Dashboard › craft › Session 00I9nKnPOSmF
00I9nKnPOSmFNVVKRPerform a strict, read-only adversarial final audit of the uncommitted review-fix worktree in /home/byk/Code/getsentry/publish-workspace-acceptance, against its branch baseline a81ab03 and relevant base behavior. Do NOT edit, format, regenerate, or mutate files. Inspect git status/diff, every changed file, relevant unchanged producer/consumer code, workflows, docs, generated parser parity, and tests. Focus on: strict canonical body-start RequestHeader parsing; exact repo binding; lowercase 40-hex revision, /checks optional terminal slash only; global duplicate View check runs detection; canonical merge-target authority and documented allowed branch-token grammar; update revision validation and byte-for-byte body preservation outside the indexed revision range; CI poller flow must never edit with an empty/invalid resolver result, preserve issue-body trailing newlines, and clean all temp files; workflow trigger/gating invariants and workflow_dispatch; checkout version v7 at all changed requested sites; exact-SHA checkout then root .craft.yml workspace discovery; fail-closed discovery; intentional getsentry/craft:latest; JSON handoff and Action output serialization; docs grammar generated from Peggy source and fail-closed markers; test quality; repository hygiene including unrelated CocoaPods churn. Run only non-mutating commands/tests if useful. Return severity-ordered findings with precise file:line citations, explicit PASS/FAIL for these concerns, testing gaps, and exactly MERGE or DO-NOT-MERGE as final line. If blocked, name the exact blocker and return DO-NOT-MERGE.
<path>/home/byk/Code/getsentry/publish-workspace-acceptance</path> <type>directory</type> <entries> .eslintrc.js .git .github/ .gitignore AGENTS.md auto-approve-repos.txt docs/ LICENSE node_modules/ package.json README.md scripts/ src/ vitest.config.js yarn.lock (15 entries) </entries>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/AGENTS.md</path> <type>file</type> <content> 1: # AGENTS.md - Coding Agent Guidelines 2: 3: This document provides guidelines for AI coding agents working in this repository. 4: 5: ## Project Overview 6: 7: This is the **Sentry Publish Repository** - a GitHub Actions-based approval system for publishing releases across multiple Sentry projects using [Craft](https://github.com/getsentry/craft). It's a pure JavaScript (Node.js 24.0.0) project using CommonJS modules. 8: 9: ## Build/Lint/Test Commands 10: 11: ### Package Manager 12: 13: - **Yarn 1.22.22** (classic) - Do NOT use npm 14: - Version management via Volta (pinned in package.json) 15: 16: ### Commands 17: 18: ```bash 19: # Install dependencies 20: yarn install 21: 22: # Run all tests 23: yarn test 24: 25: # Run tests in watch mode 26: yarn test:watch 27: 28: # Run a single test file 29: yarn test src/modules/__tests__/update-issue.js 30: 31: # Run tests ...
M .github/workflows/ci-poller.yml M .github/workflows/publish.yml M docs/publish-issue-format.md M scripts/generate-publish-issue-title-parser.js M src/modules/__tests__/details-from-context.js M src/modules/__tests__/publish-workflow.js M src/modules/__tests__/release-revision.js M src/modules/details-from-context.js M src/modules/publish-issue-title.js M src/modules/publish-issue-title.peggy M src/modules/release-revision.js M src/publish/inputs.js M src/publish/resolve-ci-poller-input.js M src/publish/resolve-location.js M src/publish/resolve-release-revision.js ?? src/modules/__tests__/generate-publish-issue-title-parser.js ?? src/publish/__tests__/ ?? src/publish/discover-location.js .github/workflows/ci-poller.yml | 28 +- .github/workflows/publish.yml | 12 +- docs/publish-issue-format.md | 47 +- scripts/generate-publish-issue-title-parser.js | 91 ++- src/modules/__tests__/details-from-context.js | 37 +- ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/ci-poller.yml</path> <type>file</type> <content> 1: name: CI Status Poller 2: 3: on: 4: schedule: 5: - cron: "*/5 * * * *" 6: workflow_dispatch: 7: inputs: 8: attempt: 9: description: Self-dispatch attempt counter (internal use) 10: required: false 11: default: "0" 12: 13: permissions: 14: contents: read 15: issues: read 16: 17: jobs: 18: check-ci: 19: runs-on: ubuntu-latest 20: environment: production 21: # Skip entirely (no runner provisioned) when there's nothing to check. 22: # Set to "true" by ci-pending.yml, reset to "false" here when done. 23: # Always allow workflow_dispatch for manual recovery. 24: if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch' 25: concurrency: 26: group: ci-status-poller 27: cancel-in-progress: false 28: steps: 29: # sentry-internal-app token ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3: issues:
4: types: [labeled]
5:
6: concurrency:
7: # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8: # issues for the same repo@version share a concurrency group.
9: group: ${{ github.event.issue.title }}
10: cancel-in-progress: false
11:
12: permissions:
13: contents: read
14: issues: write
15: packages: write
16:
17: jobs:
18: # When accepted is added to a publish issue:
19: # - Add ci-pending (and remove ci-failed if retrying)
20: # - Enable the poller via CI_POLLER_HAS_PENDING=true
21: # - Comment on the issue
22: # - Trigger the poller immediately so we don't wait for the next cron tick
23: # The publish job below requires ci-ready, so it will not fire until the
24: # poller flips ci-pending β ci-ready (which also prevents publishing without
25: # CI ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-issue-title.peggy</path>
<type>file</type>
<content>
1: {
2: function join(characters) {
3: return characters.join("");
4: }
5: }
6:
7: // BEGIN TITLE GRAMMAR
8: // Canonical grammar for publish issue titles. A path suffix is syntactic only:
9: // the controller resolves the complete suffix as a workspace after checking
10: // out the CI-approved revision.
11: PublishIssueTitle
12: = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. {
13: return {
14: repo,
15: path: path || "",
16: version,
17: };
18: }
19:
20: Repository
21: = characters:RepositoryCharacter+ { return join(characters); }
22:
23: RepositoryCharacter
24: = [A-Za-z0-9_.-]
25:
26: Path
27: = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
28:
29: PathSegment
30: = characters:RepositoryCharacter+ { return ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-issue-title.js</path>
<type>file</type>
<content>
1: /* eslint-disable */
2: // @generated by Peggy 5.1.0.
3: //
4: // https://peggyjs.org/
5:
6: "use strict";
7:
8: class peg$SyntaxError extends SyntaxError {
9: constructor(message, expected, found, location) {
10: super(message);
11: this.expected = expected;
12: this.found = found;
13: this.location = location;
14: this.name = "SyntaxError";
15: }
16:
17: format(sources) {
18: let str = "Error: " + this.message;
19: if (this.location) {
20: let src = null;
21: const st = sources.find((s) => s.source === this.location.source);
22: if (st) {
23: src = st.text.split(/\r\n|\n|\r/g);
24: }
25: const s = this.location.start;
26: const offset_s =
27: this.location.source &&
28: typeof this.location.source.offset === "function"
29: ? ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const { getReleaseRevisionDetails } = require("./release-revision");
3: const { isPublishPath } = require("./publish-location");
4: const {
5: isPublishRepository,
6: isReleaseVersion,
7: } = require("./publish-issue-validation");
8:
9: /**
10: * Matches the entire "Targets" section of a github publish issue body.
11: */
12: const TARGETS_SECTION_PARSER_REGEX =
13: /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
14:
15: /**
16: * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
17: * The "id" of the targets is captured within a capture group. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/release-revision.js</path>
<type>file</type>
<content>
1: const { parse } = require("./publish-issue-title");
2:
3: function isRevision(revision) {
4: return /^[0-9a-f]{40}$/.test(revision);
5: }
6:
7: function getReleaseRevisionDetails({ issueBody, repo }) {
8: if (
9: parse(issueBody, { startRule: "CheckRunsLinkCount" }) !== 1
10: ) {
11: throw new Error(
12: `Expected exactly one View check runs link in Quick links for getsentry/${repo}.`
13: );
14: }
15:
16: let details;
17: try {
18: details = parse(issueBody, { startRule: "ReleaseRevision" });
19: } catch {
20: throw new Error(
21: `Expected a View check runs link for getsentry/${repo} in the publish issue body.`
22: );
23: }
24:
25: if (details.repo !== repo) {
26: throw new Error(
27: `Expected a View check runs link for getsentry/${repo} in the publish issue body.`
28: );
29: }
30: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require('@actions/github');
2: const core = require('@actions/core');
3: const { detailsFromContext } = require('../modules/details-from-context');
4:
5: async function inputs() {
6: const result = await detailsFromContext({
7: context: github.context,
8: });
9: core.setOutput('result', JSON.stringify(result));
10: }
11:
12:
13: inputs();
(End of file - total 13 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-ci-poller-input.js</path>
<type>file</type>
<content>
1: const { getCiPollerInput } = require("../modules/ci-poller-input");
2: const { readFileSync } = require("fs");
3:
4: const issueBody = process.env.PUBLISH_ISSUE_BODY_FILE
5: ? readFileSync(process.env.PUBLISH_ISSUE_BODY_FILE, "utf8")
6: : process.env.PUBLISH_ISSUE_BODY || "";
7:
8: process.stdout.write(
9: JSON.stringify(
10: getCiPollerInput({
11: issueBody,
12: title: process.env.PUBLISH_TITLE || "",
13: revision: process.env.PUBLISH_REVISION || "",
14: })
15: )
16: );
(End of file - total 16 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-location.js</path>
<type>file</type>
<content>
1: const core = require("@actions/core");
2: const { resolvePublishLocation } = require("../modules/publish-location");
3:
4: function resolveLocation() {
5: const input = JSON.parse(process.env.PUBLISH_ARGS || "{}");
6: const workspaceNames = JSON.parse(process.env.CRAFT_WORKSPACE_NAMES || "[]");
7:
8: if (!Array.isArray(workspaceNames)) {
9: throw new Error(
10: "Craft workspace discovery returned an invalid workspace list."
11: );
12: }
13:
14: core.setOutput(
15: "result",
16: JSON.stringify(
17: resolvePublishLocation({
18: path: input.path,
19: workspaceNames,
20: })
21: )
22: );
23: }
24:
25: resolveLocation();
(End of file - total 25 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-release-revision.js</path>
<type>file</type>
<content>
1: const core = require("@actions/core");
2: const { getReleaseRevision } = require("../modules/release-revision");
3:
4: function resolveReleaseRevision() {
5: const { repo } = JSON.parse(process.env.PUBLISH_ARGS || "{}");
6: if (!repo) {
7: throw new Error("Publish input must define a repository.");
8: }
9:
10: core.setOutput(
11: "revision",
12: getReleaseRevision({
13: issueBody: process.env.PUBLISH_ISSUE_BODY || "",
14: repo,
15: })
16: );
17: }
18:
19: resolveReleaseRevision();
(End of file - total 19 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/discover-location.js</path>
<type>file</type>
<content>
1: const { execFileSync } = require("child_process");
2: const { existsSync } = require("fs");
3: const path = require("path");
4:
5: const core = require("@actions/core");
6:
7: const { resolvePublishLocation } = require("../modules/publish-location");
8:
9: function getWorkspaceNames({
10: repositoryDirectory,
11: exists = existsSync,
12: execFile = execFileSync,
13: }) {
14: if (!exists(path.join(repositoryDirectory, ".craft.yml"))) {
15: return [];
16: }
17:
18: const output = execFile(
19: "docker",
20: [
21: "run",
22: "--rm",
23: "--volume",
24: `${path.resolve(repositoryDirectory)}:/github/workspace/__repo__`,
25: "--workdir",
26: "/github/workspace/__repo__",
27: "getsentry/craft:latest",
28: "workspace",
29: "list",
30: ],
31: { encoding: "utf8" }
32: );
33: ...
/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/__tests__/discover-location.js /home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/__tests__/resolve-release-revision.js /home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/__tests__/resolve-location.js
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/details-from-context.js</path>
<type>file</type>
<content>
1: import { test, expect } from "vitest";
2:
3: const { detailsFromContext } = require("../details-from-context.js");
4:
5: const inputsArgs = {
6: context: {
7: repo: { owner: "getsentry", repo: "publish" },
8: payload: {
9: issue: {
10: number: "223",
11: title: "publish: getsentry/sentry@21.3.1",
12: body: `Requested by: @BYK
13:
14: Merge target: custom-branch
15:
16: Quick links:
17: - [View changes](https://github.com/getsentry/sentry/compare/21.3.0...refs/heads/releases/21.3.1)
18: - [View check runs](https://github.com/getsentry/sentry/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)
19:
20: Assign the **accepted** label to this issue to approve the release. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { spawnSync } from "child_process";
2: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
3: import { tmpdir } from "os";
4: import { join } from "path";
5:
6: import { afterEach, expect, test } from "vitest";
7:
8: const { resolvePublishLocation } = require("../publish-location.js");
9:
10: const temporaryDirectories = [];
11:
12: function getWorkflow() {
13: return readFileSync(
14: join(__dirname, "../../../.github/workflows/publish.yml"),
15: "utf8"
16: );
17: }
18:
19: function getSetTargetsScript() {
20: const workflow = getWorkflow();
21: const section = workflow.match(
22: / {6}- name: Set targets[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- uses: docker:\/\/getsentry\/craft:latest/
23: );
24: if (!section?.groups?.script) {
25: throw new Error("Missing Set targets workflow ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/release-revision.js</path>
<type>file</type>
<content>
1: import { expect, test } from "vitest";
2:
3: const {
4: getReleaseRevision,
5: updateReleaseRevision,
6: } = require("../release-revision.js");
7:
8: const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
9:
10: function requestBody(quickLinks) {
11: return `Requested by: @byk
12:
13: Merge target: (default)
14:
15: Quick links:
16: ${quickLinks}`;
17: }
18:
19: function canonicalQuickLinks(revision = REVISION) {
20: return `- [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
21: - [View check runs](https://github.com/getsentry/toolkit/commit/${revision}/checks/)`;
22: }
23:
24: test("gets the CI-approved revision from the request header", () => {
25: expect(
26: getReleaseRevision({
27: repo: "toolkit",
28: issueBody: requestBody(canonicalQuickLinks()),
29: })
30: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/generate-publish-issue-title-parser.js</path>
<type>file</type>
<content>
1: import { expect, test } from "vitest";
2:
3: const {
4: generateDocumentation,
5: } = require("../../../scripts/generate-publish-issue-title-parser.js");
6:
7: test("requires generated title grammar markers in the documentation", () => {
8: expect(() =>
9: generateDocumentation({
10: documentation: "# Publish Issue Format\n",
11: titleGrammar: 'PublishIssueTitle = "publish: "',
12: })
13: ).toThrow("Could not find the generated title grammar in the documentation.");
14: });
(End of file - total 14 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/__tests__/discover-location.js</path>
<type>file</type>
<content>
1: import { afterEach, expect, test, vi } from "vitest";
2:
3: const { discoverLocation, getWorkspaceNames } = require("../discover-location.js");
4:
5: afterEach(() => {
6: vi.restoreAllMocks();
7: });
8:
9: test("retains checkout-path behavior when the root config is absent", () => {
10: expect(
11: discoverLocation({
12: input: { path: "./packages/cli" },
13: repositoryDirectory: "__repo__",
14: exists: () => false,
15: })
16: ).toEqual({ path: "./packages/cli" });
17: });
18:
19: test("discovers exact workspace paths using the released Craft image", () => {
20: const execFile = vi.fn(() => '["packages/CLI"]');
21:
22: expect(
23: discoverLocation({
24: input: { path: "./packages/CLI" },
25: repositoryDirectory: "__repo__",
26: exists: () => true,
27: execFile,
28: })
29: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/__tests__/resolve-release-revision.js</path>
<type>file</type>
<content>
1: import { spawnSync } from "child_process";
2: import { expect, test } from "vitest";
3:
4: const script = new URL("../resolve-release-revision.js", import.meta.url).pathname;
5:
6: test("rejects missing workflow input through release revision validation", () => {
7: const result = spawnSync(process.execPath, [script], {
8: encoding: "utf8",
9: env: {
10: ...process.env,
11: PUBLISH_ARGS: "",
12: PUBLISH_ISSUE_BODY: "",
13: },
14: });
15:
16: expect(result.status).not.toBe(0);
17: expect(result.stderr).toContain("Publish input must define a repository.");
18: expect(result.stderr).not.toContain("Unexpected end of JSON input");
19: });
(End of file - total 19 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/__tests__/resolve-location.js</path>
<type>file</type>
<content>
1: import { spawnSync } from "child_process";
2: import { expect, test } from "vitest";
3:
4: const script = new URL("../resolve-location.js", import.meta.url).pathname;
5:
6: test("rejects missing workflow input through location validation", () => {
7: const result = spawnSync(process.execPath, [script], {
8: encoding: "utf8",
9: env: {
10: ...process.env,
11: PUBLISH_ARGS: "",
12: CRAFT_WORKSPACE_NAMES: "[]",
13: },
14: });
15:
16: expect(result.status).not.toBe(0);
17: expect(result.stderr).toContain("Invalid publish path.");
18: expect(result.stderr).not.toContain("Unexpected end of JSON input");
19: });
(End of file - total 19 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/scripts/generate-publish-issue-title-parser.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const path = require("path");
3: const peggy = require("peggy");
4: const prettier = require("prettier");
5:
6: const grammarPath = path.join(
7: __dirname,
8: "..",
9: "src",
10: "modules",
11: "publish-issue-title.peggy"
12: );
13: const outputPath = path.join(
14: __dirname,
15: "..",
16: "src",
17: "modules",
18: "publish-issue-title.js"
19: );
20: const documentationPath = path.join(
21: __dirname,
22: "..",
23: "docs",
24: "publish-issue-format.md"
25: );
26: function generateDocumentation({ documentation, titleGrammar }) {
27: const marker = /<!-- BEGIN GENERATED TITLE GRAMMAR -->\n[\s\S]*?<!-- END GENERATED TITLE GRAMMAR -->/.exec(
28: documentation
29: );
30:
31: if (!marker) {
32: throw new Error("Could not find the generated title grammar in the ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/docs/publish-issue-format.md</path> <type>file</type> <content> 1: # Publish Issue Format 2: 3: The Publish workflow treats a publish issue as a release request. The title identifies 4: the release; the body supplies the merge target and selected targets. Do not edit the 5: title by hand unless it remains valid under this format. 6: 7: ## Title 8: 9: Every title starts with `publish: `. The following canonical Peggy grammar is 10: generated from `src/modules/publish-issue-title.peggy`: 11: 12: <!-- BEGIN GENERATED TITLE GRAMMAR --> 13: ```peggy 14: // Canonical grammar for publish issue titles. A path suffix is syntactic only: 15: // the controller resolves the complete suffix as a workspace after checking 16: // out the CI-approved revision. 17: PublishIssueTitle 18: = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. ...
Found 70 matches
/home/byk/Code/getsentry/publish-workspace-acceptance/scripts/generate-publish-issue-title-parser.js:
Line 11: "publish-issue-title.peggy"
Line 18: "publish-issue-title.js"
Line 47: "CheckRunsLinkCount",
Line 50: grammarSource: "publish-issue-title.peggy",
/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/discover-location.js:
Line 7: const { resolvePublishLocation } = require("../modules/publish-location");
Line 51: return resolvePublishLocation({
/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/__tests__/discover-location.js:
Line 3: const { discoverLocation, getWorkspaceNames } = require("../discover-location.js");
/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/__tests__/resolve-location.js:
Line 4: const script = new URL("../resolve-location.js", import.meta.url).pathname;
/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-ci-poller-input.js:
...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/ci-poller-input.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const {
3: getReleaseRevision,
4: updateReleaseRevision,
5: } = require("./release-revision");
6: const {
7: isPublishRepository,
8: isReleaseVersion,
9: } = require("./publish-issue-validation");
10: const { isPublishPath } = require("./publish-location");
11:
12: function getCiPollerInput({ title, issueBody, revision }) {
13: let parsedTitle;
14: try {
15: parsedTitle = parsePublishIssueTitle(title);
16: } catch {
17: throw new Error(`Invalid publish issue title: '${title}'`);
18: }
19: const { repo, version } = parsedTitle;
20: if (!isPublishRepository(repo)) {
21: throw new Error(`Invalid publish issue repository: '${repo}'`);
22: }
23: if (!isReleaseVersion(version)) {
24: throw new Error(`Invalid publish issue version: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-location.js</path>
<type>file</type>
<content>
1: function resolvePublishLocation({ path, workspaceNames }) {
2: if (!isPublishPath(path)) {
3: throw new Error("Invalid publish path.");
4: }
5:
6: if (!workspaceNames.every(isWorkspaceName)) {
7: throw new Error(
8: "Craft workspace discovery returned an invalid workspace list."
9: );
10: }
11:
12: if (path === ".") {
13: return { path };
14: }
15:
16: const workspace = path.slice(2);
17: if (workspaceNames.includes(workspace)) {
18: return { path: ".", workspace };
19: }
20:
21: return { path };
22: }
23:
24: function isPublishPath(path) {
25: return (
26: typeof path === "string" &&
27: (path === "." ||
28: (path.startsWith("./") &&
29: path
30: .slice(2)
31: .split("/")
32: .every(isSafeWorkspaceSegment)))
33: );
34: }
35:
36: function ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-issue-validation.js</path>
<type>file</type>
<content>
1: function isPublishRepository(name) {
2: return (
3: /^[A-Za-z0-9_.-]+$/.test(name) &&
4: name !== "." &&
5: name !== ".." &&
6: name !== "__proto__" &&
7: !name.startsWith("-")
8: );
9: }
10:
11: function isReleaseVersion(version) {
12: return /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-?([0-9a-z-]+(?:\.[0-9a-z-]+)*))?(?:\+([0-9a-z-]+(?:\.[0-9a-z-]+)*))?$/i.test(
13: version
14: );
15: }
16:
17: module.exports = { isPublishRepository, isReleaseVersion };
(End of file - total 17 lines)
</content>
diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index 324b63f..ddc3100 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -49,7 +49,7 @@ jobs:
owner: getsentry # create token with access to all getsentry repos
- name: Check out publish controller
- uses: actions/checkout@v5
+ uses: actions/checkout@v7
with:
path: .__publish__
@@ -93,11 +93,16 @@ jobs:
# Check each issue's CI status
echo "$issues" | jq -c '.[]' | while read -r issue; do
+ (
number=$(echo "$issue" | jq -r '.number')
title=$(echo "$issue" | jq -r '.title')
- body=$(echo "$issue" | jq -r '.body')
+ body_file=$(mktemp)
+ resolver_output_file=""
+ updated_body_file=""
+ trap 'for file in "${body_file:-}" "${resolver_output_file:-}" "${updated_body_file:-}"; do [[ -z "$file" ]] || rm -f ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/package.json</path>
<type>file</type>
<content>
1: {
2: "name": "publish",
3: "private": true,
4: "version": "0.0.1",
5: "description": "Approval-based publishing system for Sentry",
6: "main": "index.js",
7: "repository": "git@github.com:getsentry/publish.git",
8: "author": "Sentry Open Source <oss@sentry.io>",
9: "license": "Apache-2.0",
10: "volta": {
11: "node": "24.0.0",
12: "yarn": "1.22.22"
13: },
14: "resolutions": {
15: "undici": "^6.23.0"
16: },
17: "scripts": {
18: "generate": "node scripts/generate-publish-issue-title-parser.js",
19: "check:generated": "node scripts/generate-publish-issue-title-parser.js --check",
20: "test": "yarn check:generated && vitest run",
21: "test:watch": "vitest",
22: "lint": "eslint src .github --ignore-pattern '!.github'",
23: "prettier": "prettier --write src"
24: },
25: "devDependencies": {
26: "eslint": ...
Found 5 matches /home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/test.yml: Line 19: - uses: actions/checkout@v6 /home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/publish.yml: Line 120: uses: actions/checkout@v6 Line 159: - uses: actions/checkout@v6 /home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/ci-poller.yml: Line 52: uses: actions/checkout@v7 /home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/auto-approve.yml: Line 16: - uses: actions/checkout@v4
yarn run v1.22.22 $ yarn check:generated && vitest run $ node scripts/generate-publish-issue-title-parser.js --check [1m[46m RUN [49m[22m [36mv4.1.0 [39m[90m/home/byk/Code/getsentry/publish-workspace-acceptance[39m [2m Test Files [22m [1m[32m13 passed[39m[22m[90m (13)[39m [2m Tests [22m [1m[32m86 passed[39m[22m[90m (86)[39m [2m Start at [22m 03:20:51 [2m Duration [22m 2.11s[2m (transform 283ms, setup 0ms, import 1.33s, tests 818ms, environment 4ms)[22m Done in 3.55s.
yarn run v1.22.22 $ eslint src .github --ignore-pattern '!.github' Done in 0.99s.
Found 25 matches
/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-ci-poller-input.js:
Line 1: const { getCiPollerInput } = require("../modules/ci-poller-input");
/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/ci-poller-input.js:
Line 6: const { getCiPollerInput } = require("../ci-poller-input.js");
Line 43: join(__dirname, "../../../.github/workflows/ci-poller.yml"),
Line 50: "node .__publish__/src/publish/resolve-ci-poller-input.js"
/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/publish.yml:
Line 20: # - Enable the poller via CI_POLLER_HAS_PENDING=true
Line 80: client-id: ${{ vars.CI_POLLER_APP_CLIENT_ID }}
Line 81: private-key: ${{ secrets.CI_POLLER_APP_PRIVATE_KEY }}
Line 88: gh variable set CI_POLLER_HAS_PENDING -R "$GITHUB_REPOSITORY" -b "true"
Line 91: # Uses the app token β GITHUB_TOKEN workflow_dispatch events are ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/ci-poller-input.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { join } from "path";
3:
4: import { expect, test } from "vitest";
5:
6: const { getCiPollerInput } = require("../ci-poller-input.js");
7:
8: const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
9: const issueBody = `Requested by: @byk
10:
11: Merge target: (default)
12:
13: Quick links:
14: - [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
15: - [View check runs](https://github.com/getsentry/toolkit/commit/${REVISION}/checks/)`;
16:
17: test("parses root and full-path publish titles", () => {
18: expect(
19: getCiPollerInput({
20: issueBody,
21: title: "publish: getsentry/toolkit/cli@1.2.3",
22: })
23: ).toEqual({
24: repo: "getsentry/toolkit",
25: revision: REVISION,
26: version: "1.2.3",
27: });
28:
29: ...
one two bash: line 1: continue: only meaningful in a `for', `while', or `until' loop
bash: line 1: continue: only meaningful in a `for', `while', or `until' loop one two status=0
M .github/workflows/ci-poller.yml M .github/workflows/publish.yml M docs/publish-issue-format.md M scripts/generate-publish-issue-title-parser.js M src/modules/__tests__/details-from-context.js M src/modules/__tests__/publish-workflow.js M src/modules/__tests__/release-revision.js M src/modules/details-from-context.js M src/modules/publish-issue-title.js M src/modules/publish-issue-title.peggy M src/modules/release-revision.js M src/publish/inputs.js M src/publish/resolve-ci-poller-input.js M src/publish/resolve-location.js M src/publish/resolve-release-revision.js ?? src/modules/__tests__/generate-publish-issue-title-parser.js ?? src/publish/__tests__/ ?? ...
/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/release-revision.js:40
throw new Error("Release revision must be a lowercase 40-character SHA.");
^
Error: Release revision must be a lowercase 40-character SHA.
at updateReleaseRevision (/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/release-revision.js:40:11)
at [eval]:1:361
at runScriptInThisContext (node:internal/vm:218:10)
at node:internal/process/execution:456:12
at [eval]-wrapper:6:24
at runScriptInContext (node:internal/process/execution:454:60)
at evalFunction (node:internal/process/execution:286:30)
at evalTypeScript (node:internal/process/execution:298:3)
at node:internal/main/eval_string:71:3
Node.js v24.0.0
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-issue-title.js</path>
<type>file</type>
<content>
1440: peg$fail(peg$endExpectation());
1441: }
1442:
1443: throw peg$buildStructuredError(
1444: peg$maxFailExpected,
1445: peg$maxFailPos < input.length ? peg$getUnicode(peg$maxFailPos) : null,
1446: peg$maxFailPos < input.length
1447: ? peg$computeLocation(peg$maxFailPos, peg$maxFailPos + 1)
1448: : peg$computeLocation(peg$maxFailPos, peg$maxFailPos)
1449: );
1450: }
1451: if (options.peg$library) {
1452: return /** @type {any} */ ({
1453: peg$result,
1454: peg$currPos,
1455: peg$FAILED,
1456: peg$maxFailExpected,
1457: peg$maxFailPos,
1458: peg$success,
1459: peg$throw: peg$success ? ...
.github/workflows/ci-poller.yml:95-102 runs each iteration in a subshell, but the error paths use continue (:105-109, :152-160). Bash rejects continue there because the subshell has no loop, then continues executing.
On an update resolver or JSON decode failure, updated_body_file stays empty (:151, :157-160), yet execution reaches gh issue edit --body-file "$updated_body_file" (:162). This can replace the issue body with an empty file.
A non-mutating Bash reproduction confirmed that continue in this subshell reports an error and does not skip the surrounding while iteration.
scripts/generate-publish-issue-title-parser.js:27-38 finds and replaces only the first marker pair. A document containing two valid generated blocks can pass --check when both blocks happen to match, leaving ambiguous canonical grammar.
src/modules/__tests__/generate-publish-issue-title-parser.js:7-14 covers only missing markers, not duplicate or malformed marker pairs.
| Concern | Verdict | Evidence |
|---|---|---|
| Body-start canonical RequestHeader | PASS | Peggy requires Requested by at offset zero and ordered header fields: publish-issue-title.peggy:39-47. |
| Exact repository binding | PASS | Parsed link repo must exactly equal title repo: release-revision.js:25-29. |
| Lowercase 40-hex SHA; only optional terminal /checks/ slash | PASS | publish-issue-title.peggy:46,50-55; replacement validation at release-revision.js:3-5,38-41. |
| Global duplicate View check runs detection | PASS | Whole-body counter runs before header parsing: release-revision.js:7-14; scanner is global: publish-issue-title.peggy:58-62. |
| Canonical merge-target authority and documented grammar | PASS | Merge target comes only from the parsed request header: details-from-context.js:54-57; grammar and docs ...
Date: Sep 8, 2026 * π‘ (03:21) Bash reproduction showed that `continue` executed outside a `for`, `while`, or `until` loop emits `bash: line 1: continue: only meaningful in a \`for', \`while', or \`until' loop`; a second reproduction printed `one`, `two`, and `status=0`, confirming the error does not automatically skip subsequent commands. * π‘ (03:22) Working tree had modified files: `.github/woβ¦
Date: Sep 8, 2026 * π‘ (03:20) Repository search found 5 `actions/checkout` workflow uses: `.github/workflows/test.yml:19` uses `actions/checkout@v6`; `.github/workflows/publish.yml:120` and `:159` use `actions/checkout@v6`; `.github/workflows/ci-poller.yml:52` uses `actions/checkout@v7`; `.github/workflows/auto-approve.yml:16` uses `actions/checkout@v4`. * π‘ (03:20) `yarn test` in `/home/byk/Coβ¦
Date: Sep 8, 2026 * π΄ (03:19) User stated that new Craft requests always include the checkout repository identity. * π‘ (03:19) Repository change `.github/workflows/ci-poller.yml`: upgraded publish-controller checkout from `actions/checkout@v5` to `actions/checkout@v7`. * π‘ (03:19) Repository change `.github/workflows/ci-poller.yml`: each issue-processing iteration now runs in a subshell and wrβ¦
Date: Sep 8, 2026 * π΄ (03:18) User stated that new Craft requests always include the checkout repository identity. * π΄ (03:18) User stated that a missing root `.craft.yml` always means checkout-path behavior. * π΄ (03:18) User stated that the controller never normalizes names; Craft preserves exact workspace-path spelling. * π‘ (03:17) Repository artifact `src/modules/details-from-context.js`: β¦
Date: Sep 8, 2026 * π‘ (03:17) User provided a generated parser source file excerpt containing Peggy parser runtime code, including line splitting via `st.text.split(/\r\n|\n|\r/g)`, expectation-description formatting, `peg$source = options.grammarSource`, literal expectation for `"\r\n"`, and parser functions such as `peg$parseBlankLines()`.
Date: Sep 8, 2026 * π΄ (03:17) Repository `AGENTS.md` states this is the Sentry Publish Repository, a GitHub Actions-based approval system for publishing releases across multiple Sentry projects using Craft; it is a pure JavaScript CommonJS project targeting Node.js 24.0.0. * π΄ (03:17) Repository development policy: use Yarn classic 1.22.22 via Volta and do not use npm; prescribed commands are `β¦
Date: Sep 8, 2026 * π΄ (03:16) User directive: CI poller flow must never edit with an empty/invalid resolver result. * π΄ [requested-review] (03:16) User requested a strict, read-only adversarial final audit of uncommitted review-fix worktree `/home/byk/Code/getsentry/publish-workspace-acceptance` against branch baseline `a81ab03` and relevant base behavior; instructed not to edit, format, regeneβ¦