Session 1VjWxal2enw5

<skill_content name="jj-guide">
# Skill: jj-guide

# jj Guide for AI Agents

Jujutsu (jj) is a Git-compatible VCS with mutable commits, automatic snapshotting, no staging area, and first-class conflicts. This skill teaches you how to use it safely from a non-interactive agent environment.

If `.jj/` exists in the repo root, this is a jj repo. **Use `jj` commands, not `git`.** In a colocated repo (`.jj/` *and* `.git/`), git tools can read the state, but mutations should go through `jj` so the operation log stays consistent.

## Critical Rules

- **NEVER** use interactive flags (`-i`, `--interactive`). TUI prompts hang in agent environments. This applies to `jj split -i`, `jj squash -i`, `jj commit -i`, `jj resolve`, `jj diffedit`, etc.
- **ALWAYS** pass `-m "msg"` when describing/committing. Without `-m`, an editor opens and hangs.
- **VERIFY** mutations with `jj st` and `jj log` after `squash`, `abandon`, `rebase`, `restore`, `commit`. ...

Error: There is no jj repo in "."
Hint: It looks like this is a git repo. You can create a jj repo backed by it by running this:
jj git init

 M .github/workflows/ci-poller.yml
 M .github/workflows/publish.yml
 M AGENTS.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/details-from-context.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? src/publish/authorize-approval.js
?? ...

/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js
/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   workflow_dispatch:
7:     inputs:
8:       attempt:
9:         description: Self-dispatch attempt counter (internal use)
10:         required: false
11:         default: "0"
12: 
13: permissions:
14:   contents: read
15:   issues: read
16: 
17: jobs:
18:   check-ci:
19:     runs-on: ubuntu-latest
20:     environment: production
21:     # Skip entirely (no runner provisioned) when there's nothing to check.
22:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
23:     # Always allow workflow_dispatch for manual recovery.
24:     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
25:     concurrency:
26:       group: ci-status-poller
27:       cancel-in-progress: false
28:     steps:
29:       - name: Get publish code
30:         uses: ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { PUBLISH_TITLE_REGEX } = require("./details-from-context.js");
4: 
5: async function authorizeApproval({
6:   actor,
7:   issueTitle,
8:   getPermission,
9:   autoApprovedRepositories = new Set(),
10: }) {
11:   const title = issueTitle.match(PUBLISH_TITLE_REGEX);
12: 
13:   if (!title) {
14:     return { authorized: false, repository: null };
15:   }
16: 
17:   const repository = `getsentry/${title.groups.repo}`;
18:   const releasePath = `${repository}${title.groups.path || ""}`;
19: 
20:   if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21:     return { authorized: true, repository };
22:   }
23: 
24:   if (actor === AUTO_APPROVER) {
25:     return { authorized: false, repository };
26:   }
27: 
28:   const { role_name } = ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-attestation.js</path>
<type>file</type>
<content>
1: const ATTESTATION_PREFIX = "<!-- publish-approval ";
2: const ATTESTATION_SUFFIX = " -->";
3: 
4: function createApprovalAttestation({ actor, eventId, title }) {
5:   const value = Buffer.from(
6:     JSON.stringify({ actor, eventId: String(eventId), title })
7:   ).toString("base64url");
8: 
9:   return `${ATTESTATION_PREFIX}${value}${ATTESTATION_SUFFIX}`;
10: }
11: 
12: function parseApprovalAttestation(body) {
13:   const start = body.indexOf(ATTESTATION_PREFIX);
14: 
15:   if (start === -1) {
16:     return null;
17:   }
18: 
19:   const end = body.indexOf(ATTESTATION_SUFFIX, start);
20: 
21:   if (end === -1) {
22:     return null;
23:   }
24: 
25:   try {
26:     const value = JSON.parse(
27:       Buffer.from(
28:         body.slice(start + ATTESTATION_PREFIX.length, end),
29:         "base64url"
30:       ).toString("utf8")
31:     );
32: 
33:     if (
34:       ...

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   hasApprovalAttestation,
4: } = require("../modules/approval-attestation.js");
5: 
6: async function getGitHubResponse(path) {
7:   return fetch(`https://api.github.com/${path}`, {
8:     headers: {
9:       Accept: "application/vnd.github+json",
10:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
11:       "X-GitHub-Api-Version": "2026-03-10",
12:     },
13:   });
14: }
15: 
16: async function getIssue({ repository, issueNumber }) {
17:   const response = await getGitHubResponse(
18:     `repos/${repository}/issues/${issueNumber}`
19:   );
20: 
21:   if (!response.ok) {
22:     throw new Error(
23:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
24:     );
25:   }
26: 
27:   return response.json();
28: }
29: 
30: async function getAllPages({ repository, issueNumber, resource ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const { authorizeApproval } = require("../approval-authorizer.js");
4: 
5: const issueTitle = "publish: getsentry/sentry-javascript@10.0.0";
6: 
7: describe("authorizeApproval", () => {
8:   test("allows the auto-approval bot for an allowlisted release without a target repository lookup", async () => {
9:     const getPermission = vi.fn();
10: 
11:     await expect(
12:       authorizeApproval({
13:         actor: "getsantry[bot]",
14:         issueTitle,
15:         getPermission,
16:         autoApprovedRepositories: new Set(["getsentry/sentry-javascript"]),
17:       })
18:     ).resolves.toEqual({
19:       authorized: true,
20:       repository: "getsentry/sentry-javascript",
21:     });
22: 
23:     expect(getPermission).not.toHaveBeenCalled();
24:   });
25: 
26:   test("rejects the auto-approval bot ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test } from "vitest";
2: 
3: const {
4:   createApprovalAttestation,
5:   currentAcceptedEvent,
6:   hasApprovalAttestation,
7:   parseApprovalAttestation,
8: } = require("../approval-attestation.js");
9: 
10: describe("approval attestations", () => {
11:   test("matches the latest accepted event to a trusted attestation", () => {
12:     const attestation = createApprovalAttestation({
13:       actor: "contractor",
14:       eventId: "200",
15:       title: "publish: getsentry/relay/py@1.2.3",
16:     });
17:     const event = currentAcceptedEvent([
18:       {
19:         actor: { login: "contractor" },
20:         event: "labeled",
21:         id: "100",
22:         label: { name: "accepted" },
23:       },
24:       {
25:         actor: { login: "contractor" },
26:         event: "labeled",
27:         id: "200",
28:         label: { ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   getAutoApprovedRepositories,
5:   main,
6: } = require("../authorize-approval.js");
7: 
8: const originalEnvironment = { ...process.env };
9: 
10: afterEach(() => {
11:   process.env = { ...originalEnvironment };
12:   vi.restoreAllMocks();
13:   vi.resetModules();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: async function runAuthorization({ actor, issueTitle, responses }) {
21:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
22:   process.env.APPROVAL_TOKEN = "release-bot-token";
23:   process.env.APPROVAL_ACTOR = actor;
24:   process.env.APPROVAL_ISSUE_NUMBER = "123";
25:   process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26:   process.env.APPROVAL_ISSUE_TITLE = ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8: } = require("../../modules/approval-attestation.js");
9: 
10: afterEach(() => {
11:   vi.restoreAllMocks();
12: });
13: 
14: function jsonResponse(json) {
15:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
16: }
17: 
18: describe("validateApprovalAttestation", () => {
19:   test("accepts the current accepted event and its trusted attestation", async () => {
20:     const title = "publish: getsentry/sentry-javascript@10.0.0";
21:     const attestation = createApprovalAttestation({
22:       actor: "contractor",
23:       eventId: "100",
24:       title,
25:     });
26:     global.fetch = vi
27:       .fn()
28:       ...

diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index a3db430..0834608 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -17,24 +17,29 @@ permissions:
 jobs:
   check-ci:
     runs-on: ubuntu-latest
     environment: production
     # Skip entirely (no runner provisioned) when there's nothing to check.
     # Set to "true" by ci-pending.yml, reset to "false" here when done.
     # Always allow workflow_dispatch for manual recovery.
     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
     concurrency:
       group: ci-status-poller
       cancel-in-progress: false
     steps:
+      - name: Get publish code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       # sentry-internal-app token for label changes on this repo.
       # This token is what triggers publish.yml downstream — see
       # https://github.com/getsentry/publish for why ...

No files found

<path>/home/byk/Code/getsentry/publish/.github/workflows</path>
<type>directory</type>
<entries>
auto-approve.yml
ci-poller.yml
cocoapods-keepalive.yml
publish.yml
test.yml

(5 entries)
</entries>

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

# REST API endpoints for issue events

Use the REST API to retrieve events triggered by activity in issues and pull requests.

## About events

You can use the REST API to view different types of events triggered by activity in issues and pull requests. For more information about the specific events that you can receive, see [Issue event types](/en/rest/using-the-rest-api/issue-event-types). To view GitHub activity outside of issues and pull requests, you can use the [Events](/en/rest/using-the-rest-api/github-event-types) endpoints.

Every pull request is an issue, but not every issue is a pull request. For this reason, "shared" actions for both features, like managing assignees, labels, and milestones, are provided within the Issues endpoints.

> \[!NOTE]
> Most endpoints use `Authorization: Bearer <YOUR-TOKEN>` and `Accept: application/vnd.github+json` headers, plus `X-GitHub-Api-Version: 2026-03-10`. Curl examples below omit these standard headers for brevity. ...

<path>/home/byk/Code/getsentry/publish/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: /**
2:  * Matches the entire "Targets" section of a github publish issue body.
3:  */
4: const TARGETS_SECTION_PARSER_REGEX =
5:   /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
6: 
7: /**
8:  * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
9:  * The "id" of the targets is captured within a capture group.
10:  */
11: const TARGETS_PARSER_REGEX = /^\s*- \[[ x]\] (\S+)/gim;
12: 
13: /**
14:  * Matches checked targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
15:  * The "id" of the targets is captured within a capture group.
16:  */
17: const CHECKED_TARGETS_PARSER_REGEX = /^\s*- \[x\] (\S+)/gim;
18: const PUBLISH_TITLE_REGEX =
19:   /^publish: ...

yarn run v1.22.22
$ vitest run

 RUN  v4.0.17 /home/byk/Code/getsentry/publish

 ✓ src/modules/__tests__/approval-authorizer.js (14 tests) 21ms
 ✓ src/publish/__tests__/validate-approval-attestation.js (4 tests) 37ms
 ✓ src/modules/__tests__/approval-attestation.js (3 tests) 36ms
 ✓ src/modules/__tests__/update-issue.js (5 tests) 25ms
 ✓ src/modules/__tests__/process-end-state.js (4 tests) 92ms
 ✓ src/publish/__tests__/authorize-approval.js (3 tests) 25ms
 ✓ src/modules/__tests__/post-workflow-details.js (1 test) 12ms
 ✓ ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/details-from-context.js</path>
<type>file</type>
<content>
1: import { test, expect } from "vitest";
2: 
3: const { detailsFromContext } = require("../details-from-context.js");
4: 
5: const inputsArgs = {
6:   context: {
7:     repo: { owner: "getsentry", repo: "publish" },
8:     payload: {
9:       issue: {
10:         number: "223",
11:         title: "publish: getsentry/sentry@21.3.1",
12:         body: `
13: Requested by: @BYK
14: 
15: Merge target: custom-branch
16: 
17: Quick links:
18: - [View changes](https://github.com/getsentry/sentry/compare/21.3.0...refs/heads/releases/21.3.1)
19: - [View check runs](https://github.com/getsentry/sentry/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)
20: 
21: Assign the **accepted** label to this issue to approve the release. ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/test.yml</path>
<type>file</type>
<content>
1: name: Test
2: on:
3:   push:
4:     branches:
5:       - main
6:   pull_request:
7: 
8: permissions:
9:   contents: read
10: 
11: defaults:
12:   run:
13:     shell: bash
14: jobs:
15:   unit-test:
16:     runs-on: ubuntu-latest
17:     name: unit tests
18:     steps:
19:       - uses: actions/checkout@v6
20:       - uses: actions/setup-node@v6
21:         with:
22:           node-version: 24
23:       - uses: actions/cache@v4
24:         id: cache
25:         with:
26:           path: node_modules
27:           key: ${{ runner.os }}-node_modules-${{ hashFiles('package.json', 'yarn.lock') }}
28: 
29:       - name: Install Dependencies
30:         if: steps.cache.outputs.cache-hit != 'true'
31:         run: yarn install --frozen-lockfile
32: 
33:       - name: Test
34:         run: yarn test

(End of file - total 34 lines)
</content>

bash: line 1: $(id >&2): syntax error: operand expected (error token is "$(id >&2)")

<path>/home/byk/Code/getsentry/publish/auto-approve-repos.txt</path>
<type>file</type>
<content>
1: getsentry/arroyo
2: getsentry/auto-type-annotate
3: getsentry/devenv
4: getsentry/infra-event-notifier
5: getsentry/jest-sentry-environment
6: getsentry/json-schema-diff
7: getsentry/js-source-scopes
8: getsentry/objectstore/clients
9: getsentry/ophio
10: getsentry/pdb
11: getsentry/pyo3-python-tracing-subscriber
12: getsentry/pytest-sentry
13: getsentry/relay/py
14: getsentry/responses
15: getsentry/rust-proguard
16: getsentry/rust-sourcemap
17: getsentry/rust-usage-accountant
18: getsentry/script-runner
19: getsentry/sentry-api-schema
20: getsentry/sentry-forked-djangorestframework-stubs
21: getsentry/sentry-forked-django-stubs
22: getsentry/sentry-forked-jsonnet
23: getsentry/sentry-infra-tools
24: getsentry/sentry-kafka-management
25: getsentry/sentry-kafka-schemas
26: getsentry/sentry-protos
27: getsentry/sentry-redis-tools
28: getsentry/service-registry
29: getsentry/skrooge
30: ...

No files found

 M .github/workflows/ci-poller.yml
 M .github/workflows/publish.yml
 M AGENTS.md
 M src/libs/__tests__/github.js
 M src/libs/github.js
 M src/modules/details-from-context.js
 M src/modules/post-workflow-details.js
 M src/modules/process-end-state.js
 M src/modules/update-issue.js
 M src/publish/inputs.js
 M src/publish/post-result.js
 M src/publish/post-workflow-details.js
 M src/publish/update-issue.js
?? .lore.md
?? src/modules/__tests__/approval-attestation.js
?? src/modules/__tests__/approval-authorizer.js
?? src/modules/approval-attestation.js
?? src/modules/approval-authorizer.js
?? src/publish/__tests__/
?? src/publish/authorize-approval.js
?? src/publish/validate-approval-attestation.js
diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index a3db430..0834608 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -26,6 +26,11 @@ jobs:
       group: ci-status-poller
       cancel-in-progress: false
     steps:
+      - ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
1: name: CI Status Poller
2: 
3: on:
4:   schedule:
5:     - cron: "*/5 * * * *"
6:   workflow_dispatch:
7:     inputs:
8:       attempt:
9:         description: Self-dispatch attempt counter (internal use)
10:         required: false
11:         default: "0"
12: 
13: permissions:
14:   contents: read
15:   issues: read
16: 
17: jobs:
18:   check-ci:
19:     runs-on: ubuntu-latest
20:     environment: production
21:     # Skip entirely (no runner provisioned) when there's nothing to check.
22:     # Set to "true" by ci-pending.yml, reset to "false" here when done.
23:     # Always allow workflow_dispatch for manual recovery.
24:     if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch'
25:     concurrency:
26:       group: ci-status-poller
27:       cancel-in-progress: false
28:     steps:
29:       - name: Get publish code
30:         uses: ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/ci-poller.yml</path>
<type>file</type>
<content>
320:       - name: Self-dispatch if issues remain pending
321:         if: >-
322:           always()
323:           && steps.token.outcome == 'success'
324:           && steps.remaining.outcome == 'success'
325:           && steps.remaining.outputs.count != '0'
326:         env:
327:           GH_TOKEN: ${{ steps.token.outputs.token }}
328:           ATTEMPT: ${{ github.event.inputs.attempt || '0' }}
329:         run: |
330:           attempt=$((ATTEMPT + 1))
331:           if [[ "$attempt" -ge 60 ]]; then
332:             echo "::warning::Max self-dispatch attempts (60) reached. Relying on cron fallback."
333:             exit 0
334:           fi
335:           echo "Re-dispatching (attempt ${attempt}/60)..."
336:           gh workflow run ci-poller.yml -R "$GITHUB_REPOSITORY" -f attempt="${attempt}"

(End of file - total 336 lines)
</content>

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3:   issues:
4:     types: [labeled]
5: 
6: concurrency:
7:   # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8:   # issues for the same repo@version share a concurrency group.
9:   group: ${{ github.event.issue.title }}
10:   cancel-in-progress: false
11: 
12: permissions:
13:   contents: read
14:   issues: write
15:   packages: write
16: 
17: jobs:
18:   # When accepted is added to a publish issue:
19:   #   - Add ci-pending (and remove ci-failed if retrying)
20:   #   - Enable the poller via CI_POLLER_HAS_PENDING=true
21:   #   - Comment on the issue
22:   #   - Trigger the poller immediately so we don't wait for the next cron tick
23:   # The publish job below requires ci-ready, so it will not fire until the
24:   # poller flips ci-pending → ci-ready (which also prevents publishing without
25:   # CI verification in the ...

<path>/home/byk/Code/getsentry/publish/src/publish/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: const {
2:   currentAcceptedEvent,
3:   hasApprovalAttestation,
4: } = require("../modules/approval-attestation.js");
5: 
6: async function getGitHubResponse(path) {
7:   return fetch(`https://api.github.com/${path}`, {
8:     headers: {
9:       Accept: "application/vnd.github+json",
10:       Authorization: `Bearer ${process.env.APPROVAL_TOKEN}`,
11:       "X-GitHub-Api-Version": "2026-03-10",
12:     },
13:   });
14: }
15: 
16: async function getIssue({ repository, issueNumber }) {
17:   const response = await getGitHubResponse(
18:     `repos/${repository}/issues/${issueNumber}`
19:   );
20: 
21:   if (!response.ok) {
22:     throw new Error(
23:       `Could not retrieve issue #${issueNumber}: GitHub returned ${response.status}`
24:     );
25:   }
26: 
27:   return response.json();
28: }
29: 
30: async function getAllPages({ repository, issueNumber, resource ...

<path>/home/byk/Code/getsentry/publish/src/publish/authorize-approval.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const {
3:   createApprovalAttestation,
4:   currentAcceptedEvent,
5: } = require("../modules/approval-attestation.js");
6: const { authorizeApproval } = require("../modules/approval-authorizer.js");
7: 
8: function getAutoApprovedRepositories() {
9:   return new Set(
10:     fs
11:       .readFileSync("auto-approve-repos.txt", "utf8")
12:       .split(/\r?\n/)
13:       .filter(Boolean)
14:   );
15: }
16: 
17: async function getPermission({ owner, repository, username }) {
18:   const response = await getGitHubResponse(
19:     `repos/${encodeURIComponent(owner)}/${encodeURIComponent(
20:       repository
21:     )}/collaborators/${encodeURIComponent(username)}/permission`
22:   );
23: 
24:   if (!response.ok) {
25:     throw new Error(
26:       `Could not retrieve ${username}'s permission for ${owner}/${repository}: GitHub returned ...

<path>/home/byk/Code/getsentry/publish/src/modules/approval-authorizer.js</path>
<type>file</type>
<content>
1: const ALLOWED_ROLE_NAMES = new Set(["write", "maintain", "admin"]);
2: const AUTO_APPROVER = "getsantry[bot]";
3: const { PUBLISH_TITLE_REGEX } = require("./details-from-context.js");
4: 
5: async function authorizeApproval({
6:   actor,
7:   issueTitle,
8:   getPermission,
9:   autoApprovedRepositories = new Set(),
10: }) {
11:   const title = issueTitle.match(PUBLISH_TITLE_REGEX);
12: 
13:   if (!title) {
14:     return { authorized: false, repository: null };
15:   }
16: 
17:   const repository = `getsentry/${title.groups.repo}`;
18:   const releasePath = `${repository}${title.groups.path || ""}`;
19: 
20:   if (actor === AUTO_APPROVER && autoApprovedRepositories.has(releasePath)) {
21:     return { authorized: true, repository };
22:   }
23: 
24:   if (actor === AUTO_APPROVER) {
25:     return { authorized: false, repository };
26:   }
27: 
28:   const { role_name } = ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-authorizer.js</path>
<type>file</type>
<content>
1: import { describe, expect, test, vi } from "vitest";
2: 
3: const { authorizeApproval } = require("../approval-authorizer.js");
4: 
5: const issueTitle = "publish: getsentry/sentry-javascript@10.0.0";
6: 
7: describe("authorizeApproval", () => {
8:   test("allows the auto-approval bot for an allowlisted release without a target repository lookup", async () => {
9:     const getPermission = vi.fn();
10: 
11:     await expect(
12:       authorizeApproval({
13:         actor: "getsantry[bot]",
14:         issueTitle,
15:         getPermission,
16:         autoApprovedRepositories: new Set(["getsentry/sentry-javascript"]),
17:       })
18:     ).resolves.toEqual({
19:       authorized: true,
20:       repository: "getsentry/sentry-javascript",
21:     });
22: 
23:     expect(getPermission).not.toHaveBeenCalled();
24:   });
25: 
26:   test("rejects the auto-approval bot ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/authorize-approval.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: import fs from "fs";
3: const {
4:   getAutoApprovedRepositories,
5:   main,
6: } = require("../authorize-approval.js");
7: 
8: const originalEnvironment = { ...process.env };
9: 
10: afterEach(() => {
11:   process.env = { ...originalEnvironment };
12:   vi.restoreAllMocks();
13:   vi.resetModules();
14: });
15: 
16: function jsonResponse(json) {
17:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
18: }
19: 
20: async function runAuthorization({ actor, issueTitle, responses }) {
21:   process.env.GITHUB_OUTPUT = "/tmp/github-output";
22:   process.env.APPROVAL_TOKEN = "release-bot-token";
23:   process.env.APPROVAL_ACTOR = actor;
24:   process.env.APPROVAL_ISSUE_NUMBER = "123";
25:   process.env.APPROVAL_ISSUE_REPOSITORY = "getsentry/publish";
26:   process.env.APPROVAL_ISSUE_TITLE = ...

<path>/home/byk/Code/getsentry/publish/src/publish/__tests__/validate-approval-attestation.js</path>
<type>file</type>
<content>
1: import { afterEach, describe, expect, test, vi } from "vitest";
2: 
3: const {
4:   validateApprovalAttestation,
5: } = require("../validate-approval-attestation.js");
6: const {
7:   createApprovalAttestation,
8: } = require("../../modules/approval-attestation.js");
9: 
10: afterEach(() => {
11:   vi.restoreAllMocks();
12: });
13: 
14: function jsonResponse(json) {
15:   return { ok: true, json: vi.fn().mockResolvedValue(json) };
16: }
17: 
18: describe("validateApprovalAttestation", () => {
19:   test("accepts the current accepted event and its trusted attestation", async () => {
20:     const title = "publish: getsentry/sentry-javascript@10.0.0";
21:     const attestation = createApprovalAttestation({
22:       actor: "contractor",
23:       eventId: "100",
24:       title,
25:     });
26:     global.fetch = vi
27:       .fn()
28:       ...

<path>/home/byk/Code/getsentry/publish/src/modules/__tests__/approval-attestation.js</path>
<type>file</type>
<content>
1: import { describe, expect, test } from "vitest";
2: 
3: const {
4:   createApprovalAttestation,
5:   currentAcceptedEvent,
6:   hasApprovalAttestation,
7:   parseApprovalAttestation,
8: } = require("../approval-attestation.js");
9: 
10: describe("approval attestations", () => {
11:   test("matches the latest accepted event to a trusted attestation", () => {
12:     const attestation = createApprovalAttestation({
13:       actor: "contractor",
14:       eventId: "200",
15:       title: "publish: getsentry/relay/py@1.2.3",
16:     });
17:     const event = currentAcceptedEvent([
18:       {
19:         actor: { login: "contractor" },
20:         event: "labeled",
21:         id: "100",
22:         label: { name: "accepted" },
23:       },
24:       {
25:         actor: { login: "contractor" },
26:         event: "labeled",
27:         id: "200",
28:         label: { ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/publish.yml</path>
<type>file</type>
<content>
326:       - uses: docker://getsentry/craft:latest
327:         name: Publish using Craft
328:         with:
329:           entrypoint: /bin/bash
330:           args: >-
331:             -e
332:             -c "
333:             export HOME=/root &&
334:             cd __repo__/${{ fromJSON(steps.inputs.outputs.result).path }} &&
335:             exec craft publish ${{ fromJSON(steps.inputs.outputs.result).version }}
336:             "
337:         env:
338:           # Pin Craft's publish-state directory to a path outside
339:           # __repo__/ so repo contents cannot pre-populate it. See the
340:           # `Set targets` step above.
341:           XDG_STATE_HOME: /github/workspace/.craft-state
342:           CRAFT_MERGE_TARGET: ${{ fromJSON(steps.inputs.outputs.result).merge_target }}
343:           CRAFT_LOG_LEVEL: ${{ vars.CRAFT_LOG_LEVEL || 'Info' }}
344:           ...

<path>/home/byk/Code/getsentry/publish/.github/workflows/auto-approve.yml</path>
<type>file</type>
<content>
1: name: auto-approve non-sdks
2: on:
3:   issues:
4:     types: [opened]
5: 
6: permissions:
7:   contents: read
8: 
9: jobs:
10:   auto-approve:
11:     runs-on: ubuntu-latest
12:     if: |
13:       (github.actor == 'sentry-release-bot[bot]' || github.actor == 'getsantry[bot]') &&
14:       startsWith(github.event.issue.title, 'publish: ')
15:     steps:
16:       - uses: actions/checkout@v4
17:         with:
18:           sparse-checkout: auto-approve-repos.txt
19:           sparse-checkout-cone-mode: false
20:       - name: Get auth token
21:         id: token
22:         uses: actions/create-github-app-token@v3
23:         with:
24:           client-id: ${{ vars.SENTRY_INTERNAL_APP_ID }}
25:           private-key: ${{ secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY }}
26:       - name: Auto-approve if repo is in the list
27:         env:
28:           GH_TOKEN: ${{ ...

     1	name: Publish
     2	on:
     3	  issues:
     4	    types: [labeled]
     5	
     6	concurrency:
     7	  # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
     8	  # issues for the same repo@version share a concurrency group.
     9	  group: ${{ github.event.issue.title }}
    10	  cancel-in-progress: false
    11	
    12	permissions:
    13	  contents: read
    14	  issues: write
    15	  packages: write
    16	
    17	jobs:
    18	  # When accepted is added to a publish issue:
    19	  #   - Add ci-pending (and remove ci-failed if retrying)
    20	  #   - Enable the poller via CI_POLLER_HAS_PENDING=true
    21	  #   - Comment on the issue
    22	  #   - Trigger the poller immediately so we don't wait for the next cron tick
    23	  # The publish job below requires ci-ready, so it will not fire until the
    24	  # poller flips ci-pending → ci-ready (which also prevents publishing without
    25	  # CI verification in the auto-approve race). ...

1
uid=1000(byk) gid=1000(byk) groups=1000(byk),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),101(lxd),111(docker)