Dashboard › craft › Session 0RqzwFOM3Wiq
0RqzwFOM3Wiqy5Q66Perform a read-only, adversarial compatibility/security review of the proposed compact workspace-title redesign across /home/byk/Code/getsentry/craft-workspace-action-propagation and /home/byk/Code/getsentry/publish-workspace-acceptance. Do not modify files. Context: user rejects any new issue-body marker or body identity changes. Desired design may use release branch configuration as source of truth to classify title suffixes. Examine action.yml, publish.yml, ci-poller.yml, title parsing, workflow sequencing, existing check-run / branch mechanisms, config schema and workspace resolution. Identify whether a secure backward-compatible no-marker design is possible. Require legacy field-less titles never convert into new requests; no normalization before workspace lookup; workflow_dispatch stays enabled. Return precise file:line evidence, prioritized blockers, a concrete minimal safe contract if possible, required regression tests, and MERGE/DO-NOT-MERGE verdict. Do not write code.
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation</path> <type>directory</type> <entries> .craft.yml .dockerignore .eslintcache .git .github/ .gitignore .lore.md .nojekyll .npmignore .prettierignore .prettierrc.yml .tsbuildinfo .vscode/ action.yml AGENTS.md blog-post-draft.md build.mjs CHANGELOG.md CONTRIBUTING.md dist/ Dockerfile docs/ eslint.config.mjs img/ LICENSE node_modules/ package.json pnpm-lock.yaml README.md src/ tsconfig.build.json tsconfig.json vitest.config.mts (33 entries) </entries>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance</path> <type>directory</type> <entries> .eslintrc.js .git .github/ .gitignore AGENTS.md auto-approve-repos.txt docs/ LICENSE node_modules/ package.json README.md src/ vitest.config.js yarn.lock (14 entries) </entries>
No files found
No files found
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/.github</path> <type>directory</type> <entries> workflows/ (1 entries) </entries>
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/.github/workflows</path> <type>directory</type> <entries> build.yml changelog-preview.yml docs-preview.yml enforce-license-compliance.yml image.yml lint.yml release.yml (7 entries) </entries>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github</path> <type>directory</type> <entries> CODEOWNERS workflows/ (2 entries) </entries>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows</path> <type>directory</type> <entries> auto-approve.yml ci-poller.yml cocoapods-keepalive.yml publish.yml test.yml (5 entries) </entries>
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/AGENTS.md</path> <type>file</type> <content> 1: # AGENTS.md 2: 3: This file provides guidance for AI coding assistants working with the Craft codebase. 4: 5: ## Package Management 6: 7: - **Always use `pnpm`** for package management. Never use `npm` or `yarn`. 8: - Node.js version is managed by [Volta](https://volta.sh/) (currently v22.12.0). 9: - Install dependencies with `pnpm install --frozen-lockfile`. 10: 11: ## Development Commands 12: 13: | Command | Description | 14: | ------------ | ------------------------------------------- | 15: | `pnpm build` | Build the project (outputs to `dist/craft`) | 16: | `pnpm test` | Run tests | 17: | `pnpm lint` | Run ESLint | 18: | `pnpm fix` | Auto-fix lint issues | 19: 20: To manually test changes: 21: 22: ```bash 23: pnpm build && ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/AGENTS.md</path> <type>file</type> <content> 1: # AGENTS.md - Coding Agent Guidelines 2: 3: This document provides guidelines for AI coding agents working in this repository. 4: 5: ## Project Overview 6: 7: This is the **Sentry Publish Repository** - a GitHub Actions-based approval system for publishing releases across multiple Sentry projects using [Craft](https://github.com/getsentry/craft). It's a pure JavaScript (Node.js 24.0.0) project using CommonJS modules. 8: 9: ## Build/Lint/Test Commands 10: 11: ### Package Manager 12: 13: - **Yarn 1.22.22** (classic) - Do NOT use npm 14: - Version management via Volta (pinned in package.json) 15: 16: ### Commands 17: 18: ```bash 19: # Install dependencies 20: yarn install 21: 22: # Run all tests 23: yarn test 24: 25: # Run tests in watch mode 26: yarn test:watch 27: 28: # Run a single test file 29: yarn test src/modules/__tests__/update-issue.js 30: 31: # Run tests ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/action.yml</path>
<type>file</type>
<content>
1: name: 'Craft Prepare Release'
2: description: 'Prepare a new release using Craft'
3:
4: inputs:
5: version:
6: description: >
7: Version to release. Can be a semver string (e.g., "1.2.3"),
8: a bump type ("major", "minor", "patch"), or "auto" for automatic detection.
9: required: false
10: merge_target:
11: description: Target branch to merge into. Uses the default branch as a fallback. ...
(no output)
(no output)
feat/workspace-action-propagation ## feat/workspace-action-propagation...origin/feat/workspace-action-propagation 6dae341 (HEAD -> feat/workspace-action-propagation, origin/feat/workspace-action-propagation) feat: propagate release workspaces 21270a1 (origin/master, origin/HEAD) feat(config): add release workspaces 32f5462 fix(git): prevent fatal error for missing 'origin' remote (#871) 5d0ec43 fix(registry): retry registry push with backoff on concurrent updates (#870) 35e8063 meta: Bump new development version b2524ef Merge branch 'release/2.30.1' cd1e829 (tag: 2.30.1) release: 2.30.1 06180e3 fix(vercel): pass prebuilt output directory 29ad5c3 meta: Bump new development version c02eb03 Merge branch 'release/2.30.0' > 6dae341 feat: propagate release workspaces > 21270a1 feat(config): add release workspaces > 32f5462 fix(git): prevent fatal error for missing 'origin' remote (#871) > 5d0ec43 fix(registry): retry registry push with backoff on concurrent updates (#870) > 35e8063 meta: ...
feat/workspace-acceptance ## feat/workspace-acceptance...origin/feat/workspace-acceptance b658ffa (HEAD -> feat/workspace-acceptance, origin/feat/workspace-acceptance) fix: validate publish workspace JSON 33de3f1 feat: accept workspace publish requests 83d210b (origin/main, origin/HEAD, opencode/tidy-orchid, main) build(deps): bump js-yaml from 4.3.0 to 4.3.1 (#9174) 5268a23 feat: Add Vercel creds 92eba3f feat: Add CLOUDFLARE_API_TOKEN (#9122) ada6147 build(deps): bump js-yaml from 4.1.1 to 4.3.0 (#8731) a4f961a fix: Add GITHUB_API_TOKEN for commit-on-git target (#9069) bf10f82 build(deps): bump postcss from 8.5.15 to 8.5.23 (#9017) 837edc0 docs: fix possessive apostrophe placement (#9015) 4da4a25 chore: replace deprecated trimRight() with trimEnd() (#9012) fatal: ambiguous argument 'origin/master...HEAD': unknown revision or path not in the working tree. Use '--' to separate paths from revisions, like this: 'git <command> [<revision>...] -- [<file>...]'
> 6dae341 feat: propagate release workspaces
diff --git a/action.yml b/action.yml
index 8fa9390..6344db2 100644
--- a/action.yml
+++ b/action.yml
@@ -31,6 +31,9 @@ inputs:
description: The path that Craft will run inside
required: false
default: '.'
+ workspace:
+ description: Named Craft release workspace to prepare and publish
+ required: false
craft_config_from_merge_target:
description: Use the craft config from the merge target branch
required: false
@@ -68,6 +71,16 @@ outputs:
runs:
using: 'composite'
steps:
+ - name: Validate workspace
+ shell: bash
+ env:
+ WORKSPACE: ${{ inputs.workspace }}
+ run: |
+ if [[ -n "$WORKSPACE" ]] && node -e 'process.exit(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(process.env.WORKSPACE) ? 0 : 1)'; then
+ echo "::error::Workspace names cannot contain Unicode control, format, or separator characters."
+ exit 1
+ fi
+
- id: killswitch
name: Check ...
> b658ffa fix: validate publish workspace JSON
> 33de3f1 feat: accept workspace publish requests
diff --git a/.github/workflows/cocoapods-keepalive.yml b/.github/workflows/cocoapods-keepalive.yml
index 21c0696..9c11b0e 100644
--- a/.github/workflows/cocoapods-keepalive.yml
+++ b/.github/workflows/cocoapods-keepalive.yml
@@ -1,4 +1,4 @@
-name: "CocoaPods Token Keep-Alive"
+name: CocoaPods Token Keep-Alive
on:
schedule:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cff6bc3..c283b79 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -184,12 +184,14 @@ jobs:
fetch-depth: 0
- name: Set targets
+ id: craft-state
shell: bash
if: fromJSON(steps.inputs.outputs.result).targets
env:
CRAFT_PUBLISH_REPO: ${{ fromJSON(steps.inputs.outputs.result).repo }}
CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.inputs.outputs.result).path }}
...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/.github/workflows/release.yml</path>
<type>file</type>
<content>
1: name: Release
2: concurrency: ${{ github.workflow }}-${{ github.ref }}
3:
4: on:
5: # For Craft's own releases (dogfooding)
6: workflow_dispatch:
7: inputs:
8: version:
9: description: Version to release
10: required: true
11: default: 'auto'
12: force:
13: description: Force a release even when there are release-blockers (optional)
14: required: false
15: workspace:
16: description: Named Craft release workspace to prepare and publish
17: required: false
18:
19: # For external repos to call this workflow
20: workflow_call:
21: inputs:
22: version:
23: description: Version to release (semver, bump type, or "auto")
24: type: string
25: required: false
26: force:
27: description: Force a release even when there are ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3: issues:
4: types: [labeled]
5:
6: concurrency:
7: # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8: # issues for the same repo@version share a concurrency group.
9: group: ${{ github.event.issue.title }}
10: cancel-in-progress: false
11:
12: permissions:
13: contents: read
14: issues: write
15: packages: write
16:
17: jobs:
18: # When accepted is added to a publish issue:
19: # - Add ci-pending (and remove ci-failed if retrying)
20: # - Enable the poller via CI_POLLER_HAS_PENDING=true
21: # - Comment on the issue
22: # - Trigger the poller immediately so we don't wait for the next cron tick
23: # The publish job below requires ci-ready, so it will not fire until the
24: # poller flips ci-pending → ci-ready (which also prevents publishing without
25: # CI ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/ci-poller.yml</path> <type>file</type> <content> 1: name: CI Status Poller 2: 3: on: 4: schedule: 5: - cron: "*/5 * * * *" 6: workflow_dispatch: 7: inputs: 8: attempt: 9: description: Self-dispatch attempt counter (internal use) 10: required: false 11: default: "0" 12: 13: permissions: 14: contents: read 15: issues: read 16: 17: jobs: 18: check-ci: 19: runs-on: ubuntu-latest 20: environment: production 21: # Skip entirely (no runner provisioned) when there's nothing to check. 22: # Set to "true" by ci-pending.yml, reset to "false" here when done. 23: # Always allow workflow_dispatch for manual recovery. 24: if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch' 25: concurrency: 26: group: ci-status-poller 27: cancel-in-progress: false 28: steps: 29: # sentry-internal-app token ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src</path> <type>directory</type> <entries> __mocks__/ __tests__/ artifact_providers/ commands/ config.ts index.ts instrument.ts logger.ts schemas/ status_providers/ targets/ types/ utils/ (13 entries) </entries>
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/config.ts</path>
<type>file</type>
<content>
1: import { existsSync, lstatSync, readFileSync } from 'fs';
2: import path from 'path';
3:
4: import { load } from 'js-yaml';
5: import GitUrlParse from 'git-url-parse';
6: import { createGitClient } from './utils/git';
7: import { ZodError } from 'zod';
8:
9: import { logger } from './logger';
10: import {
11: CraftProjectConfig,
12: CraftProjectConfigSchema,
13: GitHubGlobalConfig,
14: ArtifactProviderName,
15: StatusProviderName,
16: TargetConfig,
17: ChangelogPolicy,
18: VersioningPolicy,
19: Workspace,
20: } from './schemas/project_config';
21: import { ConfigurationError } from './utils/errors';
22: import { isCompiledGitHubAction } from './utils/detection';
23: import {
24: getPackageVersion,
25: parseVersion,
26: versionGreaterOrEqualThan,
27: SemVer,
28: } from './utils/version';
29: // Note: We import getTargetByName lazily in ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/schemas/project_config.ts</path>
<type>file</type>
<content>
1: import { z } from 'zod';
2:
3: /**
4: * DEPRECATED: Use changelog.policy instead. Different policies for changelog management
5: */
6: export const enum ChangelogPolicy {
7: Auto = 'auto',
8: Simple = 'simple',
9: None = 'none',
10: }
11:
12: /**
13: * Name of the status provider
14: */
15: export const enum StatusProviderName {
16: GitHub = 'github',
17: }
18:
19: /**
20: * Name of the artifact provider
21: */
22: export const enum ArtifactProviderName {
23: GCS = 'gcs',
24: GitHub = 'github',
25: None = 'none',
26: }
27:
28: /**
29: * Default versioning policy when no version argument is provided. ...
Found 100 matches (more matches available)
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/workspaces.ts:
Line 15: /** Information about a workspace package */
Line 25: /** Dependencies that are also workspace packages */
Line 26: workspaceDependencies: string[];
Line 29: /** Result of workspace discovery */
Line 31: /** The type of workspace manager detected */
Line 37: /** Structure of pnpm-workspace.yaml */
Line 45: workspaces?: string[] | { packages?: string[] };
Line 93: * Extract workspaces array from package.json workspaces field
Line 97: workspaces: string[] | { packages?: string[] } | undefined,
Line 99: if (!workspaces) {
Line 102: if (Array.isArray(workspaces)) {
Line 103: return workspaces;
Line 105: return workspaces.packages || [];
Line 115: // First: collect all workspace package names and locations
Line 116: const workspaceLocations: Array<{
Line 120: const workspaceNames = ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/helpers.ts</path>
<type>file</type>
<content>
1: import { appendFileSync, mkdirSync, writeFileSync } from 'fs';
2: import path from 'path';
3: import { parseArgs } from 'node:util';
4:
5: import prompts from 'prompts';
6: import { logger, LogLevel, setLevel } from '../logger';
7:
8: /**
9: * Maximum size (in bytes) for step output values passed through GITHUB_OUTPUT.
10: * Values exceeding this are truncated to avoid E2BIG errors when GitHub Actions
11: * expands them into environment variables for subsequent steps.
12: *
13: * 64 KB is well under the ~2 MB ARG_MAX kernel limit and also under GitHub's
14: * ~65 536-character issue body limit, so truncated changelogs still render. ...
Found 40 matches
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/helpers.ts:
Line 42: export function extractWorkspaceSelection(
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__tests__/helpers.test.ts:
Line 10: extractWorkspaceSelection,
Line 37: describe('extractWorkspaceSelection', () => {
Line 42: extractWorkspaceSelection(['publish', '1.0.0'], NO_ENV),
Line 48: extractWorkspaceSelection(['publish', '--workspace', 'cli'], NO_ENV),
Line 53: expect(extractWorkspaceSelection(['--workspace=mcp'], NO_ENV)).toBe('mcp');
Line 57: expect(extractWorkspaceSelection(['--workspace=-cli'], NO_ENV)).toBe(
Line 61: extractWorkspaceSelection(['--workspace', '-cli'], NO_ENV),
Line 67: extractWorkspaceSelection(['--workspace', 'cli'], {
Line 75: extractWorkspaceSelection(
Line 84: extractWorkspaceSelection(
Line 93: extractWorkspaceSelection(['publish'], {
Line ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/index.ts</path>
<type>file</type>
<content>
1: #!/usr/bin/env node
2: // Import Sentry instrumentation first, before any other code
3: import './instrument';
4:
5: import isCI from 'is-ci';
6: import yargs from 'yargs';
7:
8: import { logger, LogLevel } from './logger';
9: import {
10: sanitizeDynamicLinkerEnv,
11: warnIfCraftEnvFileExists,
12: } from './utils/env';
13: import {
14: envToBool,
15: setGlobals,
16: extractWorkspaceSelection,
17: } from './utils/helpers';
18: import { getPackageVersion } from './utils/version';
19: import { withTracing } from './utils/tracing';
20: import { setActiveWorkspace } from './config';
21:
22: // Commands
23: import * as prepare from './commands/prepare';
24: import * as publish from './commands/publish';
25: import * as targets from './commands/targets';
26: import * as config from './commands/config';
27: import * as artifacts from './commands/artifacts';
28: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require('@actions/github');
2: const core = require('@actions/core');
3: const { detailsFromContext } = require('../modules/details-from-context');
4:
5: async function inputs() {
6: const result = await detailsFromContext({
7: context: github.context,
8: });
9: core.setOutput('result', result);
10: }
11:
12:
13: inputs();
(End of file - total 13 lines)
</content>
Date: Aug 27, 2026 * 🟡 (16:14) `src/index.ts` imports `sanitizeDynamicLinkerEnv` and `warnIfCraftEnvFileExists` from `./utils/env`; `envToBool`, `setGlobals`, and `extractWorkspaceSelection` from `./utils/helpers`; and `setActiveWorkspace` from `./config`. * 🟡 (16:14) In `src/index.ts`, `printVersion()` logs `craft ${getPackageVersion()}` at debug level unless `process.argv` includes `-v` or `-…
Date: Aug 27, 2026 * 🟡 (16:04) `src/utils/helpers.ts` exports `MAX_STEP_OUTPUT_BYTES = 64 * 1024`; this limit is intended to avoid Linux `E2BIG` errors when GitHub Actions expands step outputs into later-step environment variables and to remain below GitHub’s approximately `65,536`-character issue-body limit. * 🟡 (16:04) `src/utils/helpers.ts` defines `envToBool(envVar)` using falsy values `''`…
Date: Aug 27, 2026 * 🔴 (16:04) User directed that `workflow_dispatch` must always remain allowed for manual recovery. * 🔴 (16:04) User specified that prerelease/build relaxation in minimum-version checking applies only to the CURRENT version, never to the configured `minVersion` side. * 🔴 (16:04) User specified that a missing value following `--workspace` must never be mistaken for a workspace…
Date: Aug 27, 2026 * 🟡 (16:03) Proposed Publish change `b658ffa` renames workflow display name in `.github/workflows/cocoapods-keepalive.yml:1` from `"CocoaPods Token Keep-Alive"` to `CocoaPods Token Keep-Alive`. * 🟡 (16:03) Proposed Publish change `b658ffa` adds `id: craft-state` to the `Set targets` bash step in `.github/workflows/publish.yml`, enabling later workflow steps to consume its sta…
Date: Aug 27, 2026 * 🔴 [requested-security-review] (15:55) User requested a read-only, adversarial compatibility/security review of the proposed compact workspace-title redesign across `/home/byk/Code/getsentry/craft-workspace-action-propagation` and `/home/byk/Code/getsentry/publish-workspace-acceptance`; instructed not to modify files or write code. * 🔴 (15:55) User stated they reject any new…