Dashboard › publish › Session 1DcQchnOsBBu
1DcQchnOsBBuyEF3qPerform an independent security review of the current uncommitted approval-gate changes in /home/byk/Code/getsentry/publish. Do not edit files. Treat issue authors and users with triage access as adversaries. Review authorization tokens, GitHub API and issue-event semantics, bot provenance, attestations/comments, title/label races, workflow conditions, cleanup guarantees, injection/escaping, and private RBAC exposure. Identify only substantive findings with severity (MUST-FIX/HIGH/MEDIUM/LOW/CONCERN/PASS), exact file:line references, evidence and remediation. End exactly MERGE or DO-NOT-MERGE. Do not use background work.
git
M .github/workflows/ci-poller.yml M .github/workflows/publish.yml M AGENTS.md M src/libs/__tests__/github.js M src/libs/github.js M src/modules/details-from-context.js M src/modules/post-workflow-details.js M src/modules/process-end-state.js M src/modules/update-issue.js M src/publish/inputs.js M src/publish/post-result.js M src/publish/post-workflow-details.js M src/publish/update-issue.js ?? .lore.md ?? src/modules/__tests__/approval-attestation.js ?? src/modules/__tests__/approval-authorizer.js ?? src/modules/approval-attestation.js ?? src/modules/approval-authorizer.js ?? src/publish/__tests__/ ?? src/publish/authorize-approval.js ?? src/publish/validate-approval-attestation.js .github/workflows/ci-poller.yml | 22 +++++++++ .github/workflows/publish.yml | 96 ++++++++++++++++++++++++++++++++++++ AGENTS.md | 6 +++ src/libs/__tests__/github.js | 2 +- src/libs/github.js | 6 ++- ...
diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index a3db430..0834608 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -26,6 +26,11 @@ jobs:
group: ci-status-poller
cancel-in-progress: false
steps:
+ - name: Get publish code
+ uses: actions/checkout@v6
+ with:
+ persist-credentials: false
+
# sentry-internal-app token for label changes on this repo.
# This token is what triggers publish.yml downstream — see
# https://github.com/getsentry/publish for why GITHUB_TOKEN can't.
@@ -92,6 +97,23 @@ jobs:
title=$(echo "$issue" | jq -r '.title')
body=$(echo "$issue" | jq -r '.body')
+ # The attestation binds the latest accepted-label event and title.
+ # Never move a release to ci-ready after either value changes.
+ if ! ...
/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js /home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js /home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js /home/byk/Code/getsentry/publish/src/publish/authorize-approval.js /home/byk/Code/getsentry/publish/src/modules/approval-attestation.js /home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js /home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js /home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js
<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { PUBLISH_TITLE_REGEX } = require("./details-from-context.js");
4:
5: async function authorizeApproval({
6: actor,
7: issueTitle,
8: getPermission,
9: autoApprovedRepositories = new Set(),
10: }) {
11: const title = issueTitle.match(PUBLISH_TITLE_REGEX);
12:
13: if (!title) {
14: return { authorized: false, repository: null };
15: }
16:
17: const repository = `getsentry/${title.groups.repo}`;
18: const releasePath = `${repository}${title.groups.path || ""}`;
19:
20: if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21: return { authorized: true, repository };
22: }
23:
24: if (actor === AUTO_APPROVER) {
25: return { authorized: false, repository };
26: }
27:
28: const { role_name } = ...