' to match /…/checkout@v6\n\s+with:\n(?:\s+#.*\n)*\s+ref: \$\{\{ github\.event\.repository\.default_branch \}\}

- Expected: 
/- name: Get publish code\n\s+uses: actions\/checkout@v6\n\s+with:\n(?:\s+#.*\n)*\s+ref: \$\{\{ ...

Success. Updated the following files:
M .github/workflows/ci-poller.yml

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/ci-poller-workflow.js (1 test) 4ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 66ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (8 tests) 25ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 23ms
 ✓ src/modules/__tests__/approval-authorizer.js (14 tests) 17ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 26ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 52ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

/home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js
   5:1  error  'describe' is not defined  no-undef
   6:3  error  'test' is not defined      no-undef
   7:5  error  'expect' is not defined    no-undef
  11:5  error  'expect' is not defined    no-undef

✖ 5 problems (5 errors, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

Success. Updated the following files:
M src/publish/__tests__/ci-poller-workflow.js

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/authorize-approval.js (3 tests) 14ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 19ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 13ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (8 tests) 33ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 59ms
 ✓ src/publish/__tests__/record-ci-ready-attestation.js (3 tests) 10ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 22ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Pin CI poller checkout to trusted default ref",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f7f819f13ffe3mgaylty61Tl7M" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Pin CI poller checkout to trusted default ref",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Reject release requester self-approval",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   getAutoApprovedRepositories,
5:   main,
6: } = require("../authorize-approval.js");
7: 
8: const originalEnvironment = { ...process.env };
9: 
10: afterEach(() => {
11:   process.env = { ...originalEnvironment };
12:   vi.restoreAllMocks();
13:   vi.resetModules();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: async function runAuthorization({ actor, issueTitle, responses }) {
21:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
22:   process.env.APPROVAL_TOKEN = "release-bot-token";
23:   process.env.APPROVAL_ACTOR = actor;
24:   process.env.APPROVAL_ISSUE_NUMBER = "123";
25:   process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26:   process.env.APPROVAL_ISSUE_TITLE = ...

Success. Updated the following files:
M src/publish/__tests__/authorize-approval.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/authorize-approval.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/authorize-approval.js (4 tests | 1 failed) 22ms
     ✓ loads exact release paths from the auto-approval allowlist 3ms
     ✓ writes authorization after a successful GitHub permission lookup 5ms
     × rejects a requester approving their own release 9ms
     ✓ fails closed when GitHub cannot return a permission 3ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/authorize-approval.js > authorize-approval entry point > rejects a requester approving their own release
AssertionError: ...

Success. Updated the following files:
M src/publish/authorize-approval.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/authorize-approval.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/authorize-approval.js (4 tests) 17ms

 Test Files  1 passed (1)
      Tests  4 passed (4)
   Start at  10:25:04
   Duration  399ms (transform 42ms, setup 0ms, import 66ms, tests 17ms, environment 0ms)

Done in 1.16s.

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 40ms
 ✓ src/modules/__tests__/approval-authorizer.js (14 tests) 28ms
 ✓ src/modules/__tests__/post-workflow-details.js (1 test) 24ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (8 tests) 46ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 89ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 27ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 40ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
error Command failed with exit code 1.

(no output)

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Pin CI poller checkout to trusted default ref",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Reject release requester self-approval",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add regressions and run full validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Process substantive final reviews",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f7f727fcfffeQ5f2GrCRPrlS2e" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Inspect current approval workflow and attestation implementation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Bind requested release state into approval and CI-ready attestations",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Harden publication failure cleanup before input parsing",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Pin CI poller checkout to trusted default ref",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Reject release requester self-approval",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Authenticate auto-approval provenance",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Fence publication against approval revocation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Pin Craft image immutably",
    "status": "pending",
    "priority": "high"
  ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

Name:      docker.io/getsentry/craft:latest
MediaType: application/vnd.docker.distribution.manifest.list.v2+json
Digest:    sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b
           
Manifests: 
  Name:      docker.io/getsentry/craft:latest@sha256:b42694dda52499a9bc79f1a6bad1f0b6f7dbaf25862f3e412d88a5c78b2992ab
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/amd64

Found 3 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 24:   # poller flips ci-pending → ci-ready (which also prevents publishing without


/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml:
  Line 136:             # Use Publish's title parser so CI and publishing always target

  Line 343:               # so publishing will start as soon as ci-ready is added.

<path>/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createCiReadyAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const {
7:   getAllPages,
8:   getGitHubResponse,
9:   getIssue,
10: } = require("./validate-approval-attestation.js");
11: 
12: async function getAuthenticatedLogin() {
13:   const response = await getGitHubResponse("user");
14: 
15:   if (!response.ok) {
16:     throw new Error(
17:       `Could not retrieve the authenticated user: GitHub returned ${response.status}`
18:     );
19:   }
20: 
21:   const { login } = await response.json();
22: 
23:   if (typeof login !== "string") {
24:     throw new Error("GitHub returned no authenticated user login");
25:   }
26: 
27:   return login;
28: }
29: 
30: async function recordCiReadyAttestation({
31:   expectedAcceptedEvent,
32:   getAuthenticatedLogin,
33:   getIssue,
34:  ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
5: const ATTESTATION_SUFFIX = " -->";
6: 
7: function createAttestation(prefix, value) {
8:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
9:     "base64url"
10:   )}${ATTESTATION_SUFFIX}`;
11: }
12: 
13: function requestDigest({ body, labels, title }) {
14:   if (typeof body !== "string" || !Array.isArray(labels)) {
15:     throw new Error("Invalid publish request");
16:   }
17: 
18:   return crypto
19:     .createHash("sha256")
20:     .update(
21:       JSON.stringify({
22:         body,
23:         dryRun: labels.some((label) => label.name === "dry-run"),
24:         title,
25:       })
26:     )
27:     .digest("hex");
28: }
29: 
30: function createApprovalAttestation({ actor, eventId, ...

<path>/home/byk/Code/getsentry/publish/auto-approve-repos.txt</path>
<type>file</type>
<content>
1: getsentry/arroyo
2: getsentry/auto-type-annotate
3: getsentry/devenv
4: getsentry/infra-event-notifier
5: getsentry/jest-sentry-environment
6: getsentry/json-schema-diff
7: getsentry/js-source-scopes
8: getsentry/objectstore/clients
9: getsentry/ophio
10: getsentry/pdb
11: getsentry/pyo3-python-tracing-subscriber
12: getsentry/pytest-sentry
13: getsentry/relay/py
14: getsentry/responses
15: getsentry/rust-proguard
16: getsentry/rust-sourcemap
17: getsentry/rust-usage-accountant
18: getsentry/script-runner
19: getsentry/sentry-api-schema
20: getsentry/sentry-forked-djangorestframework-stubs
21: getsentry/sentry-forked-django-stubs
22: getsentry/sentry-forked-jsonnet
23: getsentry/sentry-infra-tools
24: getsentry/sentry-kafka-management
25: getsentry/sentry-kafka-schemas
26: getsentry/sentry-protos
27: getsentry/sentry-redis-tools
28: getsentry/service-registry
29: getsentry/skrooge
30: ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { parsePublishTitle } = require("./details-from-context.js");
4: 
5: async function authorizeApproval({
6:   actor,
7:   issueTitle,
8:   getPermission,
9:   autoApprovedRepositories = new Set(),
10: }) {
11:   const title = parsePublishTitle(issueTitle);
12: 
13:   if (!title) {
14:     return { authorized: false, repository: null };
15:   }
16: 
17:   const repository = `getsentry/${title.repo}`;
18:   const releasePath = `${repository}${title.path || ""}`;
19: 
20:   if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21:     return { authorized: true, repository };
22:   }
23: 
24:   if (actor === AUTO_APPROVER) {
25:     return { authorized: false, repository };
26:   }
27: 
28:   const { role_name } = await getPermission({
29:  ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

Found 15 matches
/home/byk/Code/getsentry/publish/AGENTS.md:
  Line 7: This is the **Sentry Publish Repository** - a GitHub Actions-based approval system for publishing releases across multiple Sentry projects using [Craft](https://github.com/getsentry/craft). It's a pure JavaScript (Node.js 24.0.0) project using CommonJS modules.


/home/byk/Code/getsentry/publish/docs/rfc.md:
  Line 7: 1. We need to be able to quickly recycle all publishing tokens (NPM, PyPI, Cargo, Docker, etc.) at will without disrupting our releases or our developer flow

  Line 8: 2. We need to limit the publishing tokens to authorized personnel only and not leak them in any way

  Line 15: 1. Create a central release/publish repository to store release workflow and publishing tokens

  Line 19: 5. ...

[
  {
    "content": "Bind auto-approval to request proof",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Fence approval immediately before Craft",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Pin Craft image immutably",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

Found 27 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 25:   # CI verification in the auto-approve race).

  Line 91:         run: node src/publish/validate-approval-attestation.js

  Line 206:         run: node .__publish__/src/publish/validate-approval-attestation.js

  Line 287:           CRAFT_PUBLISH_REPO: ${{ fromJSON(steps.inputs.outputs.result).repo }}

  Line 288:           CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.inputs.outputs.result).path }}

  Line 289:           CRAFT_PUBLISH_VERSION: ${{ fromJSON(steps.inputs.outputs.result).version }}

  Line 290:           CRAFT_PUBLISH_TARGETS_JSON: ${{ toJSON(fromJSON(steps.inputs.outputs.result).targets) }}

  Line 293:           payload="$(jq -n --argjson source "$CRAFT_PUBLISH_TARGETS_JSON" '[{($source[]): true }] | add | {"published": (. // {}) }')"

  Line 304:           # not the runner host path. CRAFT_PUBLISH_PATH is either "."

  Line 309:           case "$CRAFT_PUBLISH_PATH" in

  Line 311:   ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

Found 100 matches (more matches available)
/home/byk/Code/fossilize/.github/workflows/release.yml:
  Line 33:       - uses: getsentry/craft@v2


/home/byk/Code/fossilize/.github/workflows/publish.yml:
  Line 54:           CRAFT_URL=$(curl -fsSL https://api.github.com/repos/getsentry/craft/releases/latest \


/home/byk/Code/opencode-lore/.github/workflows/ci.yml:
  Line 225:           CRAFT_URL=$(curl -fsSL https://api.github.com/repos/getsentry/craft/releases/latest \


/home/byk/Code/opencode-lore/.github/workflows/publish.yml:
  Line 71:           CRAFT_URL="https://github.com/getsentry/craft/releases/download/${CRAFT_VERSION}/craft"


/home/byk/Code/opencode-lore/.github/workflows/release.yml:
  Line 33:       - uses: getsentry/craft@v2


/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/publish.yml:
  Line 191:           # (getsentry/craft#797, released in 2.26.0). ...

No files found

No files found

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/ci-poller.yml", "utf8");
5: 
6: describe("CI poller workflow", () => {
7:   test("checks out trusted code before requesting app tokens", () => {
8:     expect(workflow).toMatch(
9:       /- name: Get publish code\n\s+uses: actions\/checkout@v6\n\s+with:\n(?:\s+#.*\n)*\s+ref: \$\{\{ github\.event\.repository\.default_branch \}\}/
10:     );
11: 
12:     expect(workflow.indexOf("Get publish code")).toBeLessThan(
13:       workflow.indexOf("Get auth token")
14:     );
15:   });
16: });

(End of file - total 16 lines)
</content>

Found 17 matches
/home/byk/Code/getsentry/publish/.lore.md:
  Line 40: * **publish.yml Craft latest image**: Trap: \`docker://getsentry/craft:latest\` looks convenient because it automatically receives Craft fixes, but the job injects cross-repository tokens and publishing secrets into code selected by a mutable tag. Fix: pin Craft, and privileged Action dependencies, to immutable image digests or reviewed immutable references; updates then require explicit review rather than silently changing release-execution code.

  Line 48: * **ci-poller ci-ready re-add**: The CI poller must always add \`ci-ready\` after passing CI, even if that label already exists. Re-adding it deliberately emits the label event that starts publishing after the \`waiting-for-ci\` race; an idempotence optimization would strand accepted releases. \`workflow\_dispatch\` must always remain allowed for manual recovery, independent of the pending-work repository ...

 M .github/workflows/ci-poller.yml
 M .github/workflows/publish.yml
 M AGENTS.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/__tests__/details-from-context.js
 M src/modules/__tests__/update-issue.js
 M src/modules/details-from-context.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? src/publish/authorize-approval.js
?? src/publish/current-accepted-event.js
?? src/publish/record-ci-ready-attestation.js
?? src/publish/validate-approval-attestation.js
 .github/workflows/ci-poller.yml               | 142 ++++++++++++++++++++++++--
 .github/workflows/publish.yml         ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   getAutoApprovedRepositories,
5:   main,
6: } = require("../authorize-approval.js");
7: 
8: const originalEnvironment = { ...process.env };
9: 
10: afterEach(() => {
11:   process.env = { ...originalEnvironment };
12:   vi.restoreAllMocks();
13:   vi.resetModules();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: async function runAuthorization({ actor, issueTitle, responses }) {
21:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
22:   process.env.APPROVAL_TOKEN = "release-bot-token";
23:   process.env.APPROVAL_ACTOR = actor;
24:   process.env.APPROVAL_ISSUE_NUMBER = "123";
25:   process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26:   process.env.APPROVAL_ISSUE_TITLE = ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
5: const ATTESTATION_SUFFIX = " -->";
6: 
7: function createAttestation(prefix, value) {
8:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
9:     "base64url"
10:   )}${ATTESTATION_SUFFIX}`;
11: }
12: 
13: function requestDigest({ body, labels, title }) {
14:   if (typeof body !== "string" || !Array.isArray(labels)) {
15:     throw new Error("Invalid publish request");
16:   }
17: 
18:   return crypto
19:     .createHash("sha256")
20:     .update(
21:       JSON.stringify({
22:         body,
23:         dryRun: labels.some((label) => label.name === "dry-run"),
24:         title,
25:       })
26:     )
27:     .digest("hex");
28: }
29: 
30: function createApprovalAttestation({ actor, eventId, ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8:   createCiReadyAttestation,
9: } = require("../../modules/approval-attestation.js");
10: 
11: afterEach(() => {
12:   vi.restoreAllMocks();
13: });
14: 
15: function jsonResponse(json) {
16:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
17: }
18: 
19: function issue(title, { body = "", labels = [{ name: "accepted" }] } = {}) {
20:   return { body, labels, title };
21: }
22: 
23: describe("validateApprovalAttestation", () => {
24:   test("accepts the current accepted event and its trusted attestation", async () => {
25:     const title = "publish: getsentry/sentry-javascript@10.0.0";
26:     const publishIssue = issue(title);
27:  ...

Found 14 matches
/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml:
  Line 39:       - name: Get auth token

  Line 46:       # sentry-release-bot token for cross-repo API access (check-suites,

  Line 50:       - name: Get release bot auth token

  Line 109:               gh issue edit "$number" -R "$GITHUB_REPOSITORY" \

  Line 128:               gh issue edit "$number" -R "$GITHUB_REPOSITORY" \

  Line 197:               gh issue edit "$number" -R "$GITHUB_REPOSITORY" --body "$updated_body"

  Line 264:                 gh issue edit "$number" -R "$GITHUB_REPOSITORY" \

  Line 286:                 gh issue edit "$number" -R "$GITHUB_REPOSITORY" \

  Line 298:                 gh issue edit "$number" -R "$GITHUB_REPOSITORY" \

  Line 310:                 gh issue edit "$number" -R "$GITHUB_REPOSITORY" \

  Line 329:                 gh issue edit "$number" -R "$GITHUB_REPOSITORY" \

  Line 338:               gh issue edit "$number" -R "$GITHUB_REPOSITORY" \

  Line 352:  ...

Success. Updated the following files:
A src/publish/__tests__/auto-approval-workflow.js
A src/publish/__tests__/publish-workflow.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/auto-approval-workflow.js (1 test | 1 failed) 41ms
     × records a request-bound attestation before adding accepted 39ms
 ❯ src/publish/__tests__/publish-workflow.js (2 tests | 2 failed) 17ms
     × revalidates approval immediately before Craft 11ms
     × pins Craft to an immutable digest 5ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 3 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/auto-approval-workflow.js > auto-approval ...

Found 14 matches
/home/byk/Code/getsentry/publish/.lore.md:
  Line 8: * **approval-authorizer GitHub roles**: Chose live GitHub collaborator permission checks over private \`security-as-code\` because Publish is public and GitHub reflects effective target-repository access without exposing RBAC. Humans authorize only with \`write\`, \`maintain\`, or \`admin\`; \`triage\` never authorizes. \`getsantry\[bot]\` must never fall through to collaborator lookup: it authorizes only when its exact parsed repository/release path is in \`auto-approve-repos.txt\`, because bot repository access does not prove the event followed an allowlisted auto-approval path.

  Line 25: * **auto-approve.yml label actor**: Trap: adding \`accepted\` with a Sentry Internal App token looks appropriate because it has label permission, but GitHub records \`sentry-internal-app\[bot]\`, not the trusted opener \`getsantry\[bot]\`, so a gate keyed to the label actor either rejects valid automation or dangerously trusts ...

<path>/home/byk/Code/getsentry/publish/auto-approve-repos.txt</path>
<type>file</type>
<content>
1: getsentry/arroyo
2: getsentry/auto-type-annotate
3: getsentry/devenv
4: getsentry/infra-event-notifier
5: getsentry/jest-sentry-environment
6: getsentry/json-schema-diff
7: getsentry/js-source-scopes
8: getsentry/objectstore/clients
9: getsentry/ophio
10: getsentry/pdb
11: getsentry/pyo3-python-tracing-subscriber
12: getsentry/pytest-sentry
13: getsentry/relay/py
14: getsentry/responses
15: getsentry/rust-proguard
16: getsentry/rust-sourcemap
17: getsentry/rust-usage-accountant
18: getsentry/script-runner
19: getsentry/sentry-api-schema
20: getsentry/sentry-forked-djangorestframework-stubs
21: getsentry/sentry-forked-django-stubs
22: getsentry/sentry-forked-jsonnet
23: getsentry/sentry-infra-tools
24: getsentry/sentry-kafka-management
25: getsentry/sentry-kafka-schemas
26: getsentry/sentry-protos
27: getsentry/sentry-redis-tools
28: getsentry/service-registry
29: getsentry/skrooge
30: ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test } from "vitest";
2: 
3: const {
4:   createApprovalAttestation,
5:   createCiReadyAttestation,
6:   currentAcceptedEvent,
7:   hasApprovalAttestation,
8:   hasCiReadyAttestation,
9:   parseApprovalAttestation,
10:   requestDigest,
11: } = require("../approval-attestation.js");
12: 
13: function issue(title, { body = "", dryRun = false } = {}) {
14:   return {
15:     body,
16:     labels: dryRun ? [{ name: "dry-run" }] : [],
17:     title,
18:   };
19: }
20: 
21: describe("approval attestations", () => {
22:   test("matches the latest accepted event to a trusted attestation", () => {
23:     const title = "publish: getsentry/relay/py@1.2.3";
24:     const publishIssue = issue(title);
25:     const attestation = createApprovalAttestation({
26:       actor: "contractor",
27:       eventId: "200",
28:       issue: publishIssue,
29:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { parsePublishTitle } = require("./details-from-context.js");
4: 
5: async function authorizeApproval({
6:   actor,
7:   issueTitle,
8:   getPermission,
9:   autoApprovedRepositories = new Set(),
10: }) {
11:   const title = parsePublishTitle(issueTitle);
12: 
13:   if (!title) {
14:     return { authorized: false, repository: null };
15:   }
16: 
17:   const repository = `getsentry/${title.repo}`;
18:   const releasePath = `${repository}${title.path || ""}`;
19: 
20:   if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21:     return { authorized: true, repository };
22:   }
23: 
24:   if (actor === AUTO_APPROVER) {
25:     return { authorized: false, repository };
26:   }
27: 
28:   const { role_name } = await getPermission({
29:  ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

[
  {
    "content": "Harden automated approval provenance before accepted labeling",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Add final approval fence before Craft publication",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Pin Craft action to an immutable digest",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run regressions, full validation, and independent review",
    "status": "pending",
    "priority": "high"
  }
]

Found 35 matches
/home/byk/Code/opencode-lore-vec-delete/.github/workflows/release.yml:
  Line 33:       - uses: getsentry/craft@v2


/home/byk/Code/superset/.github/workflows/release.yml:
  Line 33:       - uses: getsentry/craft@v2


/home/byk/Code/opencode-lore-recall-diagnostics/.github/workflows/release.yml:
  Line 33:       - uses: getsentry/craft@v2


/home/byk/Code/opencode-lore-stream-audit/.github/workflows/release.yml:
  Line 33:       - uses: getsentry/craft@v2


/home/byk/Code/opencode-lore-live/.github/workflows/release.yml:
  Line 33:       - uses: getsentry/craft@v2


/home/byk/Code/opencode-lore/.github/workflows/release.yml:
  Line 33:       - uses: getsentry/craft@v2


/home/byk/Code/getsentry/craft-workspace-action-propagation/.github/workflows/release.yml:
  Line 138:         uses: getsentry/craft@v2


/home/byk/Code/getsentry/craft-workspaces-schema/.github/workflows/release.yml:
  Line 130:         uses: ...

Name:      docker.io/getsentry/craft:latest
MediaType: application/vnd.docker.distribution.manifest.list.v2+json
Digest:    sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b
           
Manifests: 
  Name:      docker.io/getsentry/craft:latest@sha256:b42694dda52499a9bc79f1a6bad1f0b6f7dbaf25862f3e412d88a5c78b2992ab
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/amd64

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordCiReadyAttestation,
8: } = require("../record-ci-ready-attestation.js");
9: 
10: describe("recordCiReadyAttestation", () => {
11:   test("binds the current approval to the app that will add ci-ready", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordCiReadyAttestation({
16:         getAuthenticatedLogin: vi
17:           .fn()
18:           .mockResolvedValue("sentry-internal-app[bot]"),
19:         getIssue: vi.fn().mockResolvedValue({
20:           body: "Merge target: main",
21:           labels: [{ name: "accepted" }],
22:           title,
23:         }),
24:         getIssueEvents: ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
5: const ATTESTATION_SUFFIX = " -->";
6: 
7: function createAttestation(prefix, value) {
8:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
9:     "base64url"
10:   )}${ATTESTATION_SUFFIX}`;
11: }
12: 
13: function requestDigest({ body, labels, title }) {
14:   if (typeof body !== "string" || !Array.isArray(labels)) {
15:     throw new Error("Invalid publish request");
16:   }
17: 
18:   return crypto
19:     .createHash("sha256")
20:     .update(
21:       JSON.stringify({
22:         body,
23:         dryRun: labels.some((label) => label.name === "dry-run"),
24:         title,
25:       })
26:     )
27:     .digest("hex");
28: }
29: 
30: function createApprovalAttestation({ actor, eventId, ...

No files found

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

/home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/current-accepted-event.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/auto-approve.yml", "utf8");
5: 
6: describe("auto-approval workflow", () => {
7:   test("records a request-bound attestation before adding accepted", () => {
8:     expect(workflow).toContain(
9:       "node src/publish/record-auto-approval-attestation.js"
10:     );
11:     expect(
12:       workflow.indexOf("record-auto-approval-attestation.js")
13:     ).toBeLessThan(workflow.indexOf("--add-label accepted"));
14:   });
15: });

(End of file - total 15 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/publish.yml", "utf8");
5: 
6: describe("publish workflow", () => {
7:   test("revalidates approval immediately before Craft", () => {
8:     const fence = workflow.indexOf("Revalidate approval attestation");
9: 
10:     expect(fence).toBeGreaterThan(workflow.indexOf("Set targets"));
11:     expect(fence).toBeLessThan(workflow.indexOf("Publish using Craft"));
12:     expect(workflow.slice(fence)).toContain(
13:       'REQUIRE_CI_READY_ATTESTATION: "true"'
14:     );
15:   });
16: 
17:   test("pins Craft to an immutable digest", () => {
18:     expect(workflow).toMatch(
19:       /uses: docker:\/\/getsentry\/craft@sha256:[a-f0-9]{64}/
20:     );
21:   });
22: });

(End of file - total 22 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const { authorizeApproval } = require("../approval-authorizer.js");
4: 
5: const issueTitle = "publish: getsentry/sentry-javascript@10.0.0";
6: 
7: describe("authorizeApproval", () => {
8:   test("allows the auto-approval bot for an allowlisted release without a target repository lookup", async () => {
9:     const getPermission = vi.fn();
10: 
11:     await expect(
12:       authorizeApproval({
13:         actor: "getsantry[bot]",
14:         issueTitle,
15:         getPermission,
16:         autoApprovedRepositories: new Set(["getsentry/sentry-javascript"]),
17:       })
18:     ).resolves.toEqual({
19:       authorized: true,
20:       repository: "getsentry/sentry-javascript",
21:     });
22: 
23:     expect(getPermission).not.toHaveBeenCalled();
24:   });
25: 
26:   test("rejects the auto-approval bot ...

 M .github/workflows/ci-poller.yml
 M .github/workflows/publish.yml
 M AGENTS.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/__tests__/details-from-context.js
 M src/modules/__tests__/update-issue.js
 M src/modules/details-from-context.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? src/publish/authorize-approval.js
?? src/publish/current-accepted-event.js
?? src/publish/record-ci-ready-attestation.js
?? src/publish/validate-approval-attestation.js
 .github/workflows/ci-poller.yml               | 142 ++++++++++++++++++++++++--
 .github/workflows/publish.yml         ...

yarn run v1.22.22
$ vitest run src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/publish-workflow.js (2 tests | 2 failed) 13ms
     × revalidates approval immediately before Craft 8ms
     × pins Craft to an immutable digest 4ms
 ❯ src/publish/__tests__/auto-approval-workflow.js (1 test | 1 failed) 27ms
     × records a request-bound attestation before adding accepted 25ms

 Test Files  2 failed (2)
      Tests  3 failed (3)
   Start at  11:20:25
   Duration  ...

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test } from "vitest";
2: 
3: const {
4:   createApprovalAttestation,
5:   createCiReadyAttestation,
6:   currentAcceptedEvent,
7:   hasApprovalAttestation,
8:   hasCiReadyAttestation,
9:   parseApprovalAttestation,
10:   requestDigest,
11: } = require("../approval-attestation.js");
12: 
13: function issue(title, { body = "", dryRun = false } = {}) {
14:   return {
15:     body,
16:     labels: dryRun ? [{ name: "dry-run" }] : [],
17:     title,
18:   };
19: }
20: 
21: describe("approval attestations", () => {
22:   test("matches the latest accepted event to a trusted attestation", () => {
23:     const title = "publish: getsentry/relay/py@1.2.3";
24:     const publishIssue = issue(title);
25:     const attestation = createApprovalAttestation({
26:       actor: "contractor",
27:       eventId: "200",
28:       issue: publishIssue,
29:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createCiReadyAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const {
7:   getAllPages,
8:   getGitHubResponse,
9:   getIssue,
10: } = require("./validate-approval-attestation.js");
11: 
12: async function getAuthenticatedLogin() {
13:   const response = await getGitHubResponse("user");
14: 
15:   if (!response.ok) {
16:     throw new Error(
17:       `Could not retrieve the authenticated user: GitHub returned ${response.status}`
18:     );
19:   }
20: 
21:   const { login } = await response.json();
22: 
23:   if (typeof login !== "string") {
24:     throw new Error("GitHub returned no authenticated user login");
25:   }
26: 
27:   return login;
28: }
29: 
30: async function recordCiReadyAttestation({
31:   expectedAcceptedEvent,
32:   getAuthenticatedLogin,
33:   getIssue,
34:  ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordCiReadyAttestation,
8: } = require("../record-ci-ready-attestation.js");
9: 
10: describe("recordCiReadyAttestation", () => {
11:   test("binds the current approval to the app that will add ci-ready", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordCiReadyAttestation({
16:         getAuthenticatedLogin: vi
17:           .fn()
18:           .mockResolvedValue("sentry-internal-app[bot]"),
19:         getIssue: vi.fn().mockResolvedValue({
20:           body: "Merge target: main",
21:           labels: [{ name: "accepted" }],
22:           title,
23:         }),
24:         getIssueEvents: ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8:   createCiReadyAttestation,
9: } = require("../../modules/approval-attestation.js");
10: 
11: afterEach(() => {
12:   vi.restoreAllMocks();
13: });
14: 
15: function jsonResponse(json) {
16:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
17: }
18: 
19: function issue(title, { body = "", labels = [{ name: "accepted" }] } = {}) {
20:   return { body, labels, title };
21: }
22: 
23: describe("validateApprovalAttestation", () => {
24:   test("accepts the current accepted event and its trusted attestation", async () => {
25:     const title = "publish: getsentry/sentry-javascript@10.0.0";
26:     const publishIssue = issue(title);
27:  ...

[
  {
    "content": "Bind automatic approvals to a trusted request proof",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Fence publishing against live approval revocation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Pin Craft to an immutable digest",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run full validation and independent review",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { parsePublishTitle } = require("./details-from-context.js");
4: 
5: async function authorizeApproval({
6:   actor,
7:   issueTitle,
8:   getPermission,
9:   autoApprovedRepositories = new Set(),
10: }) {
11:   const title = parsePublishTitle(issueTitle);
12: 
13:   if (!title) {
14:     return { authorized: false, repository: null };
15:   }
16: 
17:   const repository = `getsentry/${title.repo}`;
18:   const releasePath = `${repository}${title.path || ""}`;
19: 
20:   if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21:     return { authorized: true, repository };
22:   }
23: 
24:   if (actor === AUTO_APPROVER) {
25:     return { authorized: false, repository };
26:   }
27: 
28:   const { role_name } = await getPermission({
29:  ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

No files found

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/auto-approve.yml", "utf8");
5: 
6: describe("auto-approval workflow", () => {
7:   test("records a request-bound attestation before adding accepted", () => {
8:     expect(workflow).toContain(
9:       "node src/publish/record-auto-approval-attestation.js"
10:     );
11:     expect(
12:       workflow.indexOf("record-auto-approval-attestation.js")
13:     ).toBeLessThan(workflow.indexOf("--add-label accepted"));
14:   });
15: });

(End of file - total 15 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/publish.yml", "utf8");
5: 
6: describe("publish workflow", () => {
7:   test("revalidates approval immediately before Craft", () => {
8:     const fence = workflow.indexOf("Revalidate approval attestation");
9: 
10:     expect(fence).toBeGreaterThan(workflow.indexOf("Set targets"));
11:     expect(fence).toBeLessThan(workflow.indexOf("Publish using Craft"));
12:     expect(workflow.slice(fence)).toContain(
13:       'REQUIRE_CI_READY_ATTESTATION: "true"'
14:     );
15:   });
16: 
17:   test("pins Craft to an immutable digest", () => {
18:     expect(workflow).toMatch(
19:       /uses: docker:\/\/getsentry\/craft@sha256:[a-f0-9]{64}/
20:     );
21:   });
22: });

(End of file - total 22 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
5: const ATTESTATION_SUFFIX = " -->";
6: 
7: function createAttestation(prefix, value) {
8:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
9:     "base64url"
10:   )}${ATTESTATION_SUFFIX}`;
11: }
12: 
13: function requestDigest({ body, labels, title }) {
14:   if (typeof body !== "string" || !Array.isArray(labels)) {
15:     throw new Error("Invalid publish request");
16:   }
17: 
18:   return crypto
19:     .createHash("sha256")
20:     .update(
21:       JSON.stringify({
22:         body,
23:         dryRun: labels.some((label) => label.name === "dry-run"),
24:         title,
25:       })
26:     )
27:     .digest("hex");
28: }
29: 
30: function createApprovalAttestation({ actor, eventId, ...

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

yarn run v1.22.22
$ vitest run src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/publish-workflow.js (2 tests | 2 failed) 13ms
     × revalidates approval immediately before Craft 9ms
     × pins Craft to an immutable digest 3ms
 ❯ src/publish/__tests__/auto-approval-workflow.js (1 test | 1 failed) 31ms
     × records a request-bound attestation before adding accepted 29ms

 Test Files  2 failed (2)
      Tests  3 failed (3)
   Start at  18:50:39
   Duration  ...

Found 14 matches
/home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js:
  Line 9:       "node src/publish/record-auto-approval-attestation.js"

  Line 12:       workflow.indexOf("record-auto-approval-attestation.js")


/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js:
  Line 2: const AUTO_APPROVER = "getsantry[bot]";

  Line 20:   if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {

  Line 24:   if (actor === AUTO_APPROVER) {


/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 346:           GIT_COMMITTER_NAME: sentry-release-bot[bot]

  Line 347:           GIT_AUTHOR_NAME: sentry-release-bot[bot]

  Line 348:           EMAIL: 180476844+sentry-release-bot[bot]@users.noreply.github.com


/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js:
  Line 120:       actor: "getsantry[bot]",

  Line 129:         event: { actor: "getsantry[bot]", eventId: "200" },

  Line 142:     ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const { authorizeApproval } = require("../approval-authorizer.js");
4: 
5: const issueTitle = "publish: getsentry/sentry-javascript@10.0.0";
6: 
7: describe("authorizeApproval", () => {
8:   test("allows the auto-approval bot for an allowlisted release without a target repository lookup", async () => {
9:     const getPermission = vi.fn();
10: 
11:     await expect(
12:       authorizeApproval({
13:         actor: "getsantry[bot]",
14:         issueTitle,
15:         getPermission,
16:         autoApprovedRepositories: new Set(["getsentry/sentry-javascript"]),
17:       })
18:     ).resolves.toEqual({
19:       authorized: true,
20:       repository: "getsentry/sentry-javascript",
21:     });
22: 
23:     expect(getPermission).not.toHaveBeenCalled();
24:   });
25: 
26:   test("rejects the auto-approval bot ...

[
  {
    "content": "Harden automated approval provenance before accepted labeling",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Add final approval fence before Craft publication",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Pin Craft action to immutable digest",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run regressions, full validation, and independent review",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8:   createCiReadyAttestation,
9: } = require("../../modules/approval-attestation.js");
10: 
11: afterEach(() => {
12:   vi.restoreAllMocks();
13: });
14: 
15: function jsonResponse(json) {
16:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
17: }
18: 
19: function issue(title, { body = "", labels = [{ name: "accepted" }] } = {}) {
20:   return { body, labels, title };
21: }
22: 
23: describe("validateApprovalAttestation", () => {
24:   test("accepts the current accepted event and its trusted attestation", async () => {
25:     const title = "publish: getsentry/sentry-javascript@10.0.0";
26:     const publishIssue = issue(title);
27:  ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

Success. Updated the following files:
M src/publish/__tests__/validate-approval-attestation.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/validate-approval-attestation.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/validate-approval-attestation.js (9 tests | 1 failed) 42ms
     ✓ accepts the current accepted event and its trusted attestation 5ms
     ✓ rejects an attestation after the issue title changes 1ms
     ✓ rejects an attestation after the issue body changes 1ms
     ✓ rejects an attestation when accepted was removed 1ms
     × rejects an attestation after the issue is closed 13ms
     ✓ rejects an attestation after accepted is re-added 17ms
     ✓ rejects a later attested approval when an earlier event was ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   getAutoApprovedRepositories,
5:   main,
6: } = require("../authorize-approval.js");
7: 
8: const originalEnvironment = { ...process.env };
9: 
10: afterEach(() => {
11:   process.env = { ...originalEnvironment };
12:   vi.restoreAllMocks();
13:   vi.resetModules();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: async function runAuthorization({ actor, issueTitle, responses }) {
21:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
22:   process.env.APPROVAL_TOKEN = "release-bot-token";
23:   process.env.APPROVAL_ACTOR = actor;
24:   process.env.APPROVAL_ISSUE_NUMBER = "123";
25:   process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26:   process.env.APPROVAL_ISSUE_TITLE = ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
5: const ATTESTATION_SUFFIX = " -->";
6: 
7: function createAttestation(prefix, value) {
8:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
9:     "base64url"
10:   )}${ATTESTATION_SUFFIX}`;
11: }
12: 
13: function requestDigest({ body, labels, title }) {
14:   if (typeof body !== "string" || !Array.isArray(labels)) {
15:     throw new Error("Invalid publish request");
16:   }
17: 
18:   return crypto
19:     .createHash("sha256")
20:     .update(
21:       JSON.stringify({
22:         body,
23:         dryRun: labels.some((label) => label.name === "dry-run"),
24:         title,
25:       })
26:     )
27:     .digest("hex");
28: }
29: 
30: function createApprovalAttestation({ actor, eventId, ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordCiReadyAttestation,
8: } = require("../record-ci-ready-attestation.js");
9: 
10: describe("recordCiReadyAttestation", () => {
11:   test("binds the current approval to the app that will add ci-ready", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordCiReadyAttestation({
16:         getAuthenticatedLogin: vi
17:           .fn()
18:           .mockResolvedValue("sentry-internal-app[bot]"),
19:         getIssue: vi.fn().mockResolvedValue({
20:           body: "Merge target: main",
21:           labels: [{ name: "accepted" }],
22:           title,
23:         }),
24:         getIssueEvents: ...

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js:
const { parsePublishTitle } = require("./details-from-context.js");

const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
const AUTO_APPROVER = "getsantry[bot]";

async function authorizeApproval({

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { parsePublishTitle } = require("./details-from-context.js");
4: 
5: async function authorizeApproval({
6:   actor,
7:   issueTitle,
8:   getPermission,
9:   autoApprovedRepositories = new Set(),
10: }) {
11:   const title = parsePublishTitle(issueTitle);
12: 
13:   if (!title) {
14:     return { authorized: false, repository: null };
15:   }
16: 
17:   const repository = `getsentry/${title.repo}`;
18:   const releasePath = `${repository}${title.path || ""}`;
19: 
20:   if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21:     return { authorized: true, repository };
22:   }
23: 
24:   if (actor === AUTO_APPROVER) {
25:     return { authorized: false, repository };
26:   }
27: 
28:   const { role_name } = await getPermission({
29:  ...

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/auto-approve.yml", "utf8");
5: 
6: describe("auto-approval workflow", () => {
7:   test("records a request-bound attestation before adding accepted", () => {
8:     expect(workflow).toContain(
9:       "node src/publish/record-auto-approval-attestation.js"
10:     );
11:     expect(
12:       workflow.indexOf("record-auto-approval-attestation.js")
13:     ).toBeLessThan(workflow.indexOf("--add-label accepted"));
14:   });
15: });

(End of file - total 15 lines)
</content>

[
  {
    "content": "Bind automated approvals to a trusted request proof",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Fence Craft execution with final live approval validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Pin Craft to immutable image digest",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/publish.yml", "utf8");
5: 
6: describe("publish workflow", () => {
7:   test("revalidates approval immediately before Craft", () => {
8:     const fence = workflow.indexOf("Revalidate approval attestation");
9: 
10:     expect(fence).toBeGreaterThan(workflow.indexOf("Set targets"));
11:     expect(fence).toBeLessThan(workflow.indexOf("Publish using Craft"));
12:     expect(workflow.slice(fence)).toContain(
13:       'REQUIRE_CI_READY_ATTESTATION: "true"'
14:     );
15:   });
16: 
17:   test("pins Craft to an immutable digest", () => {
18:     expect(workflow).toMatch(
19:       /uses: docker:\/\/getsentry\/craft@sha256:[a-f0-9]{64}/
20:     );
21:   });
22: });

(End of file - total 22 lines)
</content>

Success. Updated the following files:
M src/modules/approval-attestation.js
M src/modules/approval-authorizer.js

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js:
  if (
    issue.title !== issueTitle ||

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
45: 
46:     const pageRecords = await response.json();
47:     records.push(...pageRecords);
48: 
49:     if (pageRecords.length < 100) {
50:       return records;
51:     }
52:   }
53: }
54: 
55: async function validateApprovalAttestation({
56:   attestationAuthor,
57:   expectedAcceptedEvent,
58:   issueNumber,
59:   issueTitle,
60:   repository,
61:   requireCiReadyAttestation = false,
62: }) {
63:   const [issue, events, comments] = await Promise.all([
64:     getIssue({ repository, issueNumber }),
65:     getAllPages({ repository, issueNumber, resource: "events" }),
66:     getAllPages({ repository, issueNumber, resource: "comments" }),
67:   ]);
68:   const event = currentAcceptedEvent(events);
69:   const ciReadyEvent = currentCiReadyEvent(events);
70: 
71:   const approved =
72:     issue.title === issueTitle &&
73:     issue.labels.some((label) => label.name ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
30: async function recordCiReadyAttestation({
31:   expectedAcceptedEvent,
32:   getAuthenticatedLogin,
33:   getIssue,
34:   getIssueEvents,
35:   issueNumber,
36:   issueTitle,
37:   repository,
38: }) {
39:   const [issue, events, ciReadyActor] = await Promise.all([
40:     getIssue({ repository, issueNumber }),
41:     getIssueEvents({ repository, issueNumber }),
42:     getAuthenticatedLogin(),
43:   ]);
44:   const acceptedEvent = currentAcceptedEvent(events);
45: 
46:   if (
47:     issue.title !== issueTitle ||
48:     !issue.labels.some((label) => label.name === "accepted") ||
49:     !acceptedEvent ||
50:     (expectedAcceptedEvent &&
51:       (acceptedEvent.actor !== expectedAcceptedEvent.actor ||
52:         acceptedEvent.eventId !== expectedAcceptedEvent.eventId))
53:   ) {
54:     throw new Error("The approval changed before CI could be marked ...

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js:
  const repository = `getsentry/${title.repo}`;
  const releasePath = `${repository}${title.path || ""}`;

  if (AUTO_APPROVERS.has(actor) || actor === AUTO_APPROVAL_LABELER) {
    return { authorized: false, repository };
  }

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const { parsePublishTitle } = require("./details-from-context.js");
3: 
4: const AUTO_APPROVAL_LABELER = "sentry-internal-app[bot]";
5: const AUTO_APPROVERS = new Set(["getsantry[bot]", "sentry-release-bot[bot]"]);
6: 
7: function isAutoApprovedRepository({
8:   actor,
9:   autoApprovedRepositories,
10:   issueTitle,
11: }) {
12:   if (!AUTO_APPROVERS.has(actor)) {
13:     return false;
14:   }
15: 
16:   const title = parsePublishTitle(issueTitle);
17: 
18:   if (!title) {
19:     return false;
20:   }
21: 
22:   return autoApprovedRepositories.has(
23:     `getsentry/${title.repo}${title.path || ""}`
24:   );
25: }
26: 
27: async function authorizeApproval({
28:   actor,
29:   issueTitle,
30:   getPermission,
31:   autoApprovedRepositories = new Set(),
32: }) {
33:   const title = ...

Success. Updated the following files:
M src/modules/approval-authorizer.js
M src/publish/validate-approval-attestation.js
M src/publish/record-ci-ready-attestation.js

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const { authorizeApproval } = require("../approval-authorizer.js");
4: 
5: const issueTitle = "publish: getsentry/sentry-javascript@10.0.0";
6: 
7: describe("authorizeApproval", () => {
8:   test("allows the auto-approval bot for an allowlisted release without a target repository lookup", async () => {
9:     const getPermission = vi.fn();
10: 
11:     await expect(
12:       authorizeApproval({
13:         actor: "getsantry[bot]",
14:         issueTitle,
15:         getPermission,
16:         autoApprovedRepositories: new Set(["getsentry/sentry-javascript"]),
17:       })
18:     ).resolves.toEqual({
19:       authorized: true,
20:       repository: "getsentry/sentry-javascript",
21:     });
22: 
23:     expect(getPermission).not.toHaveBeenCalled();
24:   });
25: 
26:   test("rejects the auto-approval bot ...

Success. Updated the following files:
A src/publish/__tests__/record-auto-approval-attestation.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/record-auto-approval-attestation.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/record-auto-approval-attestation.js (0 test)

 Test Files  1 failed (1)
      Tests  no tests
   Start at  19:22:00
   Duration  243ms (transform 22ms, setup 0ms, import 0ms, tests 0ms, environment 0ms)

info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

⎯⎯⎯⎯⎯⎯ Failed Suites 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/record-auto-approval-attestation.js [ src/publish/__tests__/record-auto-approval-attestation.js ]
Error: Cannot find module '../record-auto-approval-attestation.js'
Require stack:
- ...

Success. Updated the following files:
A src/publish/record-auto-approval-attestation.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/record-auto-approval-attestation.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/record-auto-approval-attestation.js (2 tests) 9ms

 Test Files  1 passed (1)
      Tests  2 passed (2)
   Start at  19:22:37
   Duration  239ms (transform 23ms, setup 0ms, import 43ms, tests 9ms, environment 0ms)

Done in 0.78s.

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const AUTO_APPROVAL_ATTESTATION_PREFIX = "<!-- publish-auto-approval ";
5: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
6: const ATTESTATION_SUFFIX = " -->";
7: 
8: function createAttestation(prefix, value) {
9:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
10:     "base64url"
11:   )}${ATTESTATION_SUFFIX}`;
12: }
13: 
14: function requestDigest({ body, labels, title }) {
15:   if (typeof body !== "string" || !Array.isArray(labels)) {
16:     throw new Error("Invalid publish request");
17:   }
18: 
19:   return crypto
20:     .createHash("sha256")
21:     .update(
22:       JSON.stringify({
23:         body,
24:         dryRun: labels.some((label) => label.name === "dry-run"),
25:         title,
26:       })
27:     )
28:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   getAutoApprovedRepositories,
5:   main,
6: } = require("../authorize-approval.js");
7: 
8: const originalEnvironment = { ...process.env };
9: 
10: afterEach(() => {
11:   process.env = { ...originalEnvironment };
12:   vi.restoreAllMocks();
13:   vi.resetModules();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: async function runAuthorization({ actor, issueTitle, responses }) {
21:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
22:   process.env.APPROVAL_TOKEN = "release-bot-token";
23:   process.env.APPROVAL_ACTOR = actor;
24:   process.env.APPROVAL_ISSUE_NUMBER = "123";
25:   process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26:   process.env.APPROVAL_ISSUE_TITLE = ...

Success. Updated the following files:
M src/publish/__tests__/authorize-approval.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/authorize-approval.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/authorize-approval.js (5 tests | 1 failed) 30ms
     ✓ loads exact release paths from the auto-approval allowlist 5ms
     ✓ writes authorization after a successful GitHub permission lookup 6ms
     ✓ rejects a requester approving their own release 1ms
     × authorizes an allowlisted automated request with a request proof 14ms
     ✓ fails closed when GitHub cannot return a permission 3ms

 Test Files  1 failed (1)
      Tests  1 failed | 4 passed ...

Success. Updated the following files:
M src/publish/authorize-approval.js

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml:
          client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
          private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}

      - name: Auto approve
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
          ISSUE_TITLE: ${{ github.event.issue.title }}
          ISSUE_URL: ${{ github.event.issue.html_url }}
        run: |

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

Success. Updated the following files:
M .github/workflows/auto-approve.yml
M .github/workflows/publish.yml

yarn run v1.22.22
$ vitest run src/modules/__tests__/approval-attestation.js src/modules/__tests__/approval-authorizer.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/publish/__tests__/record-auto-approval-attestation.js src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/auto-approval-workflow.js (1 test) 4ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 61ms
 ❯ src/publish/__tests__/authorize-approval.js (5 tests | 1 failed) 64ms
     ✓ loads exact release paths from the auto-approval ...

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js:
        getIssue: vi.fn().mockResolvedValue({
          body: "",
          labels: [{ name: "accepted" }],
          title,

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordCiReadyAttestation,
8: } = require("../record-ci-ready-attestation.js");
9: 
10: describe("recordCiReadyAttestation", () => {
11:   test("binds the current approval to the app that will add ci-ready", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordCiReadyAttestation({
16:         getAuthenticatedLogin: vi
17:           .fn()
18:           .mockResolvedValue("sentry-internal-app[bot]"),
19:         getIssue: vi.fn().mockResolvedValue({
20:           body: "Merge target: main",
21:           labels: [{ name: "accepted" }],
22:           title,
23:         }),
24:         getIssueEvents: ...

Success. Updated the following files:
M src/publish/__tests__/authorize-approval.js
M src/publish/__tests__/record-ci-ready-attestation.js

yarn run v1.22.22
$ vitest run src/modules/__tests__/approval-attestation.js src/modules/__tests__/approval-authorizer.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/publish/__tests__/record-auto-approval-attestation.js src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/record-ci-ready-attestation.js (3 tests) 17ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 29ms
 ✓ src/publish/__tests__/authorize-approval.js (5 tests) 37ms
 ✓ src/modules/__tests__/approval-authorizer.js (14 ...

Success. Updated the following files:
M .github/workflows/auto-approve.yml
M src/publish/__tests__/auto-approval-workflow.js

Success. Updated the following files:
M src/publish/record-auto-approval-attestation.js

Success. Updated the following files:
M src/publish/record-auto-approval-attestation.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/record-auto-approval-attestation.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/record-auto-approval-attestation.js (2 tests) 12ms
 ✓ src/publish/__tests__/publish-workflow.js (2 tests) 17ms
 ✓ src/publish/__tests__/authorize-approval.js (5 tests) 36ms
 ❯ src/publish/__tests__/auto-approval-workflow.js (2 tests | 1 failed) 15ms
     ✓ records a request-bound attestation before adding accepted 2ms
     × posts the proof as ...

Success. Updated the following files:
M src/publish/__tests__/auto-approval-workflow.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/record-auto-approval-attestation.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/auto-approval-workflow.js (2 tests) 7ms
 ✓ src/publish/__tests__/publish-workflow.js (2 tests) 4ms
 ✓ src/publish/__tests__/authorize-approval.js (5 tests) 23ms
 ✓ src/publish/__tests__/record-auto-approval-attestation.js (2 tests) 8ms

 Test Files  4 passed (4)
      Tests  11 passed (11)
   Start at  19:32:45
   Duration  ...

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 23ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 44ms
 ✓ src/modules/__tests__/approval-authorizer.js (14 tests) 26ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 54ms
 ✓ src/modules/__tests__/post-workflow-details.js (1 test) 23ms
 ✓ src/publish/__tests__/authorize-approval.js (5 tests) 44ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 106ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
error Command failed with exit code 1.

(no output)

[
  {
    "content": "Bind automated approvals to a trusted request proof",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Fence Craft execution with final live approval validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Pin Craft to immutable image digest",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f7d7bf89dffes00ySxTn1Cn6CR" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f7d7bf89dffes00ySxTn1Cn6CR" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f7d7bf89dffes00ySxTn1Cn6CR" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Reject direct automated approval labels",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const { parsePublishTitle } = require("./details-from-context.js");
3: 
4: const AUTO_APPROVAL_LABELER = "sentry-internal-app[bot]";
5: const AUTO_APPROVERS = new Set(["getsantry[bot]", "sentry-release-bot[bot]"]);
6: 
7: function isAutoApprovedRepository({
8:   actor,
9:   autoApprovedRepositories,
10:   issueTitle,
11: }) {
12:   if (!AUTO_APPROVERS.has(actor)) {
13:     return false;
14:   }
15: 
16:   const title = parsePublishTitle(issueTitle);
17: 
18:   if (!title) {
19:     return false;
20:   }
21: 
22:   return autoApprovedRepositories.has(
23:     `getsentry/${title.repo}${title.path || ""}`
24:   );
25: }
26: 
27: async function authorizeApproval({
28:   actor,
29:   issueTitle,
30:   getPermission,
31:   autoApprovedRepositories = new Set(),
32: }) {
33:   const title = ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const { authorizeApproval } = require("../approval-authorizer.js");
4: 
5: const issueTitle = "publish: getsentry/sentry-javascript@10.0.0";
6: 
7: describe("authorizeApproval", () => {
8:   test("allows the auto-approval bot for an allowlisted release without a target repository lookup", async () => {
9:     const getPermission = vi.fn();
10: 
11:     await expect(
12:       authorizeApproval({
13:         actor: "getsantry[bot]",
14:         issueTitle,
15:         getPermission,
16:         autoApprovedRepositories: new Set(["getsentry/sentry-javascript"]),
17:       })
18:     ).resolves.toEqual({
19:       authorized: true,
20:       repository: "getsentry/sentry-javascript",
21:     });
22: 
23:     expect(getPermission).not.toHaveBeenCalled();
24:   });
25: 
26:   test("rejects the auto-approval bot ...

Success. Updated the following files:
M src/modules/__tests__/approval-authorizer.js
M src/publish/__tests__/authorize-approval.js

yarn run v1.22.22
$ vitest run src/modules/__tests__/approval-authorizer.js src/publish/__tests__/authorize-approval.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/modules/__tests__/approval-authorizer.js (15 tests | 2 failed) 28ms
     × rejects direct approval by getsantry[bot] without a target repository lookup 13ms
     × rejects direct approval by sentry-release-bot[bot] without a target repository lookup 2ms
     ✓ rejects the auto-approval bot for a release outside the allowlist 1ms
     ✓ allows a target repository write collaborator 1ms
     ✓ allows a target repository maintain collaborator 0ms
     ✓ allows a target repository admin collaborator ...

Success. Updated the following files:
M src/modules/approval-authorizer.js

yarn run v1.22.22
$ vitest run src/modules/__tests__/approval-authorizer.js src/publish/__tests__/authorize-approval.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/authorize-approval.js (6 tests) 19ms
 ✓ src/modules/__tests__/approval-authorizer.js (15 tests) 16ms

 Test Files  2 passed (2)
      Tests  21 passed (21)
   Start at  20:05:54
   Duration  315ms (transform 42ms, setup 0ms, import 104ms, tests 34ms, environment 3ms)

Done in 0.78s.

[
  {
    "content": "Reject direct automated approval labels",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 26ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 21ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 12ms
 ✓ src/modules/__tests__/post-workflow-details.js (1 test) 13ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 47ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 20ms
 ✓ src/publish/__tests__/authorize-approval.js (6 tests) 18ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js
  31:3  error  'autoApprovedRepositories' is assigned a value but never used  no-unused-vars

✖ 2 problems (2 errors, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

Success. Updated the following files:
M src/modules/approval-authorizer.js

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 40ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 20ms
 ✓ src/modules/__tests__/approval-authorizer.js (15 tests) 17ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 54ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 48ms
 ✓ src/modules/__tests__/post-workflow-details.js (1 test) 12ms
 ✓ src/publish/__tests__/authorize-approval.js (6 tests) 19ms
 ✓ ...

(no output)

[
  {
    "content": "Reject direct automated approval labels",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f7d5e0aeeffexmp5VuTqP40NUa" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Validate CI-poller dispatch attempt input",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Pin secret-bearing actions to commit SHAs",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Add negative auto-approval provenance regression",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   workflow_dispatch:
7:     inputs:
8:       attempt:
9:         description: Self-dispatch attempt counter (internal use)
10:         required: false
11:         default: "0"
12: 
13: permissions:
14:   contents: read
15:   issues: write
16: 
17: jobs:
18:   check-ci:
19:     runs-on: ubuntu-latest
20:     environment: production
21:     # Skip entirely (no runner provisioned) when there's nothing to check.
22:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
23:     # Always allow workflow_dispatch for manual recovery.
24:     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
25:     concurrency:
26:       group: ci-status-poller
27:       cancel-in-progress: false
28:     steps:
29:       - name: Get publish code
30:         uses: ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/ci-poller.yml", "utf8");
5: 
6: describe("CI poller workflow", () => {
7:   test("checks out trusted code before requesting app tokens", () => {
8:     expect(workflow).toMatch(
9:       /- name: Get publish code\n\s+uses: actions\/checkout@v6\n\s+with:\n(?:\s+#.*\n)*\s+ref: \$\{\{ github\.event\.repository\.default_branch \}\}/
10:     );
11: 
12:     expect(workflow.indexOf("Get publish code")).toBeLessThan(
13:       workflow.indexOf("Get auth token")
14:     );
15:   });
16: });

(End of file - total 16 lines)
</content>

11d5960a326750d5838078e36cf38b85af677262	refs/tags/v4
d23441a48e516b6c34aea4fa41551a30e30af803	refs/tags/v6

49933ea5288caeca8642d1e84afbd3f7d6820020	refs/tags/v4
a0853c24544627f65ddf259abe73b1d18a591444	refs/tags/v5
bcd2ba49218906704ab6c1aa796996da409d3eb1	refs/tags/v3

Found 18 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 36:         uses: actions/checkout@v6

  Line 42:         uses: actions/create-github-app-token@v3

  Line 52:         uses: actions/create-github-app-token@v3

  Line 149:         uses: actions/create-github-app-token@v3

  Line 191:         uses: actions/checkout@v6

  Line 222:         uses: actions/setup-node@v6

  Line 267:         uses: actions/create-github-app-token@v3

  Line 273:       - uses: actions/checkout@v6

  Line 352:       - uses: docker://getsentry/craft@sha256:9a4a5d5efa44a00c2215078ead39800d4aaa5a97908b94f45a64d7d506d6e14b


/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml:
  Line 30:         uses: actions/checkout@v6

  Line 41:         uses: actions/create-github-app-token@v3

  Line 52:         uses: actions/create-github-app-token@v3

  Line 401:         uses: ...

249970729cb0ef3589644e2896645e5dc5ba9c38	refs/tags/v6
0057852bfaa89a56745cba8c7296529d2fc39830	refs/tags/v4

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   createAutoApprovalAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   getAutoApprovedRepositories,
8:   main,
9: } = require("../authorize-approval.js");
10: 
11: const originalEnvironment = { ...process.env };
12: 
13: afterEach(() => {
14:   process.env = { ...originalEnvironment };
15:   vi.restoreAllMocks();
16:   vi.resetModules();
17: });
18: 
19: function jsonResponse(json) {
20:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
21: }
22: 
23: async function runAuthorization({ actor, issueTitle, responses }) {
24:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
25:   process.env.APPROVAL_TOKEN = "release-bot-token";
26:   process.env.APPROVAL_ACTOR = actor;
27:   process.env.APPROVAL_ISSUE_NUMBER = ...

Success. Updated the following files:
M src/publish/__tests__/ci-poller-workflow.js
A src/publish/__tests__/workflow-action-pinning.js
M src/publish/__tests__/authorize-approval.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/ci-poller-workflow.js src/publish/__tests__/workflow-action-pinning.js src/publish/__tests__/authorize-approval.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/ci-poller-workflow.js (2 tests | 2 failed) 13ms
     × checks out trusted code before requesting app tokens 10ms
     × validates workflow dispatch attempts before requesting app tokens 1ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 22ms
 ❯ src/publish/__tests__/workflow-action-pinning.js (4 tests | 3 failed) 13ms
     × pins actions in '.github/workflows/auto-approve.yml' ...

Success. Updated the following files:
M .github/workflows/auto-approve.yml
M .github/workflows/ci-poller.yml
M .github/workflows/publish.yml
M .github/workflows/test.yml
M src/publish/__tests__/workflow-action-pinning.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/ci-poller-workflow.js src/publish/__tests__/workflow-action-pinning.js src/publish/__tests__/authorize-approval.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/ci-poller-workflow.js (2 tests) 5ms
 ✓ src/publish/__tests__/workflow-action-pinning.js (4 tests) 11ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 18ms

 Test Files  3 passed (3)
      Tests  13 passed (13)
   Start at  20:22:39
   Duration  414ms (transform 44ms, setup 0ms, import 95ms, tests 33ms, environment 1ms)

Done in 0.90s.

[
  {
    "content": "Validate CI-poller dispatch attempt input",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Pin secret-bearing actions to commit SHAs",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add negative auto-approval provenance regression",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 27ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 36ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 12ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 24ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 57ms
 ✓ src/modules/__tests__/approval-authorizer.js (15 tests) 22ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 19ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

(no output)

[
  {
    "content": "Validate CI-poller dispatch attempt input",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Pin secret-bearing actions to commit SHAs",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add negative auto-approval provenance regression",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run regressions and full validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f7d4f2252ffeo6YHd6C4k3sHH7" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

Success. Updated the following files:
M src/publish/__tests__/ci-poller-workflow.js

yarn run v1.22.22
$ vitest run src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/ci-poller-workflow.js (0 test)

⎯⎯⎯⎯⎯⎯ Failed Suites 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/ci-poller-workflow.js [ src/publish/__tests__/ci-poller-workflow.js ]
Error: ENOENT: no such file or directory, open '.github/workflows/ci-poller-dispatch.yml'
 ❯ src/publish/__tests__/ci-poller-workflow.js:5:44
      3| 
      4| const workflow = readFileSync(".github/workflows/ci-poller.yml", "utf8…
      5| const manualDispatchWorkflow = readFileSync(
       |                                            ^
      6|   ...

Success. Updated the following files:
M src/publish/__tests__/ci-poller-workflow.js
M .github/workflows/ci-poller.yml
A .github/workflows/ci-poller-dispatch.yml
M .github/workflows/publish.yml

Success. Updated the following files:
M src/publish/__tests__/ci-poller-workflow.js
M .github/workflows/ci-poller.yml
M .github/workflows/ci-poller-dispatch.yml

[
  {
    "content": "Secure manual dispatch relay and attempt parsing",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Verify workflow trigger and action pinning contracts",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ vitest run src/publish/__tests__/ci-poller-workflow.js src/publish/__tests__/workflow-action-pinning.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/ci-poller-workflow.js (3 tests) 11ms
 ✓ src/publish/__tests__/publish-workflow.js (2 tests) 4ms
 ✓ src/publish/__tests__/workflow-action-pinning.js (4 tests) 6ms

 Test Files  3 passed (3)
      Tests  9 passed (9)
   Start at  20:38:54
   Duration  419ms (transform 39ms, setup 0ms, import 106ms, tests 22ms, environment 4ms)

Done in 0.95s.

[
  {
    "content": "Secure manual dispatch relay and attempt parsing",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Verify workflow trigger and action pinning contracts",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 40ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 67ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 34ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 38ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 46ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 13ms
 ✓ src/modules/__tests__/approval-authorizer.js (15 tests) 18ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

(no output)

[
  {
    "content": "Secure manual dispatch relay and attempt parsing",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Verify workflow trigger and action pinning contracts",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f7d406e55ffeHFIQeUpNhZ5EEt" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Eliminate untrusted workflow dispatch secret paths",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Add trusted trigger regression coverage",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   repository_dispatch:
7:     types: [ci-poller]
8:   workflow_run:
9:     workflows: [Run CI Status Poller]
10:     types: [completed]
11: 
12: permissions:
13:   contents: read
14:   issues: write
15: 
16: jobs:
17:   check-ci:
18:     runs-on: ubuntu-latest
19:     environment: production
20:     # Skip entirely (no runner provisioned) when there's nothing to check.
21:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
22:     # Always allow the workflow_dispatch relay for manual recovery.
23:     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_run' || github.event_name == 'repository_dispatch'
24:     concurrency:
25:       group: ci-status-poller
26:       cancel-in-progress: false
27:     steps:
28:       - name: Validate dispatch attempt
29:   ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller-dispatch.yml</path>
<type>file</type>
<content>
1: name: Run CI Status Poller
2: 
3: on:
4:   workflow_dispatch:
5: 
6: permissions: {}
7: 
8: jobs:
9:   dispatch:
10:     runs-on: ubuntu-latest
11:     steps:
12:       - run: true

(End of file - total 12 lines)
</content>

<path>/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml</path>
<type>file</type>
<content>
1: name: "CocoaPods Token Keep-Alive"
2: 
3: on:
4:   schedule:
5:     # CocoaPods sessions currently expire after 3 days of inactivity (VALIDITY_LENGTH)
6:     # This runs every day at midnight UTC to keep the current token alive
7:     # See: https://github.com/CocoaPods/trunk.cocoapods.org/blob/a1869790e9ae2229b6985b6af4532da814202558/app/models/session.rb#L9
8:     - cron: "0 0 * * *" # Runs every day at midnight UTC
9:   workflow_dispatch:
10: 
11: permissions:
12:   contents: read
13: 
14: jobs:
15:   keepalive:
16:     name: Refresh CocoaPods Session
17:     runs-on: macos-15
18:     environment: production
19:     env:
20:       COCOAPODS_TRUNK_TOKEN: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}
21: 
22:     steps:
23:       - name: Install CocoaPods
24:         run: gem install cocoapods
25:       - name: Print CocoaPods Version
26:         run: pod --version
27:       ...

Found 2 matches
/home/byk/Code/getsentry/publish/.github/workflows/ci-poller-dispatch.yml:
  Line 4:   workflow_dispatch:


/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml:
  Line 9:   workflow_dispatch:

 M .github/workflows/auto-approve.yml
 M .github/workflows/ci-poller.yml
 M .github/workflows/publish.yml
 M .github/workflows/test.yml
 M AGENTS.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/__tests__/details-from-context.js
 M src/modules/__tests__/update-issue.js
 M src/modules/details-from-context.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .github/workflows/ci-poller-dispatch.yml
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? src/publish/authorize-approval.js
?? src/publish/current-accepted-event.js
?? src/publish/record-auto-approval-attestation.js
?? src/publish/record-ci-ready-attestation.js
?? ...

User has answered your questions: "For safe manual dispatch, should I require all workflow secrets to live in the protected `production` environment (restricted to the default branch), then retain the no-secret `workflow_dispatch` relay?"="Use protected environment (Recommended)". You can now continue with the user's answers in mind.

[
  {
    "content": "Verify production environment secret policy",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Constrain secret-bearing workflows to production",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Add trusted trigger regression coverage",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

{"id":9871907870,"node_id":"EN_kwDOEgGvjc8AAAACTGlcHg","name":"production","url":"https://api.github.com/repos/getsentry/publish/environments/production","html_url":"https://github.com/getsentry/publish/deployments/activity_log?environments_filter=production","created_at":"2025-11-10T21:33:16Z","updated_at":"2025-11-10T21:33:16Z","can_admins_bypass":true,"protection_rules":[{"id":42720759,"node_id":"GA_kwDOEgGvjc4Ci933","type":"branch_policy"}],"deployment_branch_policy":{"protected_branches":false,"custom_branch_policies":true}}

{"total_count":1,"branch_policies":[{"id":38207111,"node_id":"MDE2OkdhdGVCcmFuY2hQb2xpY3kzODIwNzExMQ==","name":"main","type":"branch"}]}

AWS_ACCESS_KEY_ID	2026-02-05T12:36:05Z
AWS_SECRET_ACCESS_KEY	2026-02-05T12:36:06Z
CI_POLLER_APP_PRIVATE_KEY	2026-04-13T14:24:43Z
CLOUDFLARE_API_TOKEN	2026-08-04T11:12:51Z
COCOAPODS_TRUNK_TOKEN	2026-02-11T16:19:44Z
CRAFT_GCS_STORE_CREDS_JSON	2026-02-05T12:35:59Z
CRAFT_GCS_TARGET_CREDS_JSON	2026-02-05T12:35:59Z
CRATES_IO_TOKEN	2026-02-05T12:36:00Z
DOCKER_PASSWORD	2026-02-05T12:36:01Z
GEM_HOST_API_KEY	2026-02-05T12:36:04Z
GPG_PASSPHRASE	2026-02-05T12:36:09Z
GPG_PRIVATE_KEY	2026-02-05T12:36:09Z
HEX_API_KEY	2026-02-05T12:36:02Z
NPM_TOKEN	2026-08-05T10:19:49Z
NUGET_API_TOKEN	2026-08-17T08:25:27Z
OSSRH_PASSWORD	2026-02-05T12:36:11Z
OSSRH_USERNAME	2026-02-05T12:36:10Z
POWERSHELL_API_KEY	2026-02-05T12:36:08Z
PUBDEV_ACCESS_TOKEN	2026-02-05T12:36:11Z
PUBDEV_REFRESH_TOKEN	2026-02-05T12:36:12Z
SENTRY_RELEASE_BOT_PRIVATE_KEY	2026-02-05T12:35:57Z
TWINE_PASSWORD	2026-02-05T12:36:02Z
VERCEL_TOKEN	2026-08-07T22:27:56Z

Found 36 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 45:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}

  Line 55:           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}

  Line 152:           private-key: ${{ secrets.CI_POLLER_APP_PRIVATE_KEY }}

  Line 239:           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  Line 271:           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}

  Line 381:           DOCKER_GHCR_IO_PASSWORD: ${{ secrets.GITHUB_TOKEN }} # for ghcr.io auth

  Line 383:           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

  Line 384:           COCOAPODS_TRUNK_TOKEN: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}

  Line 385:           CRAFT_GCS_TARGET_CREDS_JSON: ${{ secrets.CRAFT_GCS_TARGET_CREDS_JSON }}

  Line 386:           CRAFT_GCS_STORE_CREDS_JSON: ${{ secrets.CRAFT_GCS_STORE_CREDS_JSON }}

  Line 387:           CRATES_IO_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}

  Line 389:   ...

{"message":"Invalid request.\n\nInvalid property /can_admins_bypass: `\"false\"` is not of type `boolean`.","documentation_url":"https://docs.github.com/rest/deployments/environments#create-or-update-an-environment","status":"422"}gh: Invalid request.

Invalid property /can_admins_bypass: `"false"` is not of type `boolean`. (HTTP 422)

{"id":9871907870,"node_id":"EN_kwDOEgGvjc8AAAACTGlcHg","name":"production","url":"https://api.github.com/repos/getsentry/publish/environments/production","html_url":"https://github.com/getsentry/publish/deployments/activity_log?environments_filter=production","created_at":"2025-11-10T21:33:16Z","updated_at":"2026-09-08T20:55:15Z","can_admins_bypass":false,"protection_rules":[{"id":42720759,"node_id":"GA_kwDOEgGvjc4Ci933","type":"branch_policy"}],"deployment_branch_policy":{"protected_branches":false,"custom_branch_policies":true}}

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/workflow-action-pinning.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflows = [
5:   ".github/workflows/auto-approve.yml",
6:   ".github/workflows/ci-poller.yml",
7:   ".github/workflows/publish.yml",
8:   ".github/workflows/test.yml",
9: ].map((path) => ({ path, contents: readFileSync(path, "utf8") }));
10: 
11: describe("workflow action pinning", () => {
12:   test.each(workflows)("pins actions in $path", ({ contents }) => {
13:     const actionReferences = contents.matchAll(
14:       /^\s+(?:- )?uses: actions\/[^\s@]+@([^\s]+)$/gm
15:     );
16: 
17:     for (const [, revision] of actionReferences) {
18:       expect(revision).toMatch(/^[a-f0-9]{40}$/);
19:     }
20:   });
21: });

(End of file - total 21 lines)
</content>

{"default_workflow_permissions":"write","can_approve_pull_request_reviews":true}failed to get secrets: HTTP 403: You must be an org admin or have the actions secrets fine-grained permission. (https://api.github.com/orgs/getsentry/actions/secrets?per_page=100)

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8:   issues: write
9: 
10: jobs:
11:   auto-approve:
12:     runs-on: ubuntu-latest
13:     if: |
14:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
15:       startsWith(github.event.issue.title, 'publish: ')
16:     steps:
17:       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
18:         with:
19:           sparse-checkout: auto-approve-repos.txt
20:           sparse-checkout-cone-mode: false
21:       - name: Get auth token
22:         id: token
23:         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
24:         with:
25:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
26:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
27:       - name: ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/test.yml</path>
<type>file</type>
<content>
1: name: Test
2: on:
3:   push:
4:     branches:
5:       - main
6:   pull_request:
7: 
8: permissions:
9:   contents: read
10: 
11: defaults:
12:   run:
13:     shell: bash
14: jobs:
15:   unit-test:
16:     runs-on: ubuntu-latest
17:     name: unit tests
18:     steps:
19:       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
20:       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
21:         with:
22:           node-version: 24
23:       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
24:         id: cache
25:         with:
26:           path: node_modules
27:           key: ${{ runner.os }}-node_modules-${{ hashFiles('package.json', 'yarn.lock') }}
28: 
29:       - name: Install Dependencies
30:         if: steps.cache.outputs.cache-hit != 'true'
31:         run: yarn install --frozen-lockfile
32: 
33:       - name: Test
34:    ...

Success. Updated the following files:
M .github/workflows/auto-approve.yml
M .github/workflows/cocoapods-keepalive.yml
D .github/workflows/ci-poller-dispatch.yml
M .github/workflows/ci-poller.yml
M src/publish/__tests__/ci-poller-workflow.js
M src/publish/__tests__/workflow-action-pinning.js

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/ci-poller.yml", "utf8");
5: 
6: describe("CI poller workflow", () => {
7:   test("checks out trusted code before requesting app tokens", () => {
8:     expect(workflow).toMatch(
9:       /- name: Get publish code\n\s+uses: actions\/checkout@[a-f0-9]{40}\n\s+with:\n(?:\s+#.*\n)*\s+ref: \$\{\{ github\.event\.repository\.default_branch \}\}/
10:     );
11: 
12:     expect(workflow.indexOf("Get publish code")).toBeLessThan(
13:       workflow.indexOf("Get auth token")
14:     );
15:   });
16: 
17:   test("uses a trusted repository dispatch for manual recovery", () => {
18:     expect(workflow).toContain("repository_dispatch:");
19:     expect(workflow).toContain("types: [ci-poller]");
20:     ...

Success. Updated the following files:
A .github/workflows/ci-poller-dispatch.yml
M .github/workflows/cocoapods-keepalive.yml
M src/publish/__tests__/ci-poller-workflow.js
M src/publish/__tests__/workflow-action-pinning.js

Success. Updated the following files:
M .github/workflows/ci-poller.yml
M src/publish/__tests__/ci-poller-workflow.js
M src/publish/__tests__/workflow-action-pinning.js

# Use GITHUB_TOKEN for authentication in workflows

Learn how to use the GITHUB_TOKEN to authenticate on behalf of GitHub Actions.

This tutorial leads you through how to use the `GITHUB_TOKEN` for authentication in GitHub Actions workflows, including examples for passing the token to actions, making API requests, and configuring permissions for secure automation.

For reference information, see [Workflow syntax for GitHub Actions](/en/actions/reference/workflows-and-actions/workflow-syntax#permissions).

## Using the `GITHUB_TOKEN` in a workflow

You can use the `GITHUB_TOKEN` by using the standard syntax for referencing secrets: `${{ secrets.GITHUB_TOKEN }}`. Examples of using the `GITHUB_TOKEN` include passing the token as an input to an action, or using it to make an authenticated GitHub API request.

> \[!IMPORTANT]
> An action can access the `GITHUB_TOKEN` through the `github.token` context even if the workflow does not explicitly pass the `GITHUB_TOKEN` to the action. ...

/home/byk/Code/getsentry/publish/.lore.md
/home/byk/Code/getsentry/publish/README.md
/home/byk/Code/getsentry/publish/AGENTS.md
/home/byk/Code/getsentry/publish/docs/rfc.md
/home/byk/Code/getsentry/publish/docs/key_rotation_vault_changes.md

<path>/home/byk/Code/getsentry/publish/README.md</path>
<type>file</type>
<content>
1: # Sentry Publish 🏠
2: 
3: This is a meta/control repository that implements the [Central Publish Repository](docs/rfc.md) RFC
4: 
5: ## Quick Start
6: 
7: [craft quick start](https://craft.sentry.dev/github-actions/)
8: 
9: ## Release Flow
10: 
11: ```mermaid
12: flowchart TD
13:     A[Developer triggers release workflow] --> B["SDK Repo: craft prepare"]
14:     B --> C[Build artifacts & create release branch]
15:     C --> D[Upload artifacts to GitHub]
16:     D --> E["Create issue in getsentry/publish"]
17:     E --> F{Release Manager Review}
18:     F -->|"Add 'accepted' label"| G[Publish workflow triggers]
19:     G --> I[Download artifacts from GitHub]
20:     I --> J["craft publish to registries"]
21:     J --> K{Publish successful?}
22:     K -->|Yes| L[Issue closed - success]
23:     K -->|No| M[Issue updated with failure]
24: ```
25: 
26: ## Goals
27: 
28: 1. ...

Success. Updated the following files:
M README.md

[
  {
    "content": "Verify production environment secret policy",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Constrain secret-bearing workflows to production",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add trusted trigger regression coverage",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/ci-poller-workflow.js src/publish/__tests__/workflow-action-pinning.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/ci-poller-workflow.js (3 tests) 10ms
 ✓ src/publish/__tests__/workflow-action-pinning.js (16 tests) 8ms

 Test Files  2 passed (2)
      Tests  19 passed (19)
   Start at  21:02:50
   Duration  449ms (transform 33ms, setup 0ms, import 74ms, tests 18ms, environment 0ms)

Done in 0.95s.

<path>/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml</path>
<type>file</type>
<content>
1: name: CocoaPods Token Keep-Alive
2: 
3: on:
4:   schedule:
5:     # CocoaPods sessions currently expire after 3 days of inactivity (VALIDITY_LENGTH)
6:     # This runs every day at midnight UTC to keep the current token alive
7:     # See: https://github.com/CocoaPods/trunk.cocoapods.org/blob/a1869790e9ae2229b6985b6af4532da814202558/app/models/session.rb#L9
8:     - cron: "0 0 * * *" # Runs every day at midnight UTC
9: 
10: permissions:
11:   contents: read
12: 
13: jobs:
14:   keepalive:
15:     name: Refresh CocoaPods Session
16:     runs-on: macos-15
17:     environment: production
18:     env:
19:       COCOAPODS_TRUNK_TOKEN: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}
20: 
21:     steps:
22:       - name: Install CocoaPods
23:         run: gem install cocoapods
24:       - name: Print CocoaPods Version
25:         run: pod --version
26:       - name: Refresh CocoaPods ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller-dispatch.yml</path>
<type>file</type>
<content>
1: name: Run CI Status Poller
2: 
3: on:
4:   workflow_dispatch:
5: 
6: permissions: {}
7: 
8: jobs:
9:   dispatch:
10:     # production only permits deployments from main. Repository secrets must
11:     # never be used by this workflow; protected environment secrets enforce
12:     # that an arbitrary dispatched ref cannot add them.
13:     environment: production
14:     runs-on: ubuntu-latest
15:     steps:
16:       - run: true

(End of file - total 16 lines)
</content>

Success. Updated the following files:
M .github/workflows/ci-poller-dispatch.yml
M src/publish/__tests__/workflow-action-pinning.js

Success. Updated the following files:
M .github/workflows/ci-poller.yml
M src/publish/__tests__/ci-poller-workflow.js
M src/publish/__tests__/workflow-action-pinning.js

Success. Updated the following files:
M .github/workflows/cocoapods-keepalive.yml

[
  {
    "content": "Verify production environment secret policy",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Constrain secret-bearing workflows to production",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add trusted trigger regression coverage",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/modules/__tests__/approval-authorizer.js (15 tests) 25ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 21ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 20ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 55ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 103ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 25ms
 ✓ src/modules/__tests__/post-workflow-details.js (1 test) 20ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

 M .github/workflows/auto-approve.yml
 M .github/workflows/ci-poller.yml
 M .github/workflows/cocoapods-keepalive.yml
 M .github/workflows/publish.yml
 M .github/workflows/test.yml
 M AGENTS.md
 M README.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/__tests__/details-from-context.js
 M src/modules/__tests__/update-issue.js
 M src/modules/details-from-context.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .github/workflows/ci-poller-dispatch.yml
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? src/publish/authorize-approval.js
?? src/publish/current-accepted-event.js
?? ...

[
  {
    "content": "Verify production environment secret policy",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Constrain secret-bearing workflows to production",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add trusted trigger regression coverage",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f7d287c61ffeoOBysv7sbnM8nN" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Verify production environment secret policy",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Constrain secret-bearing workflows to production",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add trusted trigger regression coverage",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run full validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain final independent review",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Migrate SENTRY_INTERNAL_APP_PRIVATE_KEY to production and remove broader-scoped copy",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Re-run exact-head review after secret migration",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ prettier --write src
src/libs/__tests__/github.js 73ms
src/libs/github.js 17ms
src/modules/__tests__/approval-attestation.js 54ms
src/modules/__tests__/approval-authorizer.js 30ms
src/modules/__tests__/details-from-context.js 23ms
src/modules/__tests__/post-workflow-details.js 12ms
src/modules/__tests__/process-end-state.js 29ms
src/modules/__tests__/update-issue.js 32ms
src/modules/approval-attestation.js 51ms
src/modules/approval-authorizer.js 9ms
src/modules/details-from-context.js 15ms
src/modules/post-workflow-details.js 7ms
src/modules/process-end-state.js 17ms
src/modules/update-issue.js 11ms
src/publish/__tests__/authorize-approval.js 23ms
src/publish/__tests__/auto-approval-workflow.js 3ms
src/publish/__tests__/ci-poller-workflow.js 12ms
src/publish/__tests__/current-accepted-event.js 7ms
src/publish/__tests__/publish-workflow.js 8ms
src/publish/__tests__/record-auto-approval-attestation.js 15ms
src/publish/__tests__/record-ci-ready-attestation.js ...

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 45ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 53ms
 ✓ src/modules/__tests__/post-workflow-details.js (1 test) 24ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 37ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 129ms
 ✓ src/publish/__tests__/record-ci-ready-attestation.js (3 tests) 21ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 37ms
 ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'

/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml
  1:7  error  Must use plain style scalar  yml/plain-scalar

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

<path>/home/byk/Code/getsentry/publish/.github/workflows/cocoapods-keepalive.yml</path>
<type>file</type>
<content>
1: name: "CocoaPods Token Keep-Alive"
2: 
3: on:
4:   schedule:
5:     # CocoaPods sessions currently expire after 3 days of inactivity (VALIDITY_LENGTH)
6:     # This runs every day at midnight UTC to keep the current token alive
7:     # See: https://github.com/CocoaPods/trunk.cocoapods.org/blob/a1869790e9ae2229b6985b6af4532da814202558/app/models/session.rb#L9
8:     - cron: "0 0 * * *" # Runs every day at midnight UTC
9: 
10: permissions:
11:   contents: read
12: 

(Showing lines 1-12 of 27. Use offset=13 to continue.)
</content>

Success. Updated the following files:
M .github/workflows/cocoapods-keepalive.yml

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'
Done in 1.25s.

[
  {
    "content": "Correct secret-boundary documentation for organization-level Internal App key",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run focused validation after documentation correction",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Re-run exact-head review after scope correction",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/README.md</path>
<type>file</type>
<content>
88: proper. In theory if an independent package gets sufficient independent use of Sentry we might want to reconsider an auto
89: approval process for such package as it might become an interesting target for an attacker.
90: 
91: Automatic approvals are managed in the [`auto-approve.yml`](https://github.com/getsentry/publish/blob/main/.github/workflows/auto-approve.yml) workflow.
92: 
93: ## Under the hood
94: 
95: The system uses [Craft](https://github.com/getsentry/craft) under the hood to prepare and publish releases. It uses tokens from [Sentry Release Bot](https://github.com/apps/sentry-release-bot), which is a GitHub App that is installed on all repos in `getsentry` with read and write access to code, PRs, and actions. We utilize the [create-github-app-token](https://github.com/actions/create-github-app-token) to generate a short live token in every action run, with ...

Success. Updated the following files:
M README.md

[
  {
    "content": "Correct secret-boundary documentation for organization-level Internal App key",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run final validation after scope correction",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Obtain exact-worktree independent review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ vitest run --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/validate-approval-attestation.js (9 tests) 54ms
 ✓ src/modules/__tests__/approval-attestation.js (5 tests) 47ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 19ms
 ✓ src/publish/__tests__/current-accepted-event.js (2 tests) 19ms
 ✓ src/modules/__tests__/approval-authorizer.js (15 tests) 17ms
 ✓ src/modules/__tests__/update-issue.js (6 tests) 27ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 70ms
 ✓ ...

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'
Done in 1.08s.

[
  {
    "content": "Correct secret-boundary documentation for organization-level Internal App key",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run final validation after scope correction",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain exact-worktree independent review",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f7a7fe83cffeSqKZWJTgg0G1Jv" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f7a7fe83cffeSqKZWJTgg0G1Jv" state="running">
<summary>Background task updated</summary>
<task_result>
Additional context sent to the running background task.
The task is still working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you sent and end your response.
</task_result>
</task>

<task id="ses_f7a7fe83cffeSqKZWJTgg0G1Jv" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f78c92caeffetj22OvOusYbRL7" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f78c92caeffetj22OvOusYbRL7" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f78c92caeffetj22OvOusYbRL7" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f7781c404ffeyzFXIVMY1Tc3Np" state="completed">
<task_result>

</task_result>
</task>

<task id="ses_f777323abffeA6EnEAbS2ZnHiP" state="completed">
<task_result>

</task_result>
</task>

<task id="ses_f7765b0f4ffevb3lL7JdmsdAQY" state="completed">
<task_result>

</task_result>
</task>

[
  {
    "content": "Correct secret-boundary documentation for organization-level Internal App key",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run final validation after scope correction",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain exact-worktree independent review",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Retry review when reviewer service returns evidence",
    "status": "pending",
    "priority": "high"
  }
]

<task id="ses_f77479685ffeHCeoZNVl50vFeS" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f77479685ffeHCeoZNVl50vFeS" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Add fail-first regression for auto-approval source checkout",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Add fail-first regression for retry attempts 1-9",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Repair self-approval and CI-ready mutation fixtures",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Fix auto-approval checkout and retry validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Verify regressions fail without each guard",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run formatting, full tests, lint, and whitespace checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent exact-worktree review",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/auto-approve.yml", "utf8");
5: 
6: describe("auto-approval workflow", () => {
7:   test("records a request-bound attestation before adding accepted", () => {
8:     expect(workflow).toContain(
9:       "node src/publish/record-auto-approval-attestation.js"
10:     );
11:     expect(
12:       workflow.indexOf("record-auto-approval-attestation.js")
13:     ).toBeLessThan(workflow.indexOf("--add-label accepted"));
14:   });
15: 
16:   test("posts the proof as github-actions before the internal app labels", () => {
17:     const proof = workflow.indexOf("Post automated approval attestation");
18:     const label = workflow.indexOf("--add-label accepted");
19: 
20:     expect(workflow.slice(proof, label)).toContain(
21:       ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   repository_dispatch:
7:     types: [ci-poller]
8:   workflow_run:
9:     workflows: [Run CI Status Poller]
10:     types: [completed]
11: 
12: permissions:
13:   contents: read
14:   issues: write
15: 
16: jobs:
17:   check-ci:
18:     runs-on: ubuntu-latest
19:     environment: production
20:     # Skip entirely (no runner provisioned) when there's nothing to check.
21:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
22:     # repository_dispatch and a successful main-branch run of the protected
23:     # workflow_dispatch relay are the trusted manual-recovery paths.
24:     if: >-
25:       vars.CI_POLLER_HAS_PENDING == 'true'
26:       || github.event_name == 'repository_dispatch'
27:       || (
28:       github.event_name == 'workflow_run'
29:       && ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   createAutoApprovalAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   getAutoApprovedRepositories,
8:   main,
9: } = require("../authorize-approval.js");
10: 
11: const originalEnvironment = { ...process.env };
12: 
13: afterEach(() => {
14:   process.env = { ...originalEnvironment };
15:   vi.restoreAllMocks();
16:   vi.resetModules();
17: });
18: 
19: function jsonResponse(json) {
20:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
21: }
22: 
23: async function runAuthorization({ actor, issueTitle, responses }) {
24:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
25:   process.env.APPROVAL_TOKEN = "release-bot-token";
26:   process.env.APPROVAL_ACTOR = actor;
27:   process.env.APPROVAL_ISSUE_NUMBER = ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordCiReadyAttestation,
8: } = require("../record-ci-ready-attestation.js");
9: 
10: describe("recordCiReadyAttestation", () => {
11:   test("binds the current approval to the app that will add ci-ready", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordCiReadyAttestation({
16:         getAuthenticatedLogin: vi
17:           .fn()
18:           .mockResolvedValue("sentry-internal-app[bot]"),
19:         getIssue: vi.fn().mockResolvedValue({
20:           body: "Merge target: main",
21:           labels: [{ name: "accepted" }],
22:           state: "open",
23:           title,
24:         }),
25:         ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createCiReadyAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const {
7:   getAllPages,
8:   getGitHubResponse,
9:   getIssue,
10: } = require("./validate-approval-attestation.js");
11: 
12: async function getAuthenticatedLogin() {
13:   const response = await getGitHubResponse("user");
14: 
15:   if (!response.ok) {
16:     throw new Error(
17:       `Could not retrieve the authenticated user: GitHub returned ${response.status}`
18:     );
19:   }
20: 
21:   const { login } = await response.json();
22: 
23:   if (typeof login !== "string") {
24:     throw new Error("GitHub returned no authenticated user login");
25:   }
26: 
27:   return login;
28: }
29: 
30: async function recordCiReadyAttestation({
31:   expectedAcceptedEvent,
32:   getAuthenticatedLogin,
33:   getIssue,
34:  ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-auto-approval-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createAutoApprovalAttestation,
4: } = require("../modules/approval-attestation.js");
5: const { getIssue } = require("./validate-approval-attestation.js");
6: 
7: async function recordAutoApprovalAttestation({
8:   autoApprover,
9:   getIssue,
10:   issueNumber,
11:   issueTitle,
12:   repository,
13: }) {
14:   const issue = await getIssue({ repository, issueNumber });
15: 
16:   if (
17:     issue.state !== "open" ||
18:     issue.title !== issueTitle ||
19:     issue.user?.login?.toLowerCase() !== autoApprover.toLowerCase()
20:   ) {
21:     throw new Error("The automated approval request changed before approval");
22:   }
23: 
24:   return createAutoApprovalAttestation({ autoApprover, issue });
25: }
26: 
27: async function main() {
28:   for (const name of [
29:     "GITHUB_OUTPUT",
30:     "APPROVAL_TOKEN",
31:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

Success. Updated the following files:
M src/publish/__tests__/auto-approval-workflow.js
M src/publish/__tests__/ci-poller-workflow.js
M src/publish/__tests__/authorize-approval.js
M src/publish/__tests__/record-ci-ready-attestation.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/ci-poller-workflow.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/record-ci-ready-attestation.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/record-ci-ready-attestation.js (3 tests) 10ms
 ❯ src/publish/__tests__/ci-poller-workflow.js (3 tests | 1 failed) 24ms
     ✓ checks out trusted code before requesting app tokens 5ms
     ✓ uses a protected workflow dispatch relay for manual recovery 1ms
     × validates repository dispatch attempts before requesting app tokens 16ms
 ✓ ...

Success. Updated the following files:
M .github/workflows/auto-approve.yml
M .github/workflows/ci-poller.yml

[
  {
    "content": "Add fail-first regression for auto-approval source checkout",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add fail-first regression for retry attempts 1-9",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Repair self-approval and CI-ready mutation fixtures",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Fix auto-approval checkout and retry validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Verify regressions fail without each guard",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run formatting, full tests, lint, and whitespace checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain final independent exact-worktree review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/ci-poller-workflow.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/record-ci-ready-attestation.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/ci-poller-workflow.js (3 tests) 9ms
 ✓ src/publish/__tests__/auto-approval-workflow.js (3 tests) 4ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 21ms
 ✓ src/publish/__tests__/record-ci-ready-attestation.js (3 tests) 9ms

 Test Files  4 passed (4)
      Tests  16 passed (16)
   ...

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
120:   }
121: 
122:   if (!process.env.APPROVAL_ISSUE_REPOSITORY) {
123:     throw new Error(
124:       'No "APPROVAL_ISSUE_REPOSITORY" environment variable found'
125:     );
126:   }
127: 
128:   const actor = process.env.APPROVAL_ACTOR;
129:   const issueTitle = process.env.APPROVAL_ISSUE_TITLE;
130:   const autoApprovedRepositories = getAutoApprovedRepositories();
131:   let authorized;
132:   let issue;
133:   let event;
134: 
135:   if (actor === AUTO_APPROVAL_LABELER) {
136:     const [liveIssue, events, comments] = await Promise.all([
137:       getIssue({
138:         repository: process.env.APPROVAL_ISSUE_REPOSITORY,
139:         issueNumber: process.env.APPROVAL_ISSUE_NUMBER,
140:       }),
141:       getIssueEvents({
142:         repository: process.env.APPROVAL_ISSUE_REPOSITORY,
143:         issueNumber: process.env.APPROVAL_ISSUE_NUMBER,
144:       }),
145:       ...

Success. Updated the following files:
M src/publish/authorize-approval.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/authorize-approval.js -t 'rejects a requester approving their own release' --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/authorize-approval.js (7 tests | 1 failed | 6 skipped) 24ms
     ↓ loads exact release paths from the auto-approval allowlist
     ↓ writes authorization after a successful GitHub permission lookup
     × rejects a requester approving their own release 18ms
     ↓ authorizes an allowlisted automated request with a request proof
     ↓ rejects an automated approval without a request proof
     ↓ rejects direct approval by an automated opener
     ...

Success. Updated the following files:
M src/publish/authorize-approval.js

Success. Updated the following files:
M src/publish/record-ci-ready-attestation.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/record-ci-ready-attestation.js -t 'rejects an approval that changes before ci-ready is recorded' --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/record-ci-ready-attestation.js (3 tests | 1 failed | 2 skipped) 13ms
     ↓ binds the current approval to the app that will add ci-ready
     × rejects an approval that changes before ci-ready is recorded 12ms
     ↓ rejects a re-approval after the event observed by the poller

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/record-ci-ready-attestation.js > recordCiReadyAttestation > rejects an ...

Success. Updated the following files:
M src/publish/record-ci-ready-attestation.js

Success. Updated the following files:
M src/publish/record-ci-ready-attestation.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/record-ci-ready-attestation.js -t 'rejects a re-approval after the event observed by the poller' --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/record-ci-ready-attestation.js (3 tests | 1 failed | 2 skipped) 12ms
     ↓ binds the current approval to the app that will add ci-ready
     ↓ rejects an approval that changes before ci-ready is recorded
     × rejects a re-approval after the event observed by the poller 10ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/record-ci-ready-attestation.js > recordCiReadyAttestation > rejects a ...

Success. Updated the following files:
M src/publish/record-ci-ready-attestation.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/ci-poller-workflow.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/record-ci-ready-attestation.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/publish/__tests__/ci-poller-workflow.js (3 tests) 9ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) 20ms
 ✓ src/publish/__tests__/record-ci-ready-attestation.js (3 tests) 10ms
 ✓ src/publish/__tests__/auto-approval-workflow.js (3 tests) 4ms

 Test Files  4 passed (4)
      Tests  16 passed (16)
   ...

[
  {
    "content": "Add fail-first regression for auto-approval source checkout",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add fail-first regression for retry attempts 1-9",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Repair self-approval and CI-ready mutation fixtures",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Fix auto-approval checkout and retry validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Verify regressions fail without each guard",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run formatting, full tests, lint, and whitespace checks",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Obtain final independent exact-worktree review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ prettier --write src
src/libs/__tests__/github.js 72ms
src/libs/github.js 10ms
src/modules/__tests__/approval-attestation.js 38ms
src/modules/__tests__/approval-authorizer.js 19ms
src/modules/__tests__/details-from-context.js 18ms
src/modules/__tests__/post-workflow-details.js 10ms
src/modules/__tests__/process-end-state.js 25ms
src/modules/__tests__/update-issue.js 19ms
src/modules/approval-attestation.js 24ms
src/modules/approval-authorizer.js 8ms
src/modules/details-from-context.js 12ms
src/modules/post-workflow-details.js 4ms
src/modules/process-end-state.js 14ms
src/modules/update-issue.js 8ms
src/publish/__tests__/authorize-approval.js 19ms
src/publish/__tests__/auto-approval-workflow.js 4ms
src/publish/__tests__/ci-poller-workflow.js 7ms
src/publish/__tests__/current-accepted-event.js 5ms
src/publish/__tests__/publish-workflow.js 4ms
src/publish/__tests__/record-auto-approval-attestation.js 8ms
src/publish/__tests__/record-ci-ready-attestation.js ...

[
  {
    "content": "Add fail-first regression for auto-approval source checkout",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add fail-first regression for retry attempts 1-9",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Repair self-approval and CI-ready mutation fixtures",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Fix auto-approval checkout and retry validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Verify regressions fail without each guard",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run formatting, full tests, lint, and whitespace checks",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Obtain final independent exact-worktree review",
    "status": "in_progress",
    "priority": "high"
  }
]

<task id="ses_f772c23a9ffe0p7UJWZ161cSAH" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f772c23a9ffe0p7UJWZ161cSAH" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f77148e81ffeLZigv1qXUEEOCi" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Add fail-first regression for auto-approval source checkout",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Add fail-first regression for retry attempts 1-9",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Repair self-approval and CI-ready mutation fixtures",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Fix auto-approval checkout and retry validation",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Verify regressions fail without each guard",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run formatting, full tests, lint, and whitespace checks",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Integrate latest origin/main workspace publish changes",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Rerun fail-first, stability, and full validation",
    "status": ...

No files found

## main...origin/main [behind 1]
 M .github/workflows/auto-approve.yml
 M .github/workflows/ci-poller.yml
 M .github/workflows/cocoapods-keepalive.yml
 M .github/workflows/publish.yml
 M .github/workflows/test.yml
 M AGENTS.md
 M README.md
 M docs/key_rotation_vault_changes.md
 M docs/rfc.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/__tests__/details-from-context.js
 M src/modules/__tests__/update-issue.js
 M src/modules/details-from-context.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .github/workflows/ci-poller-dispatch.yml
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? ...

M	.github/workflows/ci-poller.yml
M	.github/workflows/cocoapods-keepalive.yml
M	.github/workflows/publish.yml
M	README.md
A	docs/publish-issue-format.md
M	package.json
A	scripts/generate-publish-issue-title-parser.js
A	src/modules/__tests__/ci-poller-input.js
A	src/modules/__tests__/ci-poller-workflow.js
M	src/modules/__tests__/details-from-context.js
A	src/modules/__tests__/generate-publish-issue-title-parser.js
A	src/modules/__tests__/publish-location.js
A	src/modules/__tests__/publish-workflow.js
A	src/modules/__tests__/release-revision.js
M	src/modules/__tests__/update-issue.js
A	src/modules/ci-poller-input.js
M	src/modules/details-from-context.js
A	src/modules/publish-issue-title.js
A	src/modules/publish-issue-title.peggy
A	src/modules/publish-issue-validation.js
A	src/modules/publish-location.js
A	src/modules/release-revision.js
M	src/modules/update-issue.js
A	src/publish/__tests__/discover-location.js
A	src/publish/__tests__/resolve-location.js
A	src/publish/__tests__/resolve-re...

commit 7c60ddb7f43040fe8fbfea70efc833f689c04e75
Author:     Burak Yigit Kaya <byk@sentry.io>
AuthorDate: Tue Sep 8 18:37:21 2026 +0100
Commit:     GitHub <noreply@github.com>
CommitDate: Tue Sep 8 17:37:21 2026 +0000

    feat: accept workspace publish requests
    
    ## Summary
    
    - Parse and validate workspace-qualified publish request titles.
    - Propagate the selected workspace into Craft and isolate secure
    publish-resume state by workspace.
    - Restore failed target state only from the workflow-created XDG state
    file.
    
    ## Validation
    
    - pnpm test: 6 files, 25 tests passed.
    - Focused workflow-state regression: 3 files, 18 tests passed.
    - Prettier and changed-file ESLint passed.
    
    ## Deployment
    
    Deploy this controller before Craft PR #872. It adds the title parser
    and secure state contract required for workspace-qualified requests.

 .github/workflows/ci-poller.yml                    |   62 +-
 ...

<task id="ses_f76fc4fe4ffeOcCwBOfB1oUFQX" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f76fc2d75ffeQyflMvS2ZxBgtR" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f76fc4fe4ffeOcCwBOfB1oUFQX" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f76fc2d75ffeQyflMvS2ZxBgtR" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f76f14942ffeds3uVYC7Tt1CLY" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index a3db430..487e9da 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -1,314 +1,324 @@
 name: CI Status Poller
 
 on:
   schedule:
     - cron: "*/5 * * * *"
   workflow_dispatch:
     inputs:
       attempt:
         description: Self-dispatch attempt counter (internal use)
         required: false
         default: "0"
 
 permissions:
   contents: read
   issues: read
 
 jobs:
   check-ci:
     runs-on: ubuntu-latest
     environment: production
     # Skip entirely (no runner provisioned) when there's nothing to check.
     # Set to "true" by ci-pending.yml, reset to "false" here when done.
     # Always allow workflow_dispatch for manual recovery.
     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
     concurrency:
       group: ci-status-poller
       cancel-in-progress: false
     steps:
       # sentry-internal-app token ...

Updating 83d210b..7c60ddb
Created autostash: aa5efe2
Fast-forward
 .github/workflows/ci-poller.yml                    |   62 +-
 .github/workflows/cocoapods-keepalive.yml          |    2 +-
 .github/workflows/publish.yml                      |   84 +-
 README.md                                          |    5 +
 docs/publish-issue-format.md                       |  107 ++
 package.json                                       |    5 +-
 scripts/generate-publish-issue-title-parser.js     |  104 ++
 src/modules/__tests__/ci-poller-input.js           |   97 ++
 src/modules/__tests__/ci-poller-workflow.js        |  197 +++
 src/modules/__tests__/details-from-context.js      |  166 ++-
 .../generate-publish-issue-title-parser.js         |   40 +
 src/modules/__tests__/publish-location.js          |   91 ++
 src/modules/__tests__/publish-workflow.js          |  156 +++
 src/modules/__tests__/release-revision.js          |  150 ++
 src/modules/__tests__/update-issue.js              |   15 +-
 ...

## main...origin/main
M  .github/workflows/auto-approve.yml
UU .github/workflows/ci-poller.yml
M  .github/workflows/cocoapods-keepalive.yml
UU .github/workflows/publish.yml
M  .github/workflows/test.yml
M  AGENTS.md
M  README.md
M  docs/key_rotation_vault_changes.md
M  docs/rfc.md
M  src/libs/__tests__/github.js
M  src/libs/github.js
M  src/modules/__tests__/details-from-context.js
UU src/modules/__tests__/update-issue.js
UU src/modules/details-from-context.js
M  src/modules/post-workflow-details.js
M  src/modules/process-end-state.js
UU src/modules/update-issue.js
UU src/publish/inputs.js
M  src/publish/post-result.js
M  src/publish/post-workflow-details.js
M  src/publish/update-issue.js
?? .github/workflows/ci-poller-dispatch.yml
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/authorize-approval.js
?? ...

<path>/home/byk/Code/getsentry/publish/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const { getReleaseRevisionDetails } = require("./release-revision");
3: const { isPublishPath } = require("./publish-location");
4: const {
5:   isPublishRepository,
6:   isReleaseVersion,
7: } = require("./publish-issue-validation");
8: 
9: /**
10:  * Matches the entire "Targets" section of a github publish issue body.
11:  */
12: const TARGETS_SECTION_PARSER_REGEX =
13:   /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
14: 
15: /**
16:  * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
17:  * The "id" of the targets is captured within a capture group. ...

<path>/home/byk/Code/getsentry/publish/src/modules/update-issue.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   TARGETS_SECTION_PARSER_REGEX,
4:   TARGETS_PARSER_REGEX,
5: } = require("./details-from-context");
6: 
7: <<<<<<< Updated upstream
8: async function updateTargets({
9:   octokit,
10:   stateFilePath,
11:   publishRepo,
12:   issue_number,
13: }) {
14:   if (!stateFilePath || !fs.existsSync(stateFilePath)) {
15: =======
16: async function updateTargets({ octokit, version, publishRepo, issue_number }) {
17:   const CRAFT_STATE_FILE_PATH = `${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json`;
18: 
19:   if (!fs.existsSync(CRAFT_STATE_FILE_PATH)) {
20: >>>>>>> Stashed changes
21:     return;
22:   }
23: 
24:   const issueRequest = octokit.rest.issues.get({
25:     ...publishRepo,
26:     issue_number,
27:   });
28: 
29:   const craftStateRequest = fs.promises
30:     .readFile(stateFilePath, { encoding: "utf-8" })
31:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require("@actions/github");
2: const core = require("@actions/core");
3: const { detailsFromContext } = require("../modules/details-from-context");
4: 
5: async function inputs() {
6: <<<<<<< Updated upstream
7:     const result = await detailsFromContext({
8:       context: github.context,
9:     });
10:     core.setOutput('result', JSON.stringify(result));
11: }
12: 
13: 
14: =======
15:   const result = await detailsFromContext({
16:     context: github.context,
17:   });
18:   core.setOutput("result", result);
19: }
20: 
21: >>>>>>> Stashed changes
22: inputs();

(End of file - total 22 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/update-issue.js</path>
<type>file</type>
<content>
1: import { vi, describe, test, expect, beforeAll, beforeEach, it } from "vitest";
2: import fs from "fs";
3: 
4: const { updateIssue, transformIssueBody } = require("../update-issue.js");
5: 
6: let mockExistsSync;
7: 
8: const updateTargetsArgs = {
9:   inputs: { repo: "sentry", version: "21.3.1" },
10:   context: {
11:     runId: "1234",
12:     repo: { owner: "getsentry", repo: "publish" },
13:     payload: { issue: { number: "211" } },
14:   },
15:   octokit: {
16:     rest: {
17:       actions: {
18:         getWorkflowRun: async () => ({
19:           data: {
20:             html_url: "https://github.com/getsentry/sentry/actions/runs/1234",
21:           },
22:         }),
23:       },
24:       issues: {
25:         get: vi.fn(),
26:         update: vi.fn(),
27:         removeLabel: vi.fn(),
28:       },
29:     },
30:   },
31:   Sentry: {
32:     Scope: class Scope ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const { parsePublishTitle } = require("./details-from-context.js");
3: 
4: const AUTO_APPROVAL_LABELER = "sentry-internal-app[bot]";
5: const AUTO_APPROVERS = new Set(["getsantry[bot]", "sentry-release-bot[bot]"]);
6: 
7: function isAutoApprovedRepository({
8:   actor,
9:   autoApprovedRepositories,
10:   issueTitle,
11: }) {
12:   if (!AUTO_APPROVERS.has(actor)) {
13:     return false;
14:   }
15: 
16:   const title = parsePublishTitle(issueTitle);
17: 
18:   if (!title) {
19:     return false;
20:   }
21: 
22:   return autoApprovedRepositories.has(
23:     `getsentry/${title.repo}${title.path || ""}`
24:   );
25: }
26: 
27: async function authorizeApproval({ actor, issueTitle, getPermission }) {
28:   const title = parsePublishTitle(issueTitle);
29: 
30:   if (!title) {
31:     return { authorized: ...

<path>/home/byk/Code/getsentry/publish/src/modules/publish-issue-title.peggy</path>
<type>file</type>
<content>
1: {
2:   function join(characters) {
3:     return characters.join("");
4:   }
5: }
6: 
7: // BEGIN TITLE GRAMMAR
8: // Canonical grammar for publish issue titles. A path suffix is syntactic only:
9: // the controller resolves the complete suffix as a workspace after checking
10: // out the CI-approved revision.
11: PublishIssueTitle
12:   = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. {
13:       return {
14:         repo,
15:         path: path || "",
16:         version,
17:       };
18:     }
19: 
20: Repository
21:   = characters:RepositoryCharacter+ { return join(characters); }
22: 
23: RepositoryCharacter
24:   = [A-Za-z0-9_.-]
25: 
26: Path
27:   = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
28: 
29: PathSegment
30:   = characters:RepositoryCharacter+ { return join(characters); }
31: 
32: ...

<path>/home/byk/Code/getsentry/publish/src/modules/publish-issue-validation.js</path>
<type>file</type>
<content>
1: function isPublishRepository(name) {
2:   return (
3:     /^[A-Za-z0-9_.-]+$/.test(name) &&
4:     name !== "." &&
5:     name !== ".." &&
6:     name !== "__proto__" &&
7:     !name.startsWith("-")
8:   );
9: }
10: 
11: function isReleaseVersion(version) {
12:   return /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-?([0-9a-z-]+(?:\.[0-9a-z-]+)*))?(?:\+([0-9a-z-]+(?:\.[0-9a-z-]+)*))?$/i.test(
13:     version
14:   );
15: }
16: 
17: module.exports = { isPublishRepository, isReleaseVersion };

(End of file - total 17 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/modules/publish-location.js</path>
<type>file</type>
<content>
1: function resolvePublishLocation({ path, workspaceNames }) {
2:   if (!isPublishPath(path)) {
3:     throw new Error("Invalid publish path.");
4:   }
5: 
6:   if (!workspaceNames.every(isWorkspaceName)) {
7:     throw new Error(
8:       "Craft workspace discovery returned an invalid workspace list."
9:     );
10:   }
11: 
12:   if (path === ".") {
13:     return { path };
14:   }
15: 
16:   const workspace = path.slice(2);
17:   if (workspaceNames.includes(workspace)) {
18:     return { path: ".", workspace };
19:   }
20: 
21:   return { path };
22: }
23: 
24: function isPublishPath(path) {
25:   return (
26:     typeof path === "string" &&
27:     (path === "." ||
28:       (path.startsWith("./") &&
29:         path
30:           .slice(2)
31:           .split("/")
32:           .every(isSafeWorkspaceSegment)))
33:   );
34: }
35: 
36: function isWorkspaceName(name) {
37:   ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/details-from-context.js</path>
<type>file</type>
<content>
1: import { test, expect } from "vitest";
2: 
3: const {
4:   detailsFromContext,
5:   parsePublishTitle,
6: } = require("../details-from-context.js");
7: 
8: const inputsArgs = {
9:   context: {
10:     repo: { owner: "getsentry", repo: "publish" },
11:     payload: {
12:       issue: {
13:         number: "223",
14:         title: "publish: getsentry/sentry@21.3.1",
15:         body: `Requested by: @BYK
16: 
17: Merge target: custom-branch
18: 
19: Quick links:
20: - [View changes](https://github.com/getsentry/sentry/compare/21.3.0...refs/heads/releases/21.3.1)
21: - [View check runs](https://github.com/getsentry/sentry/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)
22: 
23: Assign the **accepted** label to this issue to approve the release. ...

<path>/home/byk/Code/getsentry/publish/src/modules/release-revision.js</path>
<type>file</type>
<content>
1: const { parse } = require("./publish-issue-title");
2: 
3: function isRevision(revision) {
4:   return /^[0-9a-f]{40}$/.test(revision);
5: }
6: 
7: function getReleaseRevisionDetails({ issueBody, repo }) {
8:   if (
9:     parse(issueBody, { startRule: "CheckRunsLinkCount" }) !== 1
10:   ) {
11:     throw new Error(
12:       `Expected exactly one View check runs link in Quick links for getsentry/${repo}.`
13:     );
14:   }
15: 
16:   let details;
17:   try {
18:     details = parse(issueBody, { startRule: "ReleaseRevision" });
19:   } catch {
20:     throw new Error(
21:       `Expected a View check runs link for getsentry/${repo} in the publish issue body.`
22:     );
23:   }
24: 
25:   if (details.repo !== repo) {
26:     throw new Error(
27:       `Expected a View check runs link for getsentry/${repo} in the publish issue body.`
28:     );
29:   }
30: 
31:   return ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

Found 12 matches
/home/byk/Code/getsentry/publish/src/modules/details-from-context.js:
  Line 26: const PUBLISH_TITLE_REGEX =

  Line 29: function parsePublishTitle(title) {

  Line 30:   return title.match(PUBLISH_TITLE_REGEX)?.groups || null;

  Line 54:   const titleMatch = parsePublishTitle(context.payload.issue.title);

  Line 98:   parsePublishTitle,

  Line 99:   PUBLISH_TITLE_REGEX,


/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js:
  Line 2: const { parsePublishTitle } = require("./details-from-context.js");

  Line 16:   const title = parsePublishTitle(issueTitle);

  Line 28:   const title = parsePublishTitle(issueTitle);


/home/byk/Code/getsentry/publish/src/modules/__tests__/details-from-context.js:
  Line 5:   parsePublishTitle,

  Line 76:     parsePublishTitle(

  Line 84:   expect(parsePublishTitle("publish: sentry-javascript@10.0.0")).toEqual({

Success. Updated the following files:
M src/modules/details-from-context.js
M src/publish/inputs.js
M src/modules/update-issue.js
M src/modules/__tests__/details-from-context.js
M src/modules/__tests__/update-issue.js

Found 9 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 192: <<<<<<< Updated upstream

  Line 194: =======

  Line 196: >>>>>>> Stashed changes

  Line 261: <<<<<<< Updated upstream

  Line 263: =======

  Line 265: >>>>>>> Stashed changes


/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml:
  Line 131: <<<<<<< Updated upstream

  Line 136: =======

  Line 193: >>>>>>> Stashed changes

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/details-from-context.js src/modules/__tests__/approval-authorizer.js src/modules/__tests__/update-issue.js src/modules/__tests__/publish-issue-title.js src/modules/__tests__/release-revision.js src/modules/__tests__/publish-location.js src/modules/__tests__/ci-poller-input.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/resolve-release-revision.js src/publish/__tests__/resolve-location.js src/publish/__tests__/discover-location.js --printConsoleTrace

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/modules/__tests__/approval-authorizer.js (15 tests) 40ms
 ✓ src/modules/__tests__/update-issue.js (7 tests) 25ms
 ✓ src/publish/__tests__/authorize-approval.js (7 tests) ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
105:           # This avoids polling for abandoned releases that nobody approved.
106:           issues=$(gh issue list -R "$GITHUB_REPOSITORY" \
107:             --state open \
108:             --label ci-pending \
109:             --label accepted \
110:             --limit 200 \
111:             --json number,title,labels,body)
112: 
113:           count=$(echo "$issues" | jq length)
114:           if [[ "$count" == "0" ]]; then
115:             echo "No ci-pending + accepted issues found."
116:             exit 0
117:           fi
118:           echo "Found ${count} ci-pending + accepted issue(s)."
119: 
120:           # Check each issue's CI status
121:           echo "$issues" | jq -c '.[]' | while read -r issue; do
122:             (
123:             number=$(echo "$issue" | jq -r '.number')
124:             title=$(echo "$issue" | jq -r '.title')
125:             ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-input.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { join } from "path";
3: 
4: import { expect, test } from "vitest";
5: 
6: const { getCiPollerInput } = require("../ci-poller-input.js");
7: 
8: const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
9: const issueBody = `Requested by: @byk
10: 
11: Merge target: (default)
12: 
13: Quick links:
14: - [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
15: - [View check runs](https://github.com/getsentry/toolkit/commit/${REVISION}/checks/)`;
16: 
17: test("parses root and full-path publish titles", () => {
18:   expect(
19:     getCiPollerInput({
20:       issueBody,
21:       title: "publish: getsentry/toolkit/cli@1.2.3",
22:     })
23:   ).toEqual({
24:     repo: "getsentry/toolkit",
25:     revision: REVISION,
26:     version: "1.2.3",
27:   });
28: 
29:   expect(
30:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/ci-poller-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/ci-poller.yml", "utf8");
5: const manualDispatchWorkflow = readFileSync(
6:   ".github/workflows/ci-poller-dispatch.yml",
7:   "utf8"
8: );
9: 
10: describe("CI poller workflow", () => {
11:   test("checks out trusted code before requesting app tokens", () => {
12:     expect(workflow).toMatch(
13:       /- name: Get publish code\n\s+uses: actions\/checkout@[a-f0-9]{40}\n\s+with:\n(?:\s+#.*\n)*\s+ref: \$\{\{ github\.event\.repository\.default_branch \}\}/
14:     );
15: 
16:     expect(workflow.indexOf("Get publish code")).toBeLessThan(
17:       workflow.indexOf("Get auth token")
18:     );
19:   });
20: 
21:   test("uses a protected workflow dispatch relay for manual recovery", () => {
22:     ...

Success. Updated the following files:
M .github/workflows/ci-poller.yml

3d3c42e5aac5ba805825da76410c181273ba90b1	refs/tags/v7

<path>/home/byk/Code/getsentry/publish/src/publish/discover-location.js</path>
<type>file</type>
<content>
1: const { execFileSync } = require("child_process");
2: const { existsSync } = require("fs");
3: const path = require("path");
4: 
5: const core = require("@actions/core");
6: 
7: const { resolvePublishLocation } = require("../modules/publish-location");
8: 
9: function getWorkspaceNames({
10:   repositoryDirectory,
11:   exists = existsSync,
12:   execFile = execFileSync,
13: }) {
14:   if (!exists(path.join(repositoryDirectory, ".craft.yml"))) {
15:     return [];
16:   }
17: 
18:   const output = execFile(
19:     "docker",
20:     [
21:       "run",
22:       "--rm",
23:       "--volume",
24:       `${path.resolve(repositoryDirectory)}:/github/workspace/__repo__`,
25:       "--workdir",
26:       "/github/workspace/__repo__",
27:       "getsentry/craft:latest",
28:       "workspace",
29:       "list",
30:     ],
31:     { encoding: "utf8" }
32:   );
33:   let ...

<path>/home/byk/Code/getsentry/publish/package.json</path>
<type>file</type>
<content>
1: {
2:   "name": "publish",
3:   "private": true,
4:   "version": "0.0.1",
5:   "description": "Approval-based publishing system for Sentry",
6:   "main": "index.js",
7:   "repository": "git@github.com:getsentry/publish.git",
8:   "author": "Sentry Open Source <oss@sentry.io>",
9:   "license": "Apache-2.0",
10:   "volta": {
11:     "node": "24.0.0",
12:     "yarn": "1.22.22"
13:   },
14:   "resolutions": {
15:     "undici": "^6.23.0"
16:   },
17:   "scripts": {
18:     "generate": "node scripts/generate-publish-issue-title-parser.js",
19:     "check:generated": "node scripts/generate-publish-issue-title-parser.js --check",
20:     "test": "yarn check:generated && vitest run",
21:     "test:watch": "vitest",
22:     "lint": "eslint src .github --ignore-pattern '!.github'",
23:     "prettier": "prettier --write src"
24:   },
25:   "devDependencies": {
26:     "eslint": "^8.9.0",
27:     ...

Success. Updated the following files:
M .github/workflows/publish.yml
M src/publish/discover-location.js

No files found

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { spawnSync } from "child_process";
2: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
3: import { tmpdir } from "os";
4: import { join } from "path";
5: 
6: import { afterEach, expect, test } from "vitest";
7: 
8: const { resolvePublishLocation } = require("../publish-location.js");
9: 
10: const temporaryDirectories = [];
11: 
12: function getWorkflow() {
13:   return readFileSync(
14:     join(__dirname, "../../../.github/workflows/publish.yml"),
15:     "utf8"
16:   );
17: }
18: 
19: function getSetTargetsScript() {
20:   const workflow = getWorkflow();
21:   const section = workflow.match(
22:     / {6}- name: Set targets[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- uses: docker:\/\/getsentry\/craft:latest/
23:   );
24:   if (!section?.groups?.script) {
25:     throw new Error("Missing Set targets workflow script");
26:   }
27:   ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/publish.yml", "utf8");
5: 
6: describe("publish workflow", () => {
7:   test("revalidates approval immediately before Craft", () => {
8:     const fence = workflow.indexOf("Revalidate approval attestation");
9: 
10:     expect(fence).toBeGreaterThan(workflow.indexOf("Set targets"));
11:     expect(fence).toBeLessThan(workflow.indexOf("Publish using Craft"));
12:     expect(workflow.slice(fence)).toContain(
13:       'REQUIRE_CI_READY_ATTESTATION: "true"'
14:     );
15:   });
16: 
17:   test("pins Craft to an immutable digest", () => {
18:     expect(workflow).toMatch(
19:       /uses: docker:\/\/getsentry\/craft@sha256:[a-f0-9]{64}/
20:     );
21:   });
22: });

(End of file - total 22 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/discover-location.js</path>
<type>file</type>
<content>
1: import { afterEach, expect, test, vi } from "vitest";
2: 
3: const { discoverLocation, getWorkspaceNames } = require("../discover-location.js");
4: 
5: afterEach(() => {
6:   vi.restoreAllMocks();
7: });
8: 
9: test("retains checkout-path behavior when the root config is absent", () => {
10:   expect(
11:     discoverLocation({
12:       input: { path: "./packages/cli" },
13:       repositoryDirectory: "__repo__",
14:       exists: () => false,
15:     })
16:   ).toEqual({ path: "./packages/cli" });
17: });
18: 
19: test("discovers exact workspace paths using the released Craft image", () => {
20:   const execFile = vi.fn(() => '["packages/CLI"]');
21: 
22:   expect(
23:     discoverLocation({
24:       input: { path: "./packages/CLI" },
25:       repositoryDirectory: "__repo__",
26:       exists: () => true,
27:       execFile,
28:     })
29:   ).toEqual({ path: ...

Success. Updated the following files:
M src/modules/__tests__/publish-workflow.js
M src/publish/__tests__/discover-location.js
M src/modules/__tests__/ci-poller-input.js

[
  {
    "content": "Resolve upstream module and workflow conflicts without weakening approval security",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Align upstream tests with immutable controller, Craft, and approval contracts",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run generated checks, focused regressions, full tests, lint, formatting, and whitespace validation",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Review the exact integrated diff for security and behavioral regressions",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain substantive independent exact-head review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/generate-publish-issue-title-parser.js src/modules/__tests__/details-from-context.js src/modules/__tests__/release-revision.js src/modules/__tests__/publish-location.js src/modules/__tests__/ci-poller-input.js src/modules/__tests__/ci-poller-workflow.js src/modules/__tests__/publish-workflow.js src/modules/__tests__/update-issue.js src/modules/__tests__/approval-attestation.js src/modules/__tests__/approval-authorizer.js src/publish/__tests__/discover-location.js src/publish/__tests__/resolve-location.js src/publish/__tests__/resolve-release-revision.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/ci-poller-workflow.js src/publish/__tests__/publish-workflow.js src/publish/__tests__/record-auto-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-workflow.js</path>
<type>file</type>
<content>
1: import {
2:   mkdtempSync,
3:   mkdirSync,
4:   readFileSync,
5:   readdirSync,
6:   rmSync,
7:   writeFileSync,
8: } from "fs";
9: import { tmpdir } from "os";
10: import { join } from "path";
11: import { spawnSync } from "child_process";
12: 
13: import { afterEach, expect, test } from "vitest";
14: 
15: const temporaryDirectories = [];
16: const INITIAL_REVISION = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
17: const UPDATED_REVISION = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
18: 
19: function getPollerScript() {
20:   const workflow = readFileSync(
21:     join(__dirname, "../../../.github/workflows/ci-poller.yml"),
22:     "utf8"
23:   );
24:   const section = workflow.match(
25:     / {6}- name: Check CI status for ci-pending issues[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- name: Check for remaining pending issues/
26:   );
27: 
28:   if ...

Success. Updated the following files:
M src/modules/__tests__/ci-poller-workflow.js

Success. Updated the following files:
M src/modules/__tests__/ci-poller-workflow.js

yarn install v1.22.22
[1/4] Resolving packages...
[2/4] Fetching packages...
(node:1060934) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `node --trace-deprecation ...` to show where the warning was created)
[3/4] Linking dependencies...
warning " > vitest@4.1.0" has unmet peer dependency "vite@^6.0.0 || ^7.0.0 || ^8.0.0-0".
[4/4] Building fresh packages...
Done in 2.39s.
yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/generate-publish-issue-title-parser.js src/modules/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish


 Test Files  2 passed (2)
      Tests  9 passed (9)
   Start at  ...

## main...origin/main
M  .github/workflows/auto-approve.yml
UU .github/workflows/ci-poller.yml
M  .github/workflows/cocoapods-keepalive.yml
UU .github/workflows/publish.yml
M  .github/workflows/test.yml
M  AGENTS.md
M  README.md
M  docs/key_rotation_vault_changes.md
M  docs/rfc.md
M  src/libs/__tests__/github.js
M  src/libs/github.js
 M src/modules/__tests__/ci-poller-input.js
 M src/modules/__tests__/ci-poller-workflow.js
MM src/modules/__tests__/details-from-context.js
 M src/modules/__tests__/publish-workflow.js
UU src/modules/__tests__/update-issue.js
UU src/modules/details-from-context.js
M  src/modules/post-workflow-details.js
M  src/modules/process-end-state.js
UU src/modules/update-issue.js
 M src/publish/__tests__/discover-location.js
 M src/publish/discover-location.js
UU src/publish/inputs.js
M  src/publish/post-result.js
M  src/publish/post-workflow-details.js
M  src/publish/update-issue.js
?? .github/workflows/ci-poller-dispatch.yml
?? .lore.md
?? ...

Success. Updated the following files:
M src/modules/__tests__/ci-poller-workflow.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish


 Test Files  1 passed (1)
      Tests  6 passed (6)
   Start at  02:26:10
   Duration  742ms (transform 36ms, setup 0ms, import 54ms, tests 500ms, environment 0ms)

Done in 1.33s.

yarn run v1.22.22
$ node scripts/generate-publish-issue-title-parser.js --check
Done in 0.52s.
yarn run v1.22.22
$ yarn check:generated && vitest run --printConsoleTrace
$ node scripts/generate-publish-issue-title-parser.js --check

 RUN  v4.1.0 /home/byk/Code/getsentry/publish


 Test Files  25 passed (25)
      Tests  163 passed (163)
   Start at  02:26:39
   Duration  3.85s (transform 616ms, setup 0ms, import 2.26s, tests 2.01s, environment 4ms)

Done in 5.11s.

[
  {
    "content": "Resolve upstream module and workflow conflicts without weakening approval security",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Align upstream tests with immutable controller, Craft, and approval contracts",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Run generated checks, focused regressions, full tests, lint, formatting, and whitespace validation",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Review the exact integrated diff for security and behavioral regressions",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain substantive independent exact-head review",
    "status": "pending",
    "priority": "high"
  }
]

yarn run v1.22.22
$ prettier --write src
src/libs/__tests__/github.js 73ms
src/libs/github.js 10ms
src/modules/__tests__/approval-attestation.js 47ms
src/modules/__tests__/approval-authorizer.js 20ms
src/modules/__tests__/ci-poller-input.js 12ms
src/modules/__tests__/ci-poller-workflow.js 30ms
src/modules/__tests__/details-from-context.js 17ms
src/modules/__tests__/generate-publish-issue-title-parser.js 6ms
src/modules/__tests__/post-workflow-details.js 5ms
src/modules/__tests__/process-end-state.js 20ms
src/modules/__tests__/publish-location.js 21ms
src/modules/__tests__/publish-workflow.js 16ms
src/modules/__tests__/release-revision.js 15ms
src/modules/__tests__/update-issue.js 16ms
src/modules/approval-attestation.js 26ms
src/modules/approval-authorizer.js 6ms
src/modules/ci-poller-input.js 5ms
src/modules/details-from-context.js 17ms
src/modules/post-workflow-details.js 6ms
src/modules/process-end-state.js 11ms
src/modules/publish-issue-title.js ...

yarn run v1.22.22
$ node scripts/generate-publish-issue-title-parser.js --check
Done in 0.52s.
## main...origin/main
M  .github/workflows/auto-approve.yml
M  .github/workflows/ci-poller.yml
M  .github/workflows/cocoapods-keepalive.yml
M  .github/workflows/publish.yml
M  .github/workflows/test.yml
M  AGENTS.md
M  README.md
M  docs/key_rotation_vault_changes.md
M  docs/rfc.md
M  src/libs/__tests__/github.js
M  src/libs/github.js
 M src/modules/__tests__/ci-poller-input.js
 M src/modules/__tests__/ci-poller-workflow.js
MM src/modules/__tests__/details-from-context.js
 M src/modules/__tests__/publish-location.js
 M src/modules/__tests__/publish-workflow.js
 M src/modules/__tests__/release-revision.js
M  src/modules/__tests__/update-issue.js
M  src/modules/details-from-context.js
M  src/modules/post-workflow-details.js
M  src/modules/process-end-state.js
 M src/modules/publish-location.js
 M src/modules/release-revision.js
 M src/publish/__tests__/discover-location.js
 M ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   repository_dispatch:
7:     types: [ci-poller]
8:   workflow_run:
9:     workflows: [Run CI Status Poller]
10:     types: [completed]
11: 
12: permissions:
13:   contents: read
14:   issues: write
15: 
16: jobs:
17:   check-ci:
18:     runs-on: ubuntu-latest
19:     environment: production
20:     # Skip entirely (no runner provisioned) when there's nothing to check.
21:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
22:     # repository_dispatch and a successful main-branch run of the protected
23:     # workflow_dispatch relay are the trusted manual-recovery paths.
24:     if: >-
25:       vars.CI_POLLER_HAS_PENDING == 'true'
26:       || github.event_name == 'repository_dispatch'
27:       || (
28:       github.event_name == 'workflow_run'
29:       && ...

<path>/home/byk/Code/getsentry/publish/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const { getReleaseRevisionDetails } = require("./release-revision");
3: const { isPublishPath } = require("./publish-location");
4: const {
5:   isPublishRepository,
6:   isReleaseVersion,
7: } = require("./publish-issue-validation");
8: 
9: /**
10:  * Matches the entire "Targets" section of a github publish issue body.
11:  */
12: const TARGETS_SECTION_PARSER_REGEX =
13:   /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
14: 
15: /**
16:  * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
17:  * The "id" of the targets is captured within a capture group. ...

<path>/home/byk/Code/getsentry/publish/src/modules/ci-poller-input.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const {
3:   getReleaseRevision,
4:   updateReleaseRevision,
5: } = require("./release-revision");
6: const {
7:   isPublishRepository,
8:   isReleaseVersion,
9: } = require("./publish-issue-validation");
10: const { isPublishPath } = require("./publish-location");
11: 
12: function getCiPollerInput({ title, issueBody, revision }) {
13:   let parsedTitle;
14:   try {
15:     parsedTitle = parsePublishIssueTitle(title);
16:   } catch {
17:     throw new Error(`Invalid publish issue title: '${title}'`);
18:   }
19:   const { repo, version } = parsedTitle;
20:   if (!isPublishRepository(repo)) {
21:     throw new Error(`Invalid publish issue repository: '${repo}'`);
22:   }
23:   if (!isReleaseVersion(version)) {
24:     throw new Error(`Invalid publish issue version: '${version}'`);
25:   }
26:   const ...

<path>/home/byk/Code/getsentry/publish/src/publish/update-issue.js</path>
<type>file</type>
<content>
1: const { updateIssue } = require("../modules/update-issue.js");
2: const { getGitHubToken } = require("../libs/github");
3: const github = require("@actions/github");
4: 
5: async function main() {
6:   const context = github.context;
7:   const octokit = github.getOctokit(getGitHubToken());
8:   let inputs;
9: 
10:   if (process.env.PUBLISH_ARGS) {
11:     try {
12:       inputs = JSON.parse(process.env.PUBLISH_ARGS);
13:     } catch {
14:       console.warn("Could not parse publish inputs; skipping target update");
15:     }
16:   }
17: 
18:   await updateIssue({ context, octokit, inputs });
19: }
20: 
21: if (require.main === module) {
22:   main().catch((error) => {
23:     console.error(error);
24:     process.exitCode = 1;
25:   });
26: }
27: 
28: module.exports = { main };

(End of file - total 28 lines)
</content>

Found 14 matches
/home/byk/Code/getsentry/publish/src/publish/update-issue.js:
  Line 1: const { updateIssue } = require("../modules/update-issue.js");

  Line 10:   if (process.env.PUBLISH_ARGS) {

  Line 12:       inputs = JSON.parse(process.env.PUBLISH_ARGS);


/home/byk/Code/getsentry/publish/src/publish/post-result.js:
  Line 7: const inputs = JSON.parse(process.env.PUBLISH_ARGS);


/home/byk/Code/getsentry/publish/src/publish/resolve-release-revision.js:
  Line 5:   const { repo } = JSON.parse(process.env.PUBLISH_ARGS || "{}");


/home/byk/Code/getsentry/publish/src/publish/resolve-location.js:
  Line 5:   const input = JSON.parse(process.env.PUBLISH_ARGS || "{}");


/home/byk/Code/getsentry/publish/src/publish/discover-location.js:
  Line 64:   const input = JSON.parse(process.env.PUBLISH_ARGS || "{}");


/home/byk/Code/getsentry/publish/src/publish/__tests__/resolve-release-revision.js:
  Line 12:       PUBLISH_ARGS: ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6: } = require("../modules/approval-attestation.js");
7: 
8: async function getGitHubResponse(path) {
9:   return fetch(`https://api.github.com/${path}`, {
10:     headers: {
11:       Accept: "application/vnd.github+json",
12:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
13:       "X-GitHub-Api-Version": "2026-03-10",
14:     },
15:   });
16: }
17: 
18: async function getIssue({ repository, issueNumber }) {
19:   const response = await getGitHubResponse(
20:     `repos/${repository}/issues/${issueNumber}`
21:   );
22: 
23:   if (!response.ok) {
24:     throw new Error(
25:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
26:     );
27:   }
28: 
29:   return response.json();
30: }
31: 
32: async ...

<path>/home/byk/Code/getsentry/publish/src/publish/current-accepted-event.js</path>
<type>file</type>
<content>
1: const { currentAcceptedEvent } = require("../modules/approval-attestation.js");
2: const { getAllPages } = require("./validate-approval-attestation.js");
3: 
4: async function getCurrentAcceptedEvent({
5:   getIssueEvents,
6:   issueNumber,
7:   repository,
8: }) {
9:   const event = currentAcceptedEvent(
10:     await getIssueEvents({ repository, issueNumber })
11:   );
12: 
13:   if (!event) {
14:     throw new Error("The issue has no current accepted label event");
15:   }
16: 
17:   return event;
18: }
19: 
20: async function main() {
21:   for (const name of [
22:     "APPROVAL_TOKEN",
23:     "APPROVAL_ISSUE_NUMBER",
24:     "APPROVAL_ISSUE_REPOSITORY",
25:   ]) {
26:     if (!process.env[name]) {
27:       throw new Error(`No "${name}" environment variable found`);
28:     }
29:   }
30: 
31:   const event = await getCurrentAcceptedEvent({
32:     getIssueEvents: ({ ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const AUTO_APPROVAL_ATTESTATION_PREFIX = "<!-- publish-auto-approval ";
5: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
6: const ATTESTATION_SUFFIX = " -->";
7: 
8: function createAttestation(prefix, value) {
9:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
10:     "base64url"
11:   )}${ATTESTATION_SUFFIX}`;
12: }
13: 
14: function requestDigest({ body, labels, title }) {
15:   if (typeof body !== "string" || !Array.isArray(labels)) {
16:     throw new Error("Invalid publish request");
17:   }
18: 
19:   return crypto
20:     .createHash("sha256")
21:     .update(
22:       JSON.stringify({
23:         body,
24:         dryRun: labels.some((label) => label.name === "dry-run"),
25:         title,
26:       })
27:     )
28:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/resolve-ci-poller-input.js</path>
<type>file</type>
<content>
1: const { getCiPollerInput } = require("../modules/ci-poller-input");
2: const { readFileSync } = require("fs");
3: 
4: const issueBody = process.env.PUBLISH_ISSUE_BODY_FILE
5:   ? readFileSync(process.env.PUBLISH_ISSUE_BODY_FILE, "utf8")
6:   : process.env.PUBLISH_ISSUE_BODY || "";
7: 
8: process.stdout.write(
9:   JSON.stringify(
10:     getCiPollerInput({
11:       issueBody,
12:       title: process.env.PUBLISH_TITLE || "",
13:       revision: process.env.PUBLISH_REVISION || "",
14:     })
15:   )
16: );

(End of file - total 16 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8:   createCiReadyAttestation,
9: } = require("../../modules/approval-attestation.js");
10: 
11: afterEach(() => {
12:   vi.restoreAllMocks();
13: });
14: 
15: function jsonResponse(json) {
16:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
17: }
18: 
19: function issue(
20:   title,
21:   { body = "", labels = [{ name: "accepted" }], state = "open" } = {}
22: ) {
23:   return { body, labels, state, title };
24: }
25: 
26: describe("validateApprovalAttestation", () => {
27:   test("accepts the current accepted event and its trusted attestation", async () => {
28:     const title = "publish: getsentry/sentry-javascript@10.0.0";
29:    ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createCiReadyAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const {
7:   getAllPages,
8:   getGitHubResponse,
9:   getIssue,
10: } = require("./validate-approval-attestation.js");
11: 
12: async function getAuthenticatedLogin() {
13:   const response = await getGitHubResponse("user");
14: 
15:   if (!response.ok) {
16:     throw new Error(
17:       `Could not retrieve the authenticated user: GitHub returned ${response.status}`
18:     );
19:   }
20: 
21:   const { login } = await response.json();
22: 
23:   if (typeof login !== "string") {
24:     throw new Error("GitHub returned no authenticated user login");
25:   }
26: 
27:   return login;
28: }
29: 
30: async function recordCiReadyAttestation({
31:   expectedAcceptedEvent,
32:   getAuthenticatedLogin,
33:   getIssue,
34:  ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordCiReadyAttestation,
8: } = require("../record-ci-ready-attestation.js");
9: 
10: describe("recordCiReadyAttestation", () => {
11:   test("binds the current approval to the app that will add ci-ready", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordCiReadyAttestation({
16:         getAuthenticatedLogin: vi
17:           .fn()
18:           .mockResolvedValue("sentry-internal-app[bot]"),
19:         getIssue: vi.fn().mockResolvedValue({
20:           body: "Merge target: main",
21:           labels: [{ name: "accepted" }],
22:           state: "open",
23:           title,
24:         }),
25:         ...

Success. Updated the following files:
M src/publish/__tests__/validate-approval-attestation.js
M src/publish/__tests__/record-ci-ready-attestation.js
M src/publish/__tests__/ci-poller-workflow.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/ci-poller-workflow.js (4 tests | 1 failed) 32ms
     × binds every poller approval fence to the listed request snapshot 18ms
 ❯ src/publish/__tests__/record-ci-ready-attestation.js (4 tests | 1 failed) 25ms
     × rejects a valid live approval for a different poller snapshot 12ms
 ❯ src/publish/__tests__/validate-approval-attestation.js (10 tests | 1 ...

Found 8 matches
/home/byk/Code/getsentry/publish/src/publish/resolve-ci-poller-input.js:
  Line 10:     getCiPollerInput({


/home/byk/Code/getsentry/publish/src/modules/ci-poller-input.js:
  Line 12: function getCiPollerInput({ title, issueBody, revision }) {


/home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-input.js:
  Line 19:     getCiPollerInput({

  Line 30:     getCiPollerInput({

  Line 59:       getCiPollerInput({

  Line 71:       getCiPollerInput({

  Line 82:     expect(() => getCiPollerInput({ issueBody, title })).toThrow(

  Line 94:   expect(() => getCiPollerInput({ issueBody, title })).toThrow(

Success. Updated the following files:
M src/modules/ci-poller-input.js
M src/publish/resolve-ci-poller-input.js
M src/publish/validate-approval-attestation.js
M src/publish/record-ci-ready-attestation.js
M .github/workflows/ci-poller.yml

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-input.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { join } from "path";
3: 
4: import { expect, test } from "vitest";
5: 
6: const { getCiPollerInput } = require("../ci-poller-input.js");
7: 
8: const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
9: const issueBody = `Requested by: @byk
10: 
11: Merge target: (default)
12: 
13: Quick links:
14: - [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
15: - [View check runs](https://github.com/getsentry/toolkit/commit/${REVISION}/checks/)`;
16: 
17: test("parses root and full-path publish titles", () => {
18:   expect(
19:     getCiPollerInput({
20:       issueBody,
21:       title: "publish: getsentry/toolkit/cli@1.2.3",
22:     })
23:   ).toEqual({
24:     repo: "getsentry/toolkit",
25:     revision: REVISION,
26:     version: "1.2.3",
27:   });
28: 
29:   expect(
30:     ...

Success. Updated the following files:
M src/modules/__tests__/ci-poller-input.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/ci-poller-input.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish


 Test Files  4 passed (4)
      Tests  32 passed (32)
   Start at  02:40:24
   Duration  661ms (transform 132ms, setup 0ms, import 296ms, tests 71ms, environment 1ms)

Done in 1.27s.

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

<path>/home/byk/Code/getsentry/publish/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require("@actions/github");
2: const core = require("@actions/core");
3: const { detailsFromContext } = require("../modules/details-from-context");
4: 
5: async function inputs() {
6:   const result = await detailsFromContext({
7:     context: github.context,
8:   });
9:   core.setOutput("result", JSON.stringify(result));
10: }
11: inputs();

(End of file - total 11 lines)
</content>

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5:   hasAutoApprovalAttestation,
6: } = require("../modules/approval-attestation.js");
7: const {
8:   AUTO_APPROVAL_LABELER,
9:   AUTO_APPROVERS,
10:   authorizeApproval,
11:   isAutoApprovedRepository,
12: } = require("../modules/approval-authorizer.js");
13: 
14: function getAutoApprovedRepositories() {
15:   return new Set(
16:     fs
17:       .readFileSync("auto-approve-repos.txt", "utf8")
18:       .split(/\r?\n/)
19:       .filter(Boolean)
20:   );
21: }
22: 
23: async function getPermission({ owner, repository, username }) {
24:   const response = await getGitHubResponse(
25:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
26:       repository
27:     )}/collaborators/${encodeURIComponent(username)}/permission`
28:   );
29: 
30:   if (!response.ok) {
31:     ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8:   issues: write
9: 
10: jobs:
11:   auto-approve:
12:     runs-on: ubuntu-latest
13:     environment: production
14:     if: |
15:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
16:       startsWith(github.event.issue.title, 'publish: ')
17:     steps:
18:       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
19:         with:
20:           persist-credentials: false
21:       - name: Get auth token
22:         id: token
23:         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
24:         with:
25:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
26:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
27:       - name: Record automated approval ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-auto-approval-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createAutoApprovalAttestation,
4: } = require("../modules/approval-attestation.js");
5: const { getIssue } = require("./validate-approval-attestation.js");
6: 
7: async function recordAutoApprovalAttestation({
8:   autoApprover,
9:   getIssue,
10:   issueNumber,
11:   issueTitle,
12:   repository,
13: }) {
14:   const issue = await getIssue({ repository, issueNumber });
15: 
16:   if (
17:     issue.state !== "open" ||
18:     issue.title !== issueTitle ||
19:     issue.user?.login?.toLowerCase() !== autoApprover.toLowerCase()
20:   ) {
21:     throw new Error("The automated approval request changed before approval");
22:   }
23: 
24:   return createAutoApprovalAttestation({ autoApprover, issue });
25: }
26: 
27: async function main() {
28:   for (const name of [
29:     "GITHUB_OUTPUT",
30:     "APPROVAL_TOKEN",
31:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   createAutoApprovalAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   getAutoApprovedRepositories,
8:   main,
9: } = require("../authorize-approval.js");
10: 
11: const originalEnvironment = { ...process.env };
12: 
13: afterEach(() => {
14:   process.env = { ...originalEnvironment };
15:   vi.restoreAllMocks();
16:   vi.resetModules();
17: });
18: 
19: function jsonResponse(json) {
20:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
21: }
22: 
23: async function runAuthorization({ actor, issueTitle, responses }) {
24:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
25:   process.env.APPROVAL_TOKEN = "release-bot-token";
26:   process.env.APPROVAL_ACTOR = actor;
27:   process.env.APPROVAL_ISSUE_NUMBER = ...

Found 19 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 67:         run: node src/publish/authorize-approval.js

  Line 91:         run: node src/publish/validate-approval-attestation.js

  Line 207:         run: node .__publish__/src/publish/validate-approval-attestation.js

  Line 340:         run: node .__publish__/src/publish/validate-approval-attestation.js


/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml:
  Line 163:               node .__publish__/src/publish/validate-approval-attestation.js; then

  Line 293:                 node .__publish__/src/publish/validate-approval-attestation.js; then

  Line 315:                 node .__publish__/src/publish/record-ci-ready-attestation.js; then

  Line 360:                 node .__publish__/src/publish/validate-approval-attestation.js; then


/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml:
  Line 35:         run: node ...

[
  {
    "content": "Bind every event-triggered approval and publish path to its exact request snapshot digest",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Review publication, discovery, checkout, attestation, and failure cleanup end to end",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Run focused regressions, full tests, lint, formatting, and diff checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain substantive independent correctness and security review of the exact final tree",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-auto-approval-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseAutoApprovalAttestation,
5: } = require("../../modules/approval-attestation.js");
6: const {
7:   recordAutoApprovalAttestation,
8: } = require("../record-auto-approval-attestation.js");
9: 
10: describe("recordAutoApprovalAttestation", () => {
11:   test("binds an automated requester to the live publish request", async () => {
12:     const title = "publish: getsentry/sentry-javascript@10.0.0";
13: 
14:     await expect(
15:       recordAutoApprovalAttestation({
16:         autoApprover: "getsantry[bot]",
17:         getIssue: vi.fn().mockResolvedValue({
18:           body: "Merge target: main",
19:           labels: [],
20:           state: "open",
21:           title,
22:           user: { login: "getsantry[bot]" },
23:         }),
24:         issueNumber: "123",
25:       ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/auto-approval-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/auto-approve.yml", "utf8");
5: 
6: describe("auto-approval workflow", () => {
7:   test("checks out the code used to record the attestation", () => {
8:     const checkout = workflow.slice(
9:       workflow.indexOf("uses: actions/checkout@"),
10:       workflow.indexOf("Record automated approval attestation")
11:     );
12: 
13:     expect(checkout).not.toContain("sparse-checkout:");
14:   });
15: 
16:   test("records a request-bound attestation before adding accepted", () => {
17:     expect(workflow).toContain(
18:       "node src/publish/record-auto-approval-attestation.js"
19:     );
20:     expect(
21:       workflow.indexOf("record-auto-approval-attestation.js")
22:     ).toBeLessThan(workflow.indexOf("--add-label ...

Success. Updated the following files:
A src/publish/__tests__/request-digest-from-event.js
M src/publish/__tests__/authorize-approval.js
M src/publish/__tests__/record-auto-approval-attestation.js
M src/publish/__tests__/auto-approval-workflow.js
M src/publish/__tests__/publish-workflow.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/request-digest-from-event.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/record-auto-approval-attestation.js src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/publish-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/auto-approval-workflow.js (3 tests | 1 failed) 47ms
     × records a request-bound attestation before adding accepted 39ms
 ❯ src/publish/__tests__/record-auto-approval-attestation.js (3 tests | 1 failed) 64ms
     × rejects a valid live request for a different opened-event snapshot 42ms
 ❯ ...

Found 20 matches
/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js:
  Line 51:     (expectedRequestDigest && requestDigest(issue) !== expectedRequestDigest) ||


/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js:
  Line 76:     (!expectedRequestDigest || requestDigest(issue) === expectedRequestDigest) &&


/home/byk/Code/getsentry/publish/src/publish/__tests__/request-digest-from-event.js:
  Line 14:     expect(requestDigestFromEvent({ issue })).toBe(requestDigest(issue));


/home/byk/Code/getsentry/publish/src/publish/__tests__/record-auto-approval-attestation.js:
  Line 18:         expectedRequestDigest: requestDigest({

  Line 67:         expectedRequestDigest: requestDigest({


/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js:
  Line 117:         expectedRequestDigest: requestDigest({


/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js:
  Line 177:       ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const crypto = require("crypto");
2: 
3: const APPROVAL_ATTESTATION_PREFIX = "<!-- publish-approval ";
4: const AUTO_APPROVAL_ATTESTATION_PREFIX = "<!-- publish-auto-approval ";
5: const CI_READY_ATTESTATION_PREFIX = "<!-- publish-ci-ready ";
6: const ATTESTATION_SUFFIX = " -->";
7: 
8: function createAttestation(prefix, value) {
9:   return `${prefix}${Buffer.from(JSON.stringify(value)).toString(
10:     "base64url"
11:   )}${ATTESTATION_SUFFIX}`;
12: }
13: 
14: function requestDigest({ body, labels, title }) {
15:   if (typeof body !== "string" || !Array.isArray(labels)) {
16:     throw new Error("Invalid publish request");
17:   }
18: 
19:   return crypto
20:     .createHash("sha256")
21:     .update(
22:       JSON.stringify({
23:         body,
24:         dryRun: labels.some((label) => label.name === "dry-run"),
25:         title,
26:       })
27:     )
28:     ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8:   createCiReadyAttestation,
9:   requestDigest,
10: } = require("../../modules/approval-attestation.js");
11: 
12: afterEach(() => {
13:   vi.restoreAllMocks();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: function issue(
21:   title,
22:   { body = "", labels = [{ name: "accepted" }], state = "open" } = {}
23: ) {
24:   return { body, labels, state, title };
25: }
26: 
27: describe("validateApprovalAttestation", () => {
28:   test("accepts the current accepted event and its trusted attestation", async () => {
29:     const title = "publish: ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   currentCiReadyEvent,
4:   hasApprovalAttestation,
5:   hasCiReadyAttestation,
6:   requestDigest,
7: } = require("../modules/approval-attestation.js");
8: 
9: async function getGitHubResponse(path) {
10:   return fetch(`https://api.github.com/${path}`, {
11:     headers: {
12:       Accept: "application/vnd.github+json",
13:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
14:       "X-GitHub-Api-Version": "2026-03-10",
15:     },
16:   });
17: }
18: 
19: async function getIssue({ repository, issueNumber }) {
20:   const response = await getGitHubResponse(
21:     `repos/${repository}/issues/${issueNumber}`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
27:     );
28:   }
29: 
30:   return ...

<path>/home/byk/Code/getsentry/publish/src/publish/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createCiReadyAttestation,
4:   currentAcceptedEvent,
5:   requestDigest,
6: } = require("../modules/approval-attestation.js");
7: const {
8:   getAllPages,
9:   getGitHubResponse,
10:   getIssue,
11: } = require("./validate-approval-attestation.js");
12: 
13: async function getAuthenticatedLogin() {
14:   const response = await getGitHubResponse("user");
15: 
16:   if (!response.ok) {
17:     throw new Error(
18:       `Could not retrieve the authenticated user: GitHub returned ${response.status}`
19:     );
20:   }
21: 
22:   const { login } = await response.json();
23: 
24:   if (typeof login !== "string") {
25:     throw new Error("GitHub returned no authenticated user login");
26:   }
27: 
28:   return login;
29: }
30: 
31: async function recordCiReadyAttestation({
32:   expectedAcceptedEvent,
33:   ...

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/Code/getsentry/publish/src/publish/authorize-approval.js:
    "APPROVAL_ISSUE_REPOSITORY",
  ]) {

Success. Updated the following files:
A src/publish/request-digest-from-event.js
M src/publish/authorize-approval.js
M src/publish/record-auto-approval-attestation.js
M src/publish/validate-approval-attestation.js
M src/publish/record-ci-ready-attestation.js

Success. Updated the following files:
M .github/workflows/auto-approve.yml
M .github/workflows/publish.yml
M src/publish/__tests__/publish-workflow.js

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/record-ci-ready-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   parseCiReadyAttestation,
5:   requestDigest,
6: } = require("../../modules/approval-attestation.js");
7: const {
8:   recordCiReadyAttestation,
9: } = require("../record-ci-ready-attestation.js");
10: 
11: describe("recordCiReadyAttestation", () => {
12:   test("binds the current approval to the app that will add ci-ready", async () => {
13:     const title = "publish: getsentry/sentry-javascript@10.0.0";
14: 
15:     await expect(
16:       recordCiReadyAttestation({
17:         getAuthenticatedLogin: vi
18:           .fn()
19:           .mockResolvedValue("sentry-internal-app[bot]"),
20:         getIssue: vi.fn().mockResolvedValue({
21:           body: "Merge target: main",
22:           labels: [{ name: "accepted" }],
23:           state: "open",
24:           title,
25:         ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
321:           {
322:             actor: { login: "contractor" },
323:             event: "labeled",
324:             id: "200",
325:             label: { name: "accepted" },
326:           },
327:         ])
328:       )
329:       .mockResolvedValueOnce(
330:         jsonResponse([
331:           { body: attestation, user: { login: "github-actions[bot]" } },
332:         ])
333:       );
334: 
335:     await expect(
336:       validateApprovalAttestation({
337:         attestationAuthor: "github-actions[bot]",
338:         expectedAcceptedEvent: { actor: "contractor", eventId: "100" },
339:         issueNumber: "123",
340:         issueTitle: title,
341:         repository: "getsentry/publish",
342:       })
343:     ).resolves.toBe(false);
344:   });
345: 
346:   test("requires a CI-ready proof tied to the current approval and label actor", async () => ...

Found 10 matches
/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js:
  Line 56:       validateApprovalAttestation({

  Line 95:       validateApprovalAttestation({

  Line 134:       validateApprovalAttestation({

  Line 175:       validateApprovalAttestation({

  Line 213:       validateApprovalAttestation({

  Line 250:       validateApprovalAttestation({

  Line 293:       validateApprovalAttestation({

  Line 336:       validateApprovalAttestation({

  Line 395:       validateApprovalAttestation({

  Line 454:       validateApprovalAttestation({

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test } from "vitest";
2: 
3: const {
4:   createApprovalAttestation,
5:   createCiReadyAttestation,
6:   currentAcceptedEvent,
7:   hasApprovalAttestation,
8:   hasCiReadyAttestation,
9:   parseApprovalAttestation,
10:   requestDigest,
11: } = require("../approval-attestation.js");
12: 
13: function issue(title, { body = "", dryRun = false } = {}) {
14:   return {
15:     body,
16:     labels: dryRun ? [{ name: "dry-run" }] : [],
17:     title,
18:   };
19: }
20: 
21: describe("approval attestations", () => {
22:   test("matches the latest accepted event to a trusted attestation", () => {
23:     const title = "publish: getsentry/relay/py@1.2.3";
24:     const publishIssue = issue(title);
25:     const attestation = createApprovalAttestation({
26:       actor: "contractor",
27:       eventId: "200",
28:       issue: publishIssue,
29:     ...

Success. Updated the following files:
M src/modules/approval-attestation.js
M src/publish/__tests__/request-digest-from-event.js
M src/publish/__tests__/record-auto-approval-attestation.js
M src/publish/__tests__/record-ci-ready-attestation.js
M src/publish/__tests__/authorize-approval.js

Success. Updated the following files:
M src/publish/__tests__/validate-approval-attestation.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/approval-attestation.js src/modules/__tests__/ci-poller-input.js src/publish/__tests__/request-digest-from-event.js src/publish/__tests__/authorize-approval.js src/publish/__tests__/record-auto-approval-attestation.js src/publish/__tests__/record-ci-ready-attestation.js src/publish/__tests__/validate-approval-attestation.js src/publish/__tests__/auto-approval-workflow.js src/publish/__tests__/publish-workflow.js src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish


 Test Files  10 passed (10)
      Tests  56 passed (56)
   Start at  03:00:12
   Duration  1.60s (transform 317ms, setup 0ms, import 683ms, tests 214ms, environment 2ms)

Done in 2.21s.

[
  {
    "content": "Bind every event-triggered approval and publish path to its exact request snapshot digest",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Review publication, discovery, checkout, attestation, and failure cleanup end to end",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Run focused regressions, full tests, lint, formatting, and diff checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain substantive independent correctness and security review of the exact final tree",
    "status": "pending",
    "priority": "high"
  }
]

No files found

<task id="ses_f76bce8f0ffehxXvUzMX3GW4dn" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f76bcb774ffed9lA7RT2yd0btL" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

yarn run v1.22.22
$ yarn check:generated && vitest run --printConsoleTrace
$ node scripts/generate-publish-issue-title-parser.js --check

 RUN  v4.1.0 /home/byk/Code/getsentry/publish


 Test Files  26 passed (26)
      Tests  171 passed (171)
   Start at  03:01:47
   Duration  5.44s (transform 702ms, setup 0ms, import 2.76s, tests 2.79s, environment 12ms)

Done in 6.80s.

yarn run v1.22.22
$ eslint src .github --ignore-pattern '!.github'
Done in 1.17s.

(no output)

<task id="ses_f76bce8f0ffehxXvUzMX3GW4dn" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f76bcb774ffed9lA7RT2yd0btL" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

<task id="ses_f76ab45fcffeECLKLvffvLIZyX" state="running">
<summary>Background task started</summary>
<task_result>
The task is working in the background. You will be notified automatically when it finishes.
DO NOT sleep, poll for progress, ask the task for status, or duplicate this task's work — avoid working with the same files or topics it is using.
Work on non-overlapping tasks, or briefly tell the user what you launched and end your response.
</task_result>
</task>

[
  {
    "content": "Bind every event-triggered approval and publish path to its exact request snapshot digest",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Reproduce and fix CI-poller rejection, malformed-input, activation, and ci-ready transition failures",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Reproduce and fix publish success/failure reconciliation and dependency-free approval cleanup",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Make terminal reporting tolerate missing publish inputs",
    "status": "pending",
    "priority": "medium"
  },
  {
    "content": "Run focused mutation regressions, 10-run stability checks, full tests, lint, formatting, and diff checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain substantive independent correctness and security review of the exact final tree",
    "status": "in_progress",
    "priority": "high"
  }
]

[
  {
    "content": "Bind every event-triggered approval and publish path to its exact request snapshot digest",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Reproduce and fix CI-poller rejection, malformed-input, activation, and ci-ready transition failures",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Reproduce and fix publish success/failure reconciliation and dependency-free approval cleanup",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Make terminal reporting tolerate missing publish inputs",
    "status": "pending",
    "priority": "medium"
  },
  {
    "content": "Run focused mutation regressions, 10-run stability checks, full tests, lint, formatting, and diff checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain substantive independent correctness and security review of the exact final tree",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   repository_dispatch:
7:     types: [ci-poller]
8:   workflow_run:
9:     workflows: [Run CI Status Poller]
10:     types: [completed]
11: 
12: permissions:
13:   contents: read
14:   issues: write
15: 
16: jobs:
17:   check-ci:
18:     runs-on: ubuntu-latest
19:     environment: production
20:     # Skip entirely (no runner provisioned) when there's nothing to check.
21:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
22:     # repository_dispatch and a successful main-branch run of the protected
23:     # workflow_dispatch relay are the trusted manual-recovery paths.
24:     if: >-
25:       vars.CI_POLLER_HAS_PENDING == 'true'
26:       || github.event_name == 'repository_dispatch'
27:       || (
28:       github.event_name == 'workflow_run'
29:       && ...

before-x
after-x
outer-x
before-y
after-y
outer-y
bash: line 1: continue: only meaningful in a `for', `while', or `until' loop
bash: line 1: continue: only meaningful in a `for', `while', or `until' loop

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/ci-poller-workflow.js</path>
<type>file</type>
<content>
1: import {
2:   mkdtempSync,
3:   mkdirSync,
4:   readFileSync,
5:   readdirSync,
6:   rmSync,
7:   writeFileSync,
8: } from "fs";
9: import { tmpdir } from "os";
10: import { join } from "path";
11: import { spawnSync } from "child_process";
12: 
13: import { afterEach, expect, test } from "vitest";
14: 
15: const temporaryDirectories = [];
16: const INITIAL_REVISION = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
17: const UPDATED_REVISION = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
18: 
19: function getPollerScript() {
20:   const workflow = readFileSync(
21:     join(__dirname, "../../../.github/workflows/ci-poller.yml"),
22:     "utf8"
23:   );
24:   const section = workflow.match(
25:     / {6}- name: Check CI status for ci-pending issues[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- name: Check for remaining pending issues/
26:   );
27: 
28:   if ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

before-x
after-x
outer-x
completed
bash: line 1: continue: only meaningful in a `for', `while', or `until' loop

Success. Updated the following files:
M src/modules/__tests__/ci-poller-workflow.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/modules/__tests__/ci-poller-workflow.js (14 tests | 13 failed) 3049ms
   × revokes approval when the poller resolver fails 137ms
   × revokes approval when the rewrite response has no body 238ms
   × revokes approval when the rewrite response body is empty 230ms
   × revokes approval when the rewrite response is malformed JSON 237ms
   × revokes approval when the rewrite response is a non-object JSON value 230ms
   × stops the poll cycle when the accepted event cannot ...

<path>/home/byk/Code/getsentry/publish/src/publish/post-result.js</path>
<type>file</type>
<content>
1: const processEndState = require("../modules/process-end-state");
2: const { getGitHubToken } = require("../libs/github");
3: const github = require("@actions/github");
4: 
5: const context = github.context;
6: const octokit = github.getOctokit(getGitHubToken());
7: const inputs = JSON.parse(process.env.PUBLISH_ARGS);
8: const args = process.argv.slice(2);
9: const status = args[0];
10: 
11: processEndState({ context, octokit, inputs, status });

(End of file - total 11 lines)
</content>

Success. Updated the following files:
M src/modules/__tests__/ci-poller-workflow.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/modules/__tests__/ci-poller-workflow.js (14 tests | 13 failed) 1717ms
   × revokes approval when the poller resolver fails 59ms
   × revokes approval when the rewrite response has no body 105ms
   × revokes approval when the rewrite response body is empty 106ms
   × revokes approval when the rewrite response is malformed JSON 115ms
   × revokes approval when the rewrite response is a non-object JSON value 99ms
   × stops the poll cycle when the accepted event cannot be ...

Success. Updated the following files:
M .github/workflows/ci-poller.yml

Found 6 matches
/home/byk/Code/getsentry/publish/.github/workflows/publish.yml:
  Line 55:         continue-on-error: true

  Line 64:         continue-on-error: true

  Line 88:         continue-on-error: true

  Line 154:         continue-on-error: true

  Line 209:         continue-on-error: true

  Line 343:         continue-on-error: true

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/ci-poller-workflow.js src/publish/__tests__/ci-poller-workflow.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish


 Test Files  2 passed (2)
      Tests  18 passed (18)
   Start at  03:49:45
   Duration  1.80s (transform 67ms, setup 0ms, import 131ms, tests 1.52s, environment 0ms)

Done in 2.32s.

[
  {
    "content": "Bind every event-triggered approval and publish path to its exact request snapshot digest",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Reproduce and fix CI-poller rejection, malformed-input, activation, and ci-ready transition failures",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Reproduce and fix publish success/failure reconciliation and dependency-free approval cleanup",
    "status": "in_progress",
    "priority": "high"
  },
  {
    "content": "Make terminal reporting tolerate missing publish inputs",
    "status": "pending",
    "priority": "medium"
  },
  {
    "content": "Run focused mutation regressions, 10-run stability checks, full tests, lint, formatting, and diff checks",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Obtain substantive independent correctness and security review of the exact final tree",
    "status": "pending",
    "priority": "high"
  }
]

<path>/home/byk/Code/getsentry/publish/src/modules/process-end-state.js</path>
<type>file</type>
<content>
1: const Sentry = require("@sentry/node");
2: 
3: async function processEndState({ context, octokit, inputs, status }) {
4:   const { repo, version } = inputs;
5:   const { repo: publishRepo, runId: run_id } = context;
6:   const { number: issue_number } = context.payload.issue;
7:   const workflowInfo = (
8:     await octokit.rest.actions.getWorkflowRun({
9:       ...publishRepo,
10:       run_id,
11:     })
12:   ).data;
13: 
14:   const details = {
15:     repo,
16:     version,
17:     publishRepo,
18:     run_id,
19:     issue_number,
20:     workflowInfo,
21:     status,
22:   };
23: 
24:   await postIssueComment({
25:     octokit,
26:     details,
27:   });
28: 
29:   if (status === "success") {
30:     await octokit.rest.issues.update({
31:       ...publishRepo,
32:       issue_number,
33:       state: "closed",
34:     });
35:   }
36: 
37:   await reportSession({ ...

<path>/home/byk/Code/getsentry/publish/src/modules/update-issue.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   TARGETS_SECTION_PARSER_REGEX,
4:   TARGETS_PARSER_REGEX,
5: } = require("./details-from-context");
6: 
7: async function updateTargets({
8:   octokit,
9:   stateFilePath,
10:   publishRepo,
11:   issue_number,
12: }) {
13:   if (!stateFilePath || !fs.existsSync(stateFilePath)) {
14:     return;
15:   }
16: 
17:   const issueRequest = octokit.rest.issues.get({
18:     ...publishRepo,
19:     issue_number,
20:   });
21: 
22:   const craftStateRequest = fs.promises
23:     .readFile(stateFilePath, { encoding: "utf-8" })
24:     .then((data) => JSON.parse(data));
25: 
26:   const [{ data: issue }, craftState] = await Promise.all([
27:     issueRequest,
28:     craftStateRequest,
29:   ]);
30: 
31:   const newIssueBody = transformIssueBody(craftState, issue.body);
32: 
33:   await octokit.rest.issues.update({
34:     ...publishRepo,
35:     ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js</path>
<type>file</type>
<content>
1: import { vi, describe, test, expect } from "vitest";
2: 
3: vi.mock("fs");
4: 
5: const processEndState = require("../process-end-state.js");
6: 
7: describe("publish failed", () => {
8:   const failureArgs = {
9:     status: "failure",
10:     inputs: { repo: "sentry", version: "21.3.1" },
11:     context: {
12:       runId: "1234",
13:       repo: { owner: "getsentry", repo: "publish" },
14:       payload: { issue: { number: "211" } },
15:     },
16:     octokit: {
17:       rest: {
18:         actions: {
19:           getWorkflowRun: async () => ({
20:             data: {
21:               html_url: "https://github.com/getsentry/sentry/actions/runs/1234",
22:             },
23:           }),
24:         },
25:         issues: {
26:           createComment: vi.fn(),
27:         },
28:       },
29:     },
30:     Sentry: {
31:       Scope: class Scope {
32:         ...

apply_patch verification failed: Error: Failed to find expected lines in /home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js:
    expect(craftReference?.[1]).toHaveLength(64);
  });
});

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { describe, expect, test } from "vitest";
3: 
4: const workflow = readFileSync(".github/workflows/publish.yml", "utf8");
5: 
6: describe("publish workflow", () => {
7:   test("binds approval and publication to the triggering issue snapshot", () => {
8:     expect(workflow).toContain("node src/publish/request-digest-from-event.js");
9:     expect(
10:       workflow.match(
11:         /EXPECTED_REQUEST_DIGEST: \$\{\{ steps\.request-digest\.outputs\.request_digest \}\}/g
12:       )
13:     ).toHaveLength(4);
14:   });
15: 
16:   test("revalidates approval immediately before Craft", () => {
17:     const fence = workflow.indexOf("Revalidate approval attestation");
18: 
19:     expect(fence).toBeGreaterThan(workflow.indexOf("Set targets"));
20:     expect(fence).toBeLessThan(workflow.indexOf("Publish using Craft"));
21:     ...

Success. Updated the following files:
M src/publish/__tests__/publish-workflow.js
M src/modules/__tests__/process-end-state.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/publish-workflow.js src/modules/__tests__/process-end-state.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/publish-workflow.js (5 tests | 2 failed) 23ms
     × activates the poller independently of comments and revokes approval if both activation paths fail 9ms
     × reconciles authorization without Node before and after terminal reporting 2ms
 ❯ src/modules/__tests__/process-end-state.js (5 tests | 1 failed) 39ms
     × closes the issue before workflow lookup and comments 2ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 3 ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js</path>
<type>file</type>
<content>
35:         captureMessage() {}
36:         captureSession() {}
37:       },
38:       Session: class Session {},
39:     },
40:   };
41: 
42:   test("create comment", async () => {
43:     await processEndState(failureArgs);
44: 
45:     const createComment = failureArgs.octokit.rest.issues.createComment;
46:     expect(createComment).toHaveBeenCalledTimes(1);
47:     expect(createComment.mock.calls[0][0]).toMatchInlineSnapshot(`
48:       {
49:         "body": "Failed to publish. ([run logs](https://github.com/getsentry/sentry/actions/runs/1234?check_suite_focus=true#step:8))
50: 
51:       _Bad branch? You can [delete with ease](https://github.com/getsentry/sentry/branches/all?query=21.3.1) and start over._",
52:         "issue_number": "211",
53:         "owner": "getsentry",
54:         "repo": "publish",
55:       }
56:     `);
57:   });
58: 
59:   test("closes ...

Success. Updated the following files:
M src/modules/__tests__/process-end-state.js

Found 1 matches
/home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js:
  Line 113:   test("closes the issue before workflow lookup and comments", async () => {

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js</path>
<type>file</type>
<content>
90:         captureSession() {}
91:       },
92:       Session: class Session {},
93:     },
94:   };
95: 
96:   test("create comment", async () => {
97:     await processEndState(cancelledArgs);
98: 
99:     const createComment = cancelledArgs.octokit.rest.issues.createComment;
100:     expect(createComment).toHaveBeenCalledTimes(1);
101:     expect(createComment.mock.calls[0][0]).toMatchInlineSnapshot(`
102:       {
103:         "body": "Publish workflow cancelled. ([run logs](https://github.com/getsentry/sentry/actions/runs/1234?check_suite_focus=true#step:8))
104: 
105:       _Bad branch? You can [delete with ease](https://github.com/getsentry/sentry/branches/all?query=21.3.1) and start over._",
106:         "issue_number": "211",
107:         "owner": "getsentry",
108:         "repo": "publish",
109:       }
110:     `);
111:   });
112: 
113:   test("closes the ...

Success. Updated the following files:
M src/modules/__tests__/process-end-state.js

Found 1 matches
/home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js:
  Line 177:   test("closes the issue before workflow lookup and comments", async () => {

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/modules/__tests__/process-end-state.js -t 'closes the issue before workflow lookup and comments' --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/modules/__tests__/process-end-state.js (5 tests | 1 failed | 4 skipped) 18ms
     × closes the issue before workflow lookup and comments 16ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/modules/__tests__/process-end-state.js > publish success > closes the issue before workflow lookup and comments
AssertionError: expected "vi.fn()" to be called with arguments: [ { issue_number: '211', …(3) } ]

Number of calls: 0

 ❯ ...

Found 10 matches
/home/byk/Code/getsentry/publish/src/publish/post-result.js:
  Line 1: const processEndState = require("../modules/process-end-state");

  Line 11: processEndState({ context, octokit, inputs, status });


/home/byk/Code/getsentry/publish/src/modules/process-end-state.js:
  Line 3: async function processEndState({ context, octokit, inputs, status }) {

  Line 119: module.exports = processEndState;


/home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js:
  Line 5: const processEndState = require("../process-end-state.js");

  Line 43:     await processEndState(failureArgs);

  Line 97:     await processEndState(cancelledArgs);

  Line 152:     await processEndState(successArgs);

  Line 182:       processEndState({

  Line 242:       await processEndState(nostatusArgs);

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

Success. Updated the following files:
M .github/workflows/publish.yml
M src/modules/process-end-state.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/publish-workflow.js src/modules/__tests__/publish-workflow.js src/modules/__tests__/process-end-state.js src/modules/__tests__/update-issue.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/publish-workflow.js (5 tests | 1 failed) 25ms
     × reconciles authorization without Node before and after terminal reporting 17ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/publish-workflow.js > publish workflow > reconciles authorization without Node before and after terminal reporting
AssertionError: expected 'name: Reconcile publish issue\n      …' to contain 'steps.publish.outcome == ...

Found 7 matches
/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js:
  Line 17:   vi.resetModules();


/home/byk/Code/getsentry/publish/src/modules/__tests__/process-end-state.js:
  Line 5: const processEndState = require("../process-end-state.js");

  Line 43:     await processEndState(failureArgs);

  Line 97:     await processEndState(cancelledArgs);

  Line 152:     await processEndState(successArgs);

  Line 182:       processEndState({

  Line 242:       await processEndState(nostatusArgs);

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   createAutoApprovalAttestation,
5:   requestDigest,
6: } = require("../../modules/approval-attestation.js");
7: const {
8:   getAutoApprovedRepositories,
9:   main,
10: } = require("../authorize-approval.js");
11: 
12: const originalEnvironment = { ...process.env };
13: 
14: afterEach(() => {
15:   process.env = { ...originalEnvironment };
16:   vi.restoreAllMocks();
17:   vi.resetModules();
18: });
19: 
20: function jsonResponse(json) {
21:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
22: }
23: 
24: async function runAuthorization({ actor, issueTitle, responses }) {
25:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
26:   process.env.APPROVAL_TOKEN = "release-bot-token";
27:   process.env.APPROVAL_ACTOR = actor;
28:   ...

Success. Updated the following files:
M src/publish/__tests__/publish-workflow.js
A src/publish/__tests__/post-result.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/post-result.js src/publish/__tests__/publish-workflow.js src/modules/__tests__/process-end-state.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/publish-workflow.js (5 tests | 1 failed) 27ms
     × reconciles authorization without Node before and after terminal reporting 19ms
 ❯ src/publish/__tests__/post-result.js (2 tests | 2 failed) 515ms
     × reports terminal state when publish inputs are undefined 512ms
     × reports terminal state when publish inputs are not-json 1ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 3 ...

<path>/home/byk/Code/getsentry/publish/src/publish/update-issue.js</path>
<type>file</type>
<content>
1: const { updateIssue } = require("../modules/update-issue.js");
2: const { getGitHubToken } = require("../libs/github");
3: const github = require("@actions/github");
4: 
5: async function main() {
6:   const context = github.context;
7:   const octokit = github.getOctokit(getGitHubToken());
8:   let inputs;
9: 
10:   if (process.env.PUBLISH_ARGS) {
11:     try {
12:       inputs = JSON.parse(process.env.PUBLISH_ARGS);
13:     } catch {
14:       console.warn("Could not parse publish inputs; skipping target update");
15:     }
16:   }
17: 
18:   await updateIssue({ context, octokit, inputs });
19: }
20: 
21: if (require.main === module) {
22:   main().catch((error) => {
23:     console.error(error);
24:     process.exitCode = 1;
25:   });
26: }
27: 
28: module.exports = { main };

(End of file - total 28 lines)
</content>

Success. Updated the following files:
M src/publish/post-result.js
M src/publish/__tests__/post-result.js
M src/publish/__tests__/publish-workflow.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/post-result.js src/publish/__tests__/publish-workflow.js src/modules/__tests__/publish-workflow.js src/modules/__tests__/process-end-state.js src/modules/__tests__/update-issue.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

 ❯ src/publish/__tests__/post-result.js (2 tests | 2 failed) 569ms
     × reports terminal state when publish inputs are undefined 563ms
     × reports terminal state when publish inputs are not-json 4ms

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 2 ⎯⎯⎯⎯⎯⎯⎯

 FAIL  src/publish/__tests__/post-result.js > post-result entry point > reports terminal state when publish inputs are undefined
 ...

<path>/home/byk/Code/getsentry/publish/src/libs/github.js</path>
<type>file</type>
<content>
1: /**
2:  * This is a helper function that throws a useful error message if the
3:  * workflow environment is not configured correctly.
4:  *
5:  * @returns string
6:  */
7: function getGitHubToken() {
8:   if (!process.env.GITHUB_TOKEN) {
9:     throw new Error(
10:       'No "GITHUB_TOKEN" environment variable found. ' +
11:         "Please ensure the workflow is configured correctly"
12:     );
13:   }
14:   return process.env.GITHUB_TOKEN;
15: }
16: 
17: module.exports = {
18:   getGitHubToken,
19: };

(End of file - total 19 lines)
</content>

Success. Updated the following files:
M src/publish/__tests__/post-result.js

yarn run v1.22.22
$ /home/byk/Code/getsentry/publish/node_modules/.bin/vitest run src/publish/__tests__/post-result.js src/publish/__tests__/publish-workflow.js src/modules/__tests__/publish-workflow.js src/modules/__tests__/process-end-state.js src/modules/__tests__/update-issue.js --printConsoleTrace

 RUN  v4.1.0 /home/byk/Code/getsentry/publish

stderr | src/publish/__tests__/post-result.js > post-result entry point > reports terminal state when publish inputs are not-json
Could not parse publish inputs; reporting without them
 ❯ main src/publish/post-result.js:14:15
 ❯ src/publish/__tests__/post-result.js:38:13

 ❯ src/publish/__tests__/post-result.js (2 tests | 2 failed) 611ms
     × reports terminal state when publish inputs are undefined ...

Success. Updated the following files:
M src/publish/post-result.js
M src/publish/__tests__/post-result.js