Dashboard › craft › Session 0AZmy5wbFQAE
0AZmy5wbFQAEyEwb9Perform a final strict read-only adversarial audit of the current uncommitted hotfix in /home/byk/Code/getsentry/publish-root-location-bootstrap. Do not edit files. Inspect complete diff plus relevant resolver/input/workflow paths and tests. Confirm exact root '.' shortcut is safe (cannot select workspace), non-root config discovery failure remains fail-closed, validation precedes this resolver, and no scope drift. Check test evidence. Return severity-ranked findings with file:line citations and an exact final verdict of MERGE or DO-NOT-MERGE.
No files found
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap</path> <type>directory</type> <entries> .eslintrc.js .git .github/ .gitignore AGENTS.md auto-approve-repos.txt docs/ LICENSE node_modules/ package.json README.md scripts/ src/ vitest.config.js yarn.lock (15 entries) </entries>
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap/AGENTS.md</path> <type>file</type> <content> 1: # AGENTS.md - Coding Agent Guidelines 2: 3: This document provides guidelines for AI coding agents working in this repository. 4: 5: ## Project Overview 6: 7: This is the **Sentry Publish Repository** - a GitHub Actions-based approval system for publishing releases across multiple Sentry projects using [Craft](https://github.com/getsentry/craft). It's a pure JavaScript (Node.js 24.0.0) project using CommonJS modules. 8: 9: ## Build/Lint/Test Commands 10: 11: ### Package Manager 12: 13: - **Yarn 1.22.22** (classic) - Do NOT use npm 14: - Version management via Volta (pinned in package.json) 15: 16: ### Commands 17: 18: ```bash 19: # Install dependencies 20: yarn install 21: 22: # Run all tests 23: yarn test 24: 25: # Run tests in watch mode 26: yarn test:watch 27: 28: # Run a single test file 29: yarn test src/modules/__tests__/update-issue.js 30: 31: # Run tests ...
M src/publish/__tests__/discover-location.js
M src/publish/discover-location.js
diff --git a/src/publish/__tests__/discover-location.js b/src/publish/__tests__/discover-location.js
index 7b522a6..6276c6c 100644
--- a/src/publish/__tests__/discover-location.js
+++ b/src/publish/__tests__/discover-location.js
@@ -1,59 +1,91 @@
import { afterEach, expect, test, vi } from "vitest";
const { discoverLocation, getWorkspaceNames } = require("../discover-location.js");
afterEach(() => {
vi.restoreAllMocks();
});
test("retains checkout-path behavior when the root config is absent", () => {
expect(
discoverLocation({
input: { path: "./packages/cli" },
repositoryDirectory: "__repo__",
exists: () => false,
})
).toEqual({ path: "./packages/cli" });
});
+test("does not discover workspaces for the checkout root", () => {
+ const execFile = vi.fn(() => {
+ throw new Error("workspace list is unavailable");
+ });
+
+ expect(
+ ...
Found 40 matches
/home/byk/Code/getsentry/publish-root-location-bootstrap/src/publish/update-issue.js:
Line 7: const inputs = JSON.parse(process.env.PUBLISH_ARGS);
/home/byk/Code/getsentry/publish-root-location-bootstrap/src/publish/resolve-release-revision.js:
Line 5: const { repo } = JSON.parse(process.env.PUBLISH_ARGS || "{}");
/home/byk/Code/getsentry/publish-root-location-bootstrap/src/publish/resolve-location.js:
Line 2: const { resolvePublishLocation } = require("../modules/publish-location");
Line 5: const input = JSON.parse(process.env.PUBLISH_ARGS || "{}");
Line 17: resolvePublishLocation({
/home/byk/Code/getsentry/publish-root-location-bootstrap/src/publish/post-result.js:
Line 7: const inputs = JSON.parse(process.env.PUBLISH_ARGS);
/home/byk/Code/getsentry/publish-root-location-bootstrap/src/publish/discover-location.js:
Line 7: const { resolvePublishLocation } = require("../modules/publish-location");
Line 45: function ...
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap/src/modules/publish-location.js</path>
<type>file</type>
<content>
1: function resolvePublishLocation({ path, workspaceNames }) {
2: if (!isPublishPath(path)) {
3: throw new Error("Invalid publish path.");
4: }
5:
6: if (!workspaceNames.every(isWorkspaceName)) {
7: throw new Error(
8: "Craft workspace discovery returned an invalid workspace list."
9: );
10: }
11:
12: if (path === ".") {
13: return { path };
14: }
15:
16: const workspace = path.slice(2);
17: if (workspaceNames.includes(workspace)) {
18: return { path: ".", workspace };
19: }
20:
21: return { path };
22: }
23:
24: function isPublishPath(path) {
25: return (
26: typeof path === "string" &&
27: (path === "." ||
28: (path.startsWith("./") &&
29: path
30: .slice(2)
31: .split("/")
32: .every(isSafeWorkspaceSegment)))
33: );
34: }
35:
36: function ...
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap/.github/workflows/publish.yml</path>
<type>file</type>
<content>
90: # Trigger the CI poller immediately instead of waiting for the next cron tick.
91: # Uses the app token — GITHUB_TOKEN workflow_dispatch events are suppressed.
92: - name: Trigger CI poller
93: env:
94: GH_TOKEN: ${{ steps.token.outputs.token }}
95: run: |
96: gh workflow run ci-poller.yml -R "$GITHUB_REPOSITORY"
97:
98: publish:
99: runs-on: ubuntu-latest
100: environment: production
101: name: Publish a new version
102: # Publish when ci-ready is present (added by the poller after CI passes).
103: # Fires ONLY on ci-ready label events — not accepted — to avoid racing
104: # with waiting-for-ci on the same event. ...
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require('@actions/github');
2: const core = require('@actions/core');
3: const { detailsFromContext } = require('../modules/details-from-context');
4:
5: async function inputs() {
6: const result = await detailsFromContext({
7: context: github.context,
8: });
9: core.setOutput('result', JSON.stringify(result));
10: }
11:
12:
13: inputs();
(End of file - total 13 lines)
</content>
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const { getReleaseRevisionDetails } = require("./release-revision");
3: const { isPublishPath } = require("./publish-location");
4: const {
5: isPublishRepository,
6: isReleaseVersion,
7: } = require("./publish-issue-validation");
8:
9: /**
10: * Matches the entire "Targets" section of a github publish issue body.
11: */
12: const TARGETS_SECTION_PARSER_REGEX =
13: /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
14:
15: /**
16: * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
17: * The "id" of the targets is captured within a capture group. ...
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap/src/modules/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { spawnSync } from "child_process";
2: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
3: import { tmpdir } from "os";
4: import { join } from "path";
5:
6: import { afterEach, expect, test } from "vitest";
7:
8: const { resolvePublishLocation } = require("../publish-location.js");
9:
10: const temporaryDirectories = [];
11:
12: function getWorkflow() {
13: return readFileSync(
14: join(__dirname, "../../../.github/workflows/publish.yml"),
15: "utf8"
16: );
17: }
18:
19: function getSetTargetsScript() {
20: const workflow = getWorkflow();
21: const section = workflow.match(
22: / {6}- name: Set targets[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- uses: docker:\/\/getsentry\/craft:latest/
23: );
24: if (!section?.groups?.script) {
25: throw new Error("Missing Set targets workflow ...
/home/byk/Code/getsentry/publish-root-location-bootstrap/src/modules/publish-issue-title.peggy /home/byk/Code/getsentry/publish-root-location-bootstrap/src/modules/publish-issue-title.js
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap/src/modules/publish-issue-title.peggy</path>
<type>file</type>
<content>
1: {
2: function join(characters) {
3: return characters.join("");
4: }
5: }
6:
7: // BEGIN TITLE GRAMMAR
8: // Canonical grammar for publish issue titles. A path suffix is syntactic only:
9: // the controller resolves the complete suffix as a workspace after checking
10: // out the CI-approved revision.
11: PublishIssueTitle
12: = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. {
13: return {
14: repo,
15: path: path || "",
16: version,
17: };
18: }
19:
20: Repository
21: = characters:RepositoryCharacter+ { return join(characters); }
22:
23: RepositoryCharacter
24: = [A-Za-z0-9_.-]
25:
26: Path
27: = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
28:
29: PathSegment
30: = characters:RepositoryCharacter+ { return ...
yarn run v1.22.22
$ yarn check:generated && vitest run src/publish/__tests__/discover-location.js --runInBand
$ node scripts/generate-publish-issue-title-parser.js --check
file:///home/byk/Code/getsentry/publish-root-location-bootstrap/node_modules/vitest/dist/chunks/cac.CWGDZnXT.js:405
throw new CACError(`Unknown option \`${name.length > 1 ? `--${name}` : `-${name}`}\``);
^
CACError: Unknown option `--runInBand`
at Command.checkUnknownOptions (file:///home/byk/Code/getsentry/publish-root-location-bootstrap/node_modules/vitest/dist/chunks/cac.CWGDZnXT.js:405:17)
at CAC.runMatchedCommand (file:///home/byk/Code/getsentry/publish-root-location-bootstrap/node_modules/vitest/dist/chunks/cac.CWGDZnXT.js:605:13)
at CAC.parse (file:///home/byk/Code/getsentry/publish-root-location-bootstrap/node_modules/vitest/dist/chunks/cac.CWGDZnXT.js:546:12)
at file:///home/byk/Code/getsentry/publish-root-location-bootstrap/node_modules/vitest/dist/cli.js:29:13
...
yarn run v1.22.22 $ yarn check:generated && vitest run src/publish/__tests__/discover-location.js $ node scripts/generate-publish-issue-title-parser.js --check [1m[46m RUN [49m[22m [36mv4.1.0 [39m[90m/home/byk/Code/getsentry/publish-root-location-bootstrap[39m [2m Test Files [22m [1m[32m1 passed[39m[22m[90m (1)[39m [2m Tests [22m [1m[32m6 passed[39m[22m[90m (6)[39m [2m Start at [22m 18:06:05 [2m Duration [22m 391ms[2m (transform 29ms, setup 0ms, import 141ms, tests 19ms, environment 0ms)[22m Done in 1.79s. yarn run v1.22.22 $ yarn check:generated && vitest run src/modules/__tests__/details-from-context.js $ node scripts/generate-publish-issue-title-parser.js --check [1m[46m RUN [49m[22m [36mv4.1.0 [39m[90m/home/byk/Code/getsentry/publish-root-location-bootstrap[39m [2m Test Files [22m [1m[32m1 passed[39m[22m[90m (1)[39m [2m Tests [22m [1m[32m16 passed[39m[22m[90m (16)[39m [2m Start at [22m 18:06:07 [2m ...
<path>/home/byk/Code/getsentry/publish-root-location-bootstrap/src/modules/__tests__/details-from-context.js</path>
<type>file</type>
<content>
1: import { test, expect } from "vitest";
2:
3: const { detailsFromContext } = require("../details-from-context.js");
4:
5: const inputsArgs = {
6: context: {
7: repo: { owner: "getsentry", repo: "publish" },
8: payload: {
9: issue: {
10: number: "223",
11: title: "publish: getsentry/sentry@21.3.1",
12: body: `Requested by: @BYK
13:
14: Merge target: custom-branch
15:
16: Quick links:
17: - [View changes](https://github.com/getsentry/sentry/compare/21.3.0...refs/heads/releases/21.3.1)
18: - [View check runs](https://github.com/getsentry/sentry/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)
19:
20: Assign the **accepted** label to this issue to approve the release. ...
CRITICAL: None.
HIGH: None.
MEDIUM: None.
LOW: None.
PASS:
'.' returns { path: '.' } before workspace discovery, so it never emits a workspace value or runs Craft: src/publish/discover-location.js:50-53. Regression proves no discovery call: src/publish/__tests__/discover-location.js:21-37.src/publish/discover-location.js:55-58; covered at src/publish/__tests__/discover-location.js:39-53.isPublishPath at src/modules/details-from-context.js:49-52, then the workflow passes that result to location resolution at .github/workflows/publish.yml:134-136,169-174.discover-location.js and its focused test changed.MERGE
Date: Sep 8, 2026 * 🔴 [requested-review] (18:03) User requested a final strict read-only adversarial audit of the current uncommitted hotfix in `/home/byk/Code/getsentry/publish-root-location-bootstrap`; instructed not to edit files; requested inspection of the complete diff plus resolver/input/workflow paths and tests; requested confirmation that exact root `'.'` shortcut cannot select a worksp…