Dashboard › publish › Session 1IiBoDLcl6ov
1IiBoDLcl6ovizzYESecurity-review the current uncommitted changes in /home/byk/Code/getsentry/publish. Focus on authorization bypasses, mutable issue-title/accepted-label event binding, token provenance, fail-closed behavior, cleanup paths, use of shared parser, and races before ci-ready/publishing. Do not modify files. You MUST provide a substantive report with file:line citations. Classify each relevant observation as PASS, CONCERN, or MUST-FIX. End with exactly MERGE or DO-NOT-MERGE. Do not return an empty report.
<path>/home/byk/Code/getsentry/publish</path> <type>directory</type> <entries> .eslintrc.js .git/ .github/ .gitignore .lore.md AGENTS.md auto-approve-repos.txt docs/ LICENSE node_modules/ package.json README.md src/ vitest.config.js yarn.lock (15 entries) </entries>
M .github/workflows/ci-poller.yml M .github/workflows/publish.yml M AGENTS.md M src/libs/__tests__/github.js M src/libs/github.js M src/modules/__tests__/details-from-context.js M src/modules/details-from-context.js M src/modules/post-workflow-details.js M src/modules/process-end-state.js M src/modules/update-issue.js M src/publish/inputs.js M src/publish/post-result.js M src/publish/post-workflow-details.js M src/publish/update-issue.js ?? .lore.md ?? src/modules/__tests__/approval-attestation.js ?? src/modules/__tests__/approval-authorizer.js ?? src/modules/approval-attestation.js ?? src/modules/approval-authorizer.js ?? src/publish/__tests__/ ?? src/publish/authorize-approval.js ?? src/publish/validate-approval-attestation.js
.github/workflows/ci-poller.yml | 54 +++++++++++++-- .github/workflows/publish.yml | 96 +++++++++++++++++++++++++++ AGENTS.md | 6 ++ src/libs/__tests__/github.js | 2 +- src/libs/github.js | 6 +- src/modules/__tests__/details-from-context.js | 22 +++++- src/modules/details-from-context.js | 17 ++++- src/modules/post-workflow-details.js | 4 +- src/modules/process-end-state.js | 4 +- src/modules/update-issue.js | 35 +++++----- src/publish/inputs.js | 17 +++-- src/publish/post-result.js | 8 +-- src/publish/post-workflow-details.js | 8 +-- src/publish/update-issue.js | 6 +- 14 files changed, 230 insertions(+), 55 deletions(-) diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml index a3db430..0f3cb1d 100644 --- ...
<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3: issues:
4: types: [labeled]
5:
6: concurrency:
7: # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8: # issues for the same repo@version share a concurrency group.
9: group: ${{ github.event.issue.title }}
10: cancel-in-progress: false
11:
12: permissions:
13: contents: read
14: issues: write
15: packages: write
16:
17: jobs:
18: # When accepted is added to a publish issue:
19: # - Add ci-pending (and remove ci-failed if retrying)
20: # - Enable the poller via CI_POLLER_HAS_PENDING=true
21: # - Comment on the issue
22: # - Trigger the poller immediately so we don't wait for the next cron tick
23: # The publish job below requires ci-ready, so it will not fire until the
24: # poller flips ci-pending → ci-ready (which also prevents publishing without
25: # CI verification in the ...
<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
361: DOCKER_USERNAME: sentrybuilder
362: DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
363: HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
364: TWINE_USERNAME: __token__
365: TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
366: TWINE_VERBOSE: "1"
367: NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
368: GEM_HOST_API_KEY: ${{ secrets.GEM_HOST_API_KEY }}
369: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
370: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
371: NUGET_API_TOKEN: ${{ secrets.NUGET_API_TOKEN }}
372: POWERSHELL_API_KEY: ${{ secrets.POWERSHELL_API_KEY }}
373: GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
374: GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
375: OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
376: ...
<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path> <type>file</type> <content> 1: name: CI Status Poller 2: 3: on: 4: schedule: 5: - cron: "*/5 * * * *" 6: workflow_dispatch: 7: inputs: 8: attempt: 9: description: Self-dispatch attempt counter (internal use) 10: required: false 11: default: "0" 12: 13: permissions: 14: contents: read 15: issues: read 16: 17: jobs: 18: check-ci: 19: runs-on: ubuntu-latest 20: environment: production 21: # Skip entirely (no runner provisioned) when there's nothing to check. 22: # Set to "true" by ci-pending.yml, reset to "false" here when done. 23: # Always allow workflow_dispatch for manual recovery. 24: if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch' 25: concurrency: 26: group: ci-status-poller 27: cancel-in-progress: false 28: steps: 29: - name: Get publish code 30: uses: ...
<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const ATTESTATION_PREFIX = "<!-- publish-approval ";
2: const ATTESTATION_SUFFIX = " -->";
3:
4: function createApprovalAttestation({ actor, eventId, title }) {
5: const value = Buffer.from(
6: JSON.stringify({ actor, eventId: String(eventId), title })
7: ).toString("base64url");
8:
9: return `${ATTESTATION_PREFIX}${value}${ATTESTATION_SUFFIX}`;
10: }
11:
12: function parseApprovalAttestation(body) {
13: const start = body.indexOf(ATTESTATION_PREFIX);
14:
15: if (start === -1) {
16: return null;
17: }
18:
19: const end = body.indexOf(ATTESTATION_SUFFIX, start);
20:
21: if (end === -1) {
22: return null;
23: }
24:
25: try {
26: const value = JSON.parse(
27: Buffer.from(
28: body.slice(start + ATTESTATION_PREFIX.length, end),
29: "base64url"
30: ).toString("utf8")
31: );
32:
33: if (
34: ...
<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { parsePublishTitle } = require("./details-from-context.js");
4:
5: async function authorizeApproval({
6: actor,
7: issueTitle,
8: getPermission,
9: autoApprovedRepositories = new Set(),
10: }) {
11: const title = parsePublishTitle(issueTitle);
12:
13: if (!title) {
14: return { authorized: false, repository: null };
15: }
16:
17: const repository = `getsentry/${title.repo}`;
18: const releasePath = `${repository}${title.path || ""}`;
19:
20: if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21: return { authorized: true, repository };
22: }
23:
24: if (actor === AUTO_APPROVER) {
25: return { authorized: false, repository };
26: }
27:
28: const { role_name } = await getPermission({
29: ...
<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3: createApprovalAttestation,
4: currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7:
8: function getAutoApprovedRepositories() {
9: return new Set(
10: fs
11: .readFileSync("auto-approve-repos.txt", "utf8")
12: .split(/\r?\n/)
13: .filter(Boolean)
14: );
15: }
16:
17: async function getPermission({ owner, repository, username }) {
18: const response = await getGitHubResponse(
19: `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20: repository
21: )}/collaborators/${encodeURIComponent(username)}/permission`
22: );
23:
24: if (!response.ok) {
25: throw new Error(
26: `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...
<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2: currentAcceptedEvent,
3: hasApprovalAttestation,
4: } = require("../modules/approval-attestation.js");
5:
6: async function getGitHubResponse(path) {
7: return fetch(`https://api.github.com/${path}`, {
8: headers: {
9: Accept: "application/vnd.github+json",
10: Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
11: "X-GitHub-Api-Version": "2026-03-10",
12: },
13: });
14: }
15:
16: async function getIssue({ repository, issueNumber }) {
17: const response = await getGitHubResponse(
18: `repos/${repository}/issues/${issueNumber}`
19: );
20:
21: if (!response.ok) {
22: throw new Error(
23: `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
24: );
25: }
26:
27: return response.json();
28: }
29:
30: async function getAllPages({ repository, issueNumber, resource ...
<path>/home/byk/Code/getsentry/publish/.github/workflows</path> <type>directory</type> <entries> auto-approve.yml ci-poller.yml cocoapods-keepalive.yml publish.yml test.yml (5 entries) </entries>
<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3: issues:
4: types: [opened]
5:
6: permissions:
7: contents: read
8:
9: jobs:
10: auto-approve:
11: runs-on: ubuntu-latest
12: if: |
13: (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14: startsWith(github.event.issue.title, 'publish: ')
15: steps:
16: - uses: actions/checkout@v4
17: with:
18: sparse-checkout: auto-approve-repos.txt
19: sparse-checkout-cone-mode: false
20: - name: Get auth token
21: id: token
22: uses: actions/create-github-app-token@v3
23: with:
24: client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25: private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26: - name: Auto-approve if repo is in the list
27: env:
28: GH_TOKEN: ${{ ...
<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test } from "vitest";
2:
3: const {
4: createApprovalAttestation,
5: currentAcceptedEvent,
6: hasApprovalAttestation,
7: parseApprovalAttestation,
8: } = require("../approval-attestation.js");
9:
10: describe("approval attestations", () => {
11: test("matches the latest accepted event to a trusted attestation", () => {
12: const attestation = createApprovalAttestation({
13: actor: "contractor",
14: eventId: "200",
15: title: "publish: getsentry/relay/py@1.2.3",
16: });
17: const event = currentAcceptedEvent([
18: {
19: actor: { login: "contractor" },
20: event: "labeled",
21: id: "100",
22: label: { name: "accepted" },
23: },
24: {
25: actor: { login: "contractor" },
26: event: "labeled",
27: id: "200",
28: label: { ...
<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2:
3: const { authorizeApproval } = require("../approval-authorizer.js");
4:
5: const issueTitle = "publish: getsentry/sentry-javascript@10.0.0";
6:
7: describe("authorizeApproval", () => {
8: test("allows the auto-approval bot for an allowlisted release without a target repository lookup", async () => {
9: const getPermission = vi.fn();
10:
11: await expect(
12: authorizeApproval({
13: actor: "getsantry[bot]",
14: issueTitle,
15: getPermission,
16: autoApprovedRepositories: new Set(["getsentry/sentry-javascript"]),
17: })
18: ).resolves.toEqual({
19: authorized: true,
20: repository: "getsentry/sentry-javascript",
21: });
22:
23: expect(getPermission).not.toHaveBeenCalled();
24: });
25:
26: test("rejects the auto-approval bot ...
<path>/home/byk/Code/getsentry/publish/src/publish/__tests__</path> <type>directory</type> <entries> authorize-approval.js validate-approval-attestation.js (2 entries) </entries>
<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4: getAutoApprovedRepositories,
5: main,
6: } = require("../authorize-approval.js");
7:
8: const originalEnvironment = { ...process.env };
9:
10: afterEach(() => {
11: process.env = { ...originalEnvironment };
12: vi.restoreAllMocks();
13: vi.resetModules();
14: });
15:
16: function jsonResponse(json) {
17: return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19:
20: async function runAuthorization({ actor, issueTitle, responses }) {
21: process.env.GITHUB_OUTPUT = "/tmp/github-output";
22: process.env.APPROVAL_TOKEN = "release-bot-token";
23: process.env.APPROVAL_ACTOR = actor;
24: process.env.APPROVAL_ISSUE_NUMBER = "123";
25: process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26: process.env.APPROVAL_ISSUE_TITLE = ...
<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2:
3: const {
4: validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7: createApprovalAttestation,
8: } = require("../../modules/approval-attestation.js");
9:
10: afterEach(() => {
11: vi.restoreAllMocks();
12: });
13:
14: function jsonResponse(json) {
15: return { ok: true, json: vi.fn().mockResolvedValue(json) };
16: }
17:
18: describe("validateApprovalAttestation", () => {
19: test("accepts the current accepted event and its trusted attestation", async () => {
20: const title = "publish: getsentry/sentry-javascript@10.0.0";
21: const attestation = createApprovalAttestation({
22: actor: "contractor",
23: eventId: "100",
24: title,
25: });
26: global.fetch = vi
27: .fn()
28: ...
<path>/home/byk/Code/getsentry/publish/package.json</path>
<type>file</type>
<content>
1: {
2: "name": "publish",
3: "private": true,
4: "version": "0.0.1",
5: "description": "Approval-based publishing system for Sentry",
6: "main": "index.js",
7: "repository": "git@github.com:getsentry/publish.git",
8: "author": "Sentry Open Source <oss@sentry.io>",
9: "license": "Apache-2.0",
10: "volta": {
11: "node": "24.0.0",
12: "yarn": "1.22.22"
13: },
14: "resolutions": {
15: "undici": "^6.23.0"
16: },
17: "scripts": {
18: "test": "vitest run",
19: "test:watch": "vitest",
20: "lint": "eslint src .github --ignore-pattern '!.github'",
21: "prettier": "prettier --write src"
22: },
23: "devDependencies": {
24: "eslint": "^8.9.0",
25: "eslint-config-prettier": "^8.3.0",
26: "eslint-plugin-yml": "^0.13.0",
27: "prettier": "^2.2.1",
28: "vitest": "^4.1.0"
29: },
30: "dependencies": {
31: "@actions/core": ...
yarn run v1.22.22 $ vitest run [1m[46m RUN [49m[22m [36mv4.0.17 [39m[90m/home/byk/Code/getsentry/publish[39m [32m✓[39m src/publish/__tests__/validate-approval-attestation.js [2m([22m[2m4 tests[22m[2m)[22m[32m 30[2mms[22m[39m [32m✓[39m src/modules/__tests__/update-issue.js [2m([22m[2m5 tests[22m[2m)[22m[32m 21[2mms[22m[39m [32m✓[39m src/modules/__tests__/approval-attestation.js [2m([22m[2m3 tests[22m[2m)[22m[32m 18[2mms[22m[39m [32m✓[39m src/modules/__tests__/approval-authorizer.js [2m([22m[2m14 tests[22m[2m)[22m[32m 29[2mms[22m[39m [32m✓[39m src/modules/__tests__/post-workflow-details.js [2m([22m[2m1 test[22m[2m)[22m[32m 24[2mms[22m[39m [32m✓[39m src/publish/__tests__/authorize-approval.js [2m([22m[2m3 tests[22m[2m)[22m[32m 28[2mms[22m[39m [32m✓[39m src/modules/__tests__/process-end-state.js [2m([22m[2m4 tests[22m[2m)[22m[32m 89[2mms[22m[39m [32m✓[39m src/libs/__tests__/github.js ...
<path>/home/byk/Code/getsentry/publish/auto-approve-repos.txt</path> <type>file</type> <content> 1: getsentry/arroyo 2: getsentry/auto-type-annotate 3: getsentry/devenv 4: getsentry/infra-event-notifier 5: getsentry/jest-sentry-environment 6: getsentry/json-schema-diff 7: getsentry/js-source-scopes 8: getsentry/objectstore/clients 9: getsentry/ophio 10: getsentry/pdb 11: getsentry/pyo3-python-tracing-subscriber 12: getsentry/pytest-sentry 13: getsentry/relay/py 14: getsentry/responses 15: getsentry/rust-proguard 16: getsentry/rust-sourcemap 17: getsentry/rust-usage-accountant 18: getsentry/script-runner 19: getsentry/sentry-api-schema 20: getsentry/sentry-forked-djangorestframework-stubs 21: getsentry/sentry-forked-django-stubs 22: getsentry/sentry-forked-jsonnet 23: getsentry/sentry-infra-tools 24: getsentry/sentry-kafka-management 25: getsentry/sentry-kafka-schemas 26: getsentry/sentry-protos 27: getsentry/sentry-redis-tools 28: getsentry/service-registry 29: getsentry/skrooge 30: ...
Found 35 matches
/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js:
Line 20: const title = "publish: getsentry/sentry-javascript@10.0.0";
Line 58: const attestedTitle = "publish: getsentry/sentry-javascript@10.0.0";
Line 59: const currentTitle = "publish: getsentry/sentry-python@10.0.0";
Line 97: const title = "publish: getsentry/sentry-javascript@10.0.0";
Line 133: const title = "publish: getsentry/sentry-javascript@10.0.0";
/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js:
Line 56: issueTitle: "publish: getsentry/sentry-javascript@10.0.0",
Line 59: jsonResponse({ title: "publish: getsentry/sentry-javascript@10.0.0" }),
Line 94: "publish: getsentry/sentry-javascript@10.0.0";
/home/byk/Code/getsentry/publish/src/modules/process-end-state.js:
Line 42: await ...
<path>/home/byk/Code/getsentry/publish/README.md</path>
<type>file</type>
<content>
1: # Sentry Publish 🏠
2:
3: This is a meta/control repository that implements the [Central Publish Repository](docs/rfc.md) RFC
4:
5: ## Quick Start
6:
7: [craft quick start](https://craft.sentry.dev/github-actions/)
8:
9: ## Release Flow
10:
11: ```mermaid
12: flowchart TD
13: A[Developer triggers release workflow] --> B["SDK Repo: craft prepare"]
14: B --> C[Build artifacts & create release branch]
15: C --> D[Upload artifacts to GitHub]
16: D --> E["Create issue in getsentry/publish"]
17: E --> F{Release Manager Review}
18: F -->|"Add 'accepted' label"| G[Publish workflow triggers]
19: G --> I[Download artifacts from GitHub]
20: I --> J["craft publish to registries"]
21: J --> K{Publish successful?}
22: K -->|Yes| L[Issue closed - success]
23: K -->|No| M[Issue updated with failure]
24: ```
25:
26: ## Goals
27:
28: 1. ...
Found 2 matches /home/byk/Code/getsentry/publish/docs/rfc.md: Line 23: 6. The owners of the release repo adds an "accepted" tag to trigger the actual release /home/byk/Code/getsentry/publish/docs/key_rotation_vault_changes.md: Line 31: 5. For others to be able to release with approval by repo admins: leverage structured issues and issue base workflow triggers. This means we can safely give read access to everyone so they can create issues.
<path>/home/byk/Code/getsentry/publish/docs/rfc.md</path> <type>file</type> <content> 1: # [RFC] Central Publish Repository 2: 3: This design document is written to address the concerns mentioned in [Key Rotation & Vault Changes](key_rotation_vault_changes.md). Implementation pending feedback from engineering team members, specifically the SDK team. 4: 5: # Problem Statement 6: 7: 1. We need to be able to quickly recycle all publishing tokens (NPM, PyPI, Cargo, Docker, etc.) at will without disrupting our releases or our developer flow 8: 2. We need to limit the publishing tokens to authorized personnel only and not leak them in any way 9: 1. GitHub secrets is not enough as it lets anyone with write access to the repo to access the secrets and scuttle them out, even in a brand new PR. Example: [https://github.com/getsentry/sentry/pull/21930](https://github.com/getsentry/sentry/pull/21930) 10: 3. ...
M .github/workflows/ci-poller.yml M .github/workflows/publish.yml M AGENTS.md M src/libs/__tests__/github.js M src/libs/github.js M src/modules/__tests__/details-from-context.js M src/modules/details-from-context.js M src/modules/post-workflow-details.js M src/modules/process-end-state.js M src/modules/update-issue.js M src/publish/inputs.js M src/publish/post-result.js M src/publish/post-workflow-details.js M src/publish/update-issue.js ?? .lore.md ?? src/modules/__tests__/approval-attestation.js ?? src/modules/__tests__/approval-authorizer.js ?? src/modules/approval-attestation.js ?? src/modules/approval-authorizer.js ?? src/publish/__tests__/ ?? src/publish/authorize-approval.js ?? src/publish/validate-approval-attestation.js
<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/details-from-context.js</path>
<type>file</type>
<content>
1: import { test, expect } from "vitest";
2:
3: const {
4: detailsFromContext,
5: parsePublishTitle,
6: } = require("../details-from-context.js");
7:
8: const inputsArgs = {
9: context: {
10: repo: { owner: "getsentry", repo: "publish" },
11: payload: {
12: issue: {
13: number: "223",
14: title: "publish: getsentry/sentry@21.3.1",
15: body: `
16: Requested by: @BYK
17:
18: Merge target: custom-branch
19:
20: Quick links:
21: - [View changes](https://github.com/getsentry/sentry/compare/21.3.0...refs/heads/releases/21.3.1)
22: - [View check runs](https://github.com/getsentry/sentry/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)
23:
24: Assign the **accepted** label to this issue to approve the release. ...
<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const ATTESTATION_PREFIX = "<!-- publish-approval ";
2: const ATTESTATION_SUFFIX = " -->";
3:
4: function createApprovalAttestation({ actor, eventId, title }) {
5: const value = Buffer.from(
6: JSON.stringify({ actor, eventId: String(eventId), title })
7: ).toString("base64url");
8:
9: return `${ATTESTATION_PREFIX}${value}${ATTESTATION_SUFFIX}`;
10: }
11:
12: function parseApprovalAttestation(body) {
13: const start = body.indexOf(ATTESTATION_PREFIX);
14:
15: if (start === -1) {
16: return null;
17: }
18:
19: const end = body.indexOf(ATTESTATION_SUFFIX, start);
20:
21: if (end === -1) {
22: return null;
23: }
24:
25: try {
26: const value = JSON.parse(
27: Buffer.from(
28: body.slice(start + ATTESTATION_PREFIX.length, end),
29: "base64url"
30: ).toString("utf8")
31: );
32:
33: if (
34: ...
<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { parsePublishTitle } = require("./details-from-context.js");
4:
5: async function authorizeApproval({
6: actor,
7: issueTitle,
8: getPermission,
9: autoApprovedRepositories = new Set(),
10: }) {
11: const title = parsePublishTitle(issueTitle);
12:
13: if (!title) {
14: return { authorized: false, repository: null };
15: }
16:
17: const repository = `getsentry/${title.repo}`;
18: const releasePath = `${repository}${title.path || ""}`;
19:
20: if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21: return { authorized: true, repository };
22: }
23:
24: if (actor === AUTO_APPROVER) {
25: return { authorized: false, repository };
26: }
27:
28: const { role_name } = await getPermission({
29: ...
<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3: createApprovalAttestation,
4: currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7:
8: function getAutoApprovedRepositories() {
9: return new Set(
10: fs
11: .readFileSync("auto-approve-repos.txt", "utf8")
12: .split(/\r?\n/)
13: .filter(Boolean)
14: );
15: }
16:
17: async function getPermission({ owner, repository, username }) {
18: const response = await getGitHubResponse(
19: `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20: repository
21: )}/collaborators/${encodeURIComponent(username)}/permission`
22: );
23:
24: if (!response.ok) {
25: throw new Error(
26: `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...
<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2: currentAcceptedEvent,
3: hasApprovalAttestation,
4: } = require("../modules/approval-attestation.js");
5:
6: async function getGitHubResponse(path) {
7: return fetch(`https://api.github.com/${path}`, {
8: headers: {
9: Accept: "application/vnd.github+json",
10: Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
11: "X-GitHub-Api-Version": "2026-03-10",
12: },
13: });
14: }
15:
16: async function getIssue({ repository, issueNumber }) {
17: const response = await getGitHubResponse(
18: `repos/${repository}/issues/${issueNumber}`
19: );
20:
21: if (!response.ok) {
22: throw new Error(
23: `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
24: );
25: }
26:
27: return response.json();
28: }
29:
30: async function getAllPages({ repository, issueNumber, resource ...
<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3: issues:
4: types: [labeled]
5:
6: concurrency:
7: # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8: # issues for the same repo@version share a concurrency group.
9: group: ${{ github.event.issue.title }}
10: cancel-in-progress: false
11:
12: permissions:
13: contents: read
14: issues: write
15: packages: write
16:
17: jobs:
18: # When accepted is added to a publish issue:
19: # - Add ci-pending (and remove ci-failed if retrying)
20: # - Enable the poller via CI_POLLER_HAS_PENDING=true
21: # - Comment on the issue
22: # - Trigger the poller immediately so we don't wait for the next cron tick
23: # The publish job below requires ci-ready, so it will not fire until the
24: # poller flips ci-pending → ci-ready (which also prevents publishing without
25: # CI verification in the ...
<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path> <type>file</type> <content> 1: name: CI Status Poller 2: 3: on: 4: schedule: 5: - cron: "*/5 * * * *" 6: workflow_dispatch: 7: inputs: 8: attempt: 9: description: Self-dispatch attempt counter (internal use) 10: required: false 11: default: "0" 12: 13: permissions: 14: contents: read 15: issues: read 16: 17: jobs: 18: check-ci: 19: runs-on: ubuntu-latest 20: environment: production 21: # Skip entirely (no runner provisioned) when there's nothing to check. 22: # Set to "true" by ci-pending.yml, reset to "false" here when done. 23: # Always allow workflow_dispatch for manual recovery. 24: if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch' 25: concurrency: 26: group: ci-status-poller 27: cancel-in-progress: false 28: steps: 29: - name: Get publish code 30: uses: ...
Date: Aug 28, 2026 * 🟡 (19:30) Working tree has modified tracked files: `.github/workflows/ci-poller.yml`, `.github/workflows/publish.yml`, `AGENTS.md`, `src/libs/__tests__/github.js`, `src/libs/github.js`, `src/modules/__tests__/details-from-context.js`, `src/modules/details-from-context.js`, `src/modules/post-workflow-details.js`, `src/modules/process-end-state.js`, `src/modules/update-issue.j…
Date: Aug 28, 2026 * 🟡 (19:00) `src/modules/approval-attestation.js` defines approval attestations as `<!-- publish-approval ${base64url(JSON.stringify({ actor, eventId: String(eventId), title }))} -->`; `parseApprovalAttestation()` returns `null` for missing, malformed, undecodable, or invalid non-string `actor`/`eventId`/`title` fields. * 🟡 (19:00) `src/modules/approval-attestation.js` select…
Date: Aug 28, 2026 * 🔴 (19:00) User stated `workflow_dispatch` must always be allowed for manual recovery. * 🔴 (19:00) User reaffirmed that a renamed or re-approved publish issue must never reach `ci-ready`. * 🟡 (19:00) `.github/workflows/ci-poller.yml` comments specify that `ci-pending.yml` sets a poller-enabled value to `"true"` and this poller resets it to `"false"` when processing is compl…
Date: Aug 28, 2026 * 🟡 (18:57) Repository `/home/byk/Code/getsentry/publish` contains 15 entries: `.eslintrc.js`, `.git/`, `.github/`, `.gitignore`, `.lore.md`, `AGENTS.md`, `auto-approve-repos.txt`, `docs/`, `LICENSE`, `node_modules/`, `package.json`, `README.md`, `src/`, `vitest.config.js`, and `yarn.lock`. * 🟡 (18:58) Current uncommitted modifications include `.github/workflows/ci-poller.yml…
Date: Aug 28, 2026 * 🔴 [requested-security-review] (18:55) User requested a security review of current uncommitted changes in `/home/byk/Code/getsentry/publish`. Required focus: authorization bypasses; mutable issue-title/accepted-label event binding; token provenance; fail-closed behavior; cleanup paths; use of shared parser; and races before `ci-ready`/publishing. * 🔴 [enforced-no-modificatio…