Dashboard › craft › Session 0W2J5fyssZZk
0W2J5fyssZZkg7iPFReturn a COMPLETE evidence-based, strict READ-ONLY audit. Do not edit files, format, generate, run mutating commands, or alter git state. If any tool fails, report BLOCKED: <tool and error>; you MUST NOT return empty.
Audit the CURRENT exact uncommitted trees:
Begin by verifying actual changed files with git status --short, git diff --name-only, and git diff --check in each worktree. Do not report stale files that are absent from the current diff, including .github/workflows/cocoapods-keepalive.yml unless it actually appears.
getsentry/craft:latest is intentional and REQUIRED. Do not report it as an issue.
Read every current changed file and necessary adjacent implementation. Test no mutation: You may run read-only commands only. Check, cite, and grade PASS / CONCERN / MUST-FIX:
packages/{cli, packages/{cli}, packages/{cli,{mcp}}, packages/{cli,{{},mcp}}), valid nested expansion works; no invalid expansion gets dropped. Schema/runtime parity; validation happens before glob invocation; safe forms, unsafe path forms, POSIX exactness, remote config root, collision/overlap, physical symlink containment.--rev.M action.yml M docs/src/content/docs/targets/github.md M src/__tests__/action.test.ts M src/__tests__/config.test.ts M src/commands/prepare.ts M src/config.ts M src/schemas/project_config.ts M src/utils/__tests__/publishState.test.ts M src/utils/publishState.ts action.yml docs/src/content/docs/targets/github.md src/__tests__/action.test.ts src/__tests__/config.test.ts src/commands/prepare.ts src/config.ts src/schemas/project_config.ts src/utils/__tests__/publishState.test.ts src/utils/publishState.ts
M .github/workflows/publish.yml M docs/publish-issue-format.md M src/modules/__tests__/ci-poller-input.js M src/modules/__tests__/details-from-context.js M src/modules/__tests__/publish-location.js M src/modules/__tests__/publish-workflow.js M src/modules/ci-poller-input.js M src/modules/details-from-context.js M src/modules/publish-issue-title.js M src/modules/publish-issue-title.peggy M src/modules/publish-location.js M src/publish/resolve-location.js ?? src/modules/publish-issue-validation.js .github/workflows/publish.yml docs/publish-issue-format.md src/modules/__tests__/ci-poller-input.js src/modules/__tests__/details-from-context.js src/modules/__tests__/publish-location.js src/modules/__tests__/publish-workflow.js src/modules/ci-poller-input.js src/modules/details-from-context.js src/modules/publish-issue-title.js src/modules/publish-issue-title.peggy src/modules/publish-location.js src/publish/resolve-location.js
diff --git a/action.yml b/action.yml
index 94f3158..d160509 100644
--- a/action.yml
+++ b/action.yml
@@ -74,6 +74,7 @@ runs:
- name: Validate workspace
shell: bash
env:
+ LC_ALL: C
PATH_INPUT: ${{ inputs.path }}
WORKSPACE: ${{ inputs.workspace }}
run: |
@@ -81,8 +82,12 @@ runs:
echo "::error::The path and workspace inputs cannot be used together."
exit 1
fi
- if [[ -n "$WORKSPACE" ]] && ! node -e 'process.exit(/^(?!\.{1,2}$)(?!__proto__$)(?!-)[A-Za-z0-9_.-]+$/.test(process.env.WORKSPACE) ? 0 : 1)'; then
- echo "::error::Workspace names must use only ASCII letters, digits, periods, underscores, and hyphens."
+ if ! node -e 'const path = process.env.PATH_INPUT; const segment = /^[A-Za-z0-9_.-]+$/; process.exit(path === "." || (typeof path === "string" && path.split("/").every(name => segment.test(name) && ![".", "..", "__proto__"].includes(name) && !name.startsWith("-"))) ? ...
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f6dc96a..23c546e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -172,12 +172,7 @@ jobs:
PUBLISH_ARGS: ${{ steps.inputs.outputs.result }}
run: |
workspace_names='[]'
- requires_workspace_discovery="$(node -e '
- const { needsWorkspaceDiscovery } = require("./.__publish__/src/modules/publish-location");
- const input = JSON.parse(process.env.PUBLISH_ARGS || "");
- process.stdout.write(String(needsWorkspaceDiscovery(input)));
- ')"
- if [[ "$requires_workspace_discovery" == "true" && -f __repo__/.craft.yml ]]; then
+ if [[ -f __repo__/.craft.yml ]]; then
workspace_names="$(docker run --rm \
--volume "$GITHUB_WORKSPACE/__repo__:/github/workspace/__repo__" \
--workdir /github/workspace/__repo__ \
@@ -224,13 +219,18 @@ jobs:
...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/action.yml</path>
<type>file</type>
<content>
1: name: 'Craft Prepare Release'
2: description: 'Prepare a new release using Craft'
3:
4: inputs:
5: version:
6: description: >
7: Version to release. Can be a semver string (e.g., "1.2.3"),
8: a bump type ("major", "minor", "patch"), or "auto" for automatic detection.
9: required: false
10: merge_target:
11: description: Target branch to merge into. Uses the default branch as a fallback. ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/action.yml</path> <type>file</type> <content> 281: existing_issue=$(gh -R "$PUBLISH_REPO" issue list --json title,url,number,body | jq -r --arg t "$title" '[.[] | select(.title == $t)] | first // empty') 282: existing_issue_url="" 283: existing_issue_number="" 284: existing_body="" 285: if [[ -n "$existing_issue" ]]; then 286: existing_issue_url=$(echo "$existing_issue" | jq -r '.url') 287: existing_issue_number=$(echo "$existing_issue" | jq -r '.number') 288: existing_body=$(echo "$existing_issue" | jq -r '.body') 289: fi 290: 291: # Extract checked targets from the existing body. 292: # Targets appear as " - [x] targetName" or " - [X] targetName" in markdown. 293: # We only look within the "### Targets" section to avoid matching checkboxes in the changelog. ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/config.ts</path>
<type>file</type>
<content>
1: import { existsSync, lstatSync, readFileSync, realpathSync } from 'fs';
2: import path from 'path';
3: import { globSync, hasMagic } from 'glob';
4:
5: import { load } from 'js-yaml';
6: import GitUrlParse from 'git-url-parse';
7: import { createGitClient } from './utils/git';
8: import { ZodError } from 'zod';
9:
10: import { logger } from './logger';
11: import {
12: CraftProjectConfig,
13: CraftProjectConfigSchema,
14: GitHubGlobalConfig,
15: ArtifactProviderName,
16: StatusProviderName,
17: TargetConfig,
18: ChangelogPolicy,
19: VersioningPolicy,
20: Workspace,
21: } from './schemas/project_config';
22: import { ConfigurationError } from './utils/errors';
23: import { isCompiledGitHubAction } from './utils/detection';
24: import {
25: getPackageVersion,
26: parseVersion,
27: versionGreaterOrEqualThan,
28: SemVer,
29: } from ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/publishState.ts</path> <type>file</type> <content> 1: /** 2: * Helpers for locating Craft's publish-state file in a path that is NOT 3: * writable by the repository being published. 4: * 5: * Background: `craft publish` writes a small JSON file listing targets 6: * that have completed so a resumed run can skip them. Before this module 7: * existed, the file lived at `.craft-publish-<version>.json` in the 8: * project's cwd. That path is inside the repository checkout, so any 9: * committed file at the same path (or any earlier CI step) could 10: * pre-populate the "published" set and trick Craft into silently 11: * skipping targets. 12: * 13: * The file now lives under `$XDG_STATE_HOME/craft/` (falling back to 14: * `$HOME/.local/state/craft/`). The filename is keyed on 15: * owner, repo, a hash of cwd (to disambiguate monorepo subpaths), and 16: * the version being published. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3: issues:
4: types: [labeled]
5:
6: concurrency:
7: # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8: # issues for the same repo@version share a concurrency group.
9: group: ${{ github.event.issue.title }}
10: cancel-in-progress: false
11:
12: permissions:
13: contents: read
14: issues: write
15: packages: write
16:
17: jobs:
18: # When accepted is added to a publish issue:
19: # - Add ci-pending (and remove ci-failed if retrying)
20: # - Enable the poller via CI_POLLER_HAS_PENDING=true
21: # - Comment on the issue
22: # - Trigger the poller immediately so we don't wait for the next cron tick
23: # The publish job below requires ci-ready, so it will not fire until the
24: # poller flips ci-pending → ci-ready (which also prevents publishing without
25: # CI ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require('@actions/github');
2: const core = require('@actions/core');
3: const { detailsFromContext } = require('../modules/details-from-context');
4:
5: async function inputs() {
6: const result = await detailsFromContext({
7: context: github.context,
8: });
9: core.setOutput('result', result);
10: }
11:
12:
13: inputs();
(End of file - total 13 lines)
</content>
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/version.ts</path>
<type>file</type>
<content>
1: import { getGitTagPrefix } from '../config';
2:
3: /**
4: * Regular expression for matching semver versions.
5: *
6: * Modified to match version components
7: * Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
8: * @see https://github.com/sindresorhus/semver-regex
9: */
10: const semverRegex = () =>
11: /\bv?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-?([\da-z-]+(?:\.[\da-z-]+)*))?(?:\+([\da-z-]+(?:\.[\da-z-]+)*))?\b/gi;
12:
13: /**
14: * Extracts a version number from the given text.
15: *
16: * In case the version contains a leading "v", it is stripped from the result.
17: * All semantic versions are supported. See {@link http://semver.org/} for
18: * more information. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/ci-poller-input.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const {
3: getReleaseRevision,
4: updateReleaseRevision,
5: } = require("./release-revision");
6: const {
7: isPublishRepository,
8: isReleaseVersion,
9: } = require("./publish-issue-validation");
10: const { isPublishPath } = require("./publish-location");
11:
12: function getCiPollerInput({ title, issueBody, revision }) {
13: let parsedTitle;
14: try {
15: parsedTitle = parsePublishIssueTitle(title);
16: } catch {
17: throw new Error(`Invalid publish issue title: '${title}'`);
18: }
19: const { repo, version } = parsedTitle;
20: if (!isPublishRepository(repo)) {
21: throw new Error(`Invalid publish issue repository: '${repo}'`);
22: }
23: if (!isReleaseVersion(version)) {
24: throw new Error(`Invalid publish issue version: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const { isPublishPath } = require("./publish-location");
3: const {
4: isPublishRepository,
5: isReleaseVersion,
6: } = require("./publish-issue-validation");
7:
8: /**
9: * Matches the entire "Targets" section of a github publish issue body.
10: */
11: const TARGETS_SECTION_PARSER_REGEX =
12: /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
13:
14: /**
15: * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
16: * The "id" of the targets is captured within a capture group. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-release-revision.js</path>
<type>file</type>
<content>
1: const core = require("@actions/core");
2: const { getReleaseRevision } = require("../modules/release-revision");
3:
4: function resolveReleaseRevision() {
5: const { repo } = JSON.parse(process.env.PUBLISH_ARGS || "");
6: core.setOutput(
7: "revision",
8: getReleaseRevision({
9: issueBody: process.env.PUBLISH_ISSUE_BODY || "",
10: repo,
11: })
12: );
13: }
14:
15: resolveReleaseRevision();
(End of file - total 15 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/release-revision.js</path>
<type>file</type>
<content>
1: const CHECK_RUNS_LINK =
2: /^Requested by: @[^\r\n]+\r?\n(?:[ \t]*\r?\n)?[ \t]*Merge target: [^\r\n]+\r?\n(?:[ \t]*\r?\n)?[ \t]*Quick links:\r?\n(?:[ \t]*\r?\n)?[ \t]*- \[View changes\]\([^\r\n]+\)\r?\n[ \t]*- \[View check runs\]\(https:\/\/github\.com\/getsentry\/(?<repo>[A-Za-z0-9_.-]+)\/commit\/(?<revision>[0-9a-f]{40})\/checks\/?\)(?=\r?\n|$)/;
3: const CHECK_RUNS_LINK_COUNT = /^[ \t]*- \[View check runs\]\(/gm;
4:
5: function getReleaseRevision({ issueBody, repo }) {
6: if ((issueBody.match(CHECK_RUNS_LINK_COUNT) || []).length !== 1) {
7: throw new Error(
8: `Expected exactly one View check runs link in Quick links for getsentry/${repo}.`
9: );
10: }
11:
12: const match = issueBody.match(CHECK_RUNS_LINK);
13: if (!match?.groups || match.groups.repo !== repo) {
14: throw new Error(
15: `Expected a View check runs link ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/schemas/project_config.ts</path> <type>file</type> <content> 190: statusProvider: BaseStatusProviderSchema.optional(), 191: artifactProvider: BaseArtifactProviderSchema.optional(), 192: versioning: VersioningConfigSchema.optional(), 193: /** 194: * Do not merge the release branch after publishing. 195: * Defaults to true for compiled GitHub Actions (Node.js actions with dist/ folder). 196: */ 197: noMerge: z.boolean().optional(), 198: } as const; 199: 200: /** 201: * Configuration for a single named workspace (release unit). 202: * 203: * A workspace mirrors the release-relevant subset of the top-level config; 204: * every field is optional and inherits the top-level value when omitted. The 205: * `github` block is *partial* (all fields optional) so a workspace can override 206: * `owner` and/or `repo` while inheriting the rest from the top-level `github`. ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/__tests__/config.test.ts</path>
<type>file</type>
<content>
330: loadConfigurationFromString(
331: ['github:', ' owner: getsentry', ' repo: craft'].join('\n'),
332: );
333: expect(getActiveWorkspace()).toBeUndefined();
334: });
335:
336: test('resolves the selected workspace: overrides win, base inherited', () => {
337: setActiveWorkspace('cli');
338: const config = loadConfigurationFromString(WS_CONFIG);
339:
340: // Overridden by the workspace.
341: expect(config.releaseBranchPrefix).toBe('release/cli');
342: expect(getGitTagPrefix()).toBe('cli@');
343: expect(config.github).toEqual({ owner: 'getsentry', repo: 'toolkit' });
344: // Inherited from the top level.
345: expect(config.changelog).toBe('CHANGELOG.md');
346: // `workspaces` is stripped from the resolved config.
347: expect(config.workspaces).toBeUndefined();
348: });
349:
350: test('a ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-location.js</path>
<type>file</type>
<content>
1: function resolvePublishLocation({ path, workspaceNames }) {
2: if (!isPublishPath(path)) {
3: throw new Error("Invalid publish path.");
4: }
5:
6: if (!workspaceNames.every(isWorkspaceName)) {
7: throw new Error(
8: "Craft workspace discovery returned an invalid workspace list."
9: );
10: }
11:
12: if (path === ".") {
13: return { path };
14: }
15:
16: const workspace = path.slice(2);
17: if (workspaceNames.includes(workspace)) {
18: return { path: ".", workspace };
19: }
20:
21: return { path };
22: }
23:
24: function isPublishPath(path) {
25: return (
26: typeof path === "string" &&
27: (path === "." ||
28: (path.startsWith("./") &&
29: path
30: .slice(2)
31: .split("/")
32: .every(isSafeWorkspaceSegment)))
33: );
34: }
35:
36: function ...
Found 33 matches
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/publishState.ts:
Line 89: export function getPublishStateFilename(
Line 118: export function getPublishStatePath(
Line 126: getPublishStateFilename(version, githubConfig, cwd, workspace),
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__tests__/publishState.test.ts:
Line 7: getPublishStateFilename,
Line 8: getPublishStatePath,
Line 42: describe('getPublishStateFilename', () => {
Line 46: const name = getPublishStateFilename(
Line 57: const a = getPublishStateFilename(
Line 62: const b = getPublishStateFilename(
Line 71: const cli = getPublishStateFilename(
Line 77: const mcp = getPublishStateFilename(
Line 91: getPublishStateFilename(
Line 104: getPublishStateFilename(version, { owner: 'o', repo: 'r' }, cwd),
Line 117: const name = getPublishStateFilename(
Line 126: ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/publish.ts</path>
<type>file</type>
<content>
150: /** One or more targets we want to publish */
151: target?: string | string[];
152: /** The new version to publish */
153: newVersion: string;
154: /** Do not perform merge after publishing */
155: noMerge: boolean;
156: /** Do not remove downloads after publishing */
157: keepDownloads: boolean;
158: /** Do not perform build status check */
159: noStatusCheck: boolean;
160: /** Do not remove release branch after publishing */
161: keepBranch: boolean;
162: /** Do not perform basic git checks */
163: noGitChecks: boolean;
164: }
165:
166: export interface PublishState {
167: published: {
168: [targetId: string]: boolean;
169: };
170: }
171:
172: /**
173: * The Publish controller prepopulates a secure state file using the issue's
174: * checkout repository. ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/docs/src/content/docs/targets/github.md</path>
<type>file</type>
<content>
1: ---
2: title: GitHub
3: description: Create GitHub releases and tags
4: ---
5:
6: Creates a release on GitHub. If a Markdown changelog is present, this target reads the release name and description from it.
7:
8: ## Configuration
9:
10: | Option | Description |
11: |--------|-------------|
12: | `tagPrefix` | Prefix for new git tags (e.g., `v`). Empty by default. |
13: | `previewReleases` | Automatically detect and create preview releases. Default: `true` |
14: | `tagOnly` | Only create a tag (without a GitHub release). Default: `false` |
15: | `floatingTags` | List of floating tags to create/update. Supports `{major}`, `{minor}`, `{patch}` placeholders. |
16:
17: ## Environment Variables
18:
19: | Name | Description |
20: |------|-------------|
21: | `GITHUB_TOKEN` | Personal GitHub API token ([create ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/__tests__/action.test.ts</path>
<type>file</type>
<content>
1: import {
2: chmodSync,
3: mkdtempSync,
4: mkdirSync,
5: readFileSync,
6: rmSync,
7: writeFileSync,
8: } from 'fs';
9: import { tmpdir } from 'os';
10: import { join } from 'path';
11: import { spawnSync } from 'child_process';
12:
13: import { load } from 'js-yaml';
14: import { afterEach, expect, test } from 'vitest';
15:
16: interface ActionStep {
17: env?: Record<string, string>;
18: name?: string;
19: run?: string;
20: }
21:
22: function getActionSteps(): ActionStep[] {
23: const action = load(
24: readFileSync(join(__dirname, '../../action.yml'), 'utf8'),
25: ) as {
26: runs?: { steps?: ActionStep[] };
27: };
28: return action.runs?.steps || [];
29: }
30:
31: function getActionStep(name: string): ActionStep {
32: const step = getActionSteps().find(step => step.name === name);
33: if (!step?.run) {
34: ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/schemas/project_config.ts</path>
<type>file</type>
<content>
1: import { z } from 'zod';
2: import { hasMagic } from 'glob';
3:
4: /**
5: * DEPRECATED: Use changelog.policy instead. Different policies for changelog management
6: */
7: export const enum ChangelogPolicy {
8: Auto = 'auto',
9: Simple = 'simple',
10: None = 'none',
11: }
12:
13: /**
14: * Name of the status provider
15: */
16: export const enum StatusProviderName {
17: GitHub = 'github',
18: }
19:
20: /**
21: * Name of the artifact provider
22: */
23: export const enum ArtifactProviderName {
24: GCS = 'gcs',
25: GitHub = 'github',
26: None = 'none',
27: }
28:
29: /**
30: * Default versioning policy when no version argument is provided. ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/__tests__/config.test.ts</path>
<type>file</type>
<content>
1: import { describe, test, expect, vi, afterEach, beforeEach } from 'vitest';
2: import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from 'fs';
3: import { tmpdir } from 'os';
4: import { join } from 'path';
5: /**
6: * Tests of our ability to read craft config files. (This is NOT general test
7: * configuration).
8: */
9:
10: import {
11: getGitTagPrefix,
12: loadConfigurationFromString,
13: validateConfiguration,
14: setActiveWorkspace,
15: getActiveWorkspace,
16: getConfiguration,
17: getVersioningPolicy,
18: getWorkspaceNames,
19: WORKSPACES_MIN_VERSION,
20: } from '../config';
21: import { CraftProjectConfigSchema } from '../schemas/project_config';
22: import { logger } from '../logger';
23:
24: describe('validateConfiguration', () => {
25: test('parses minimal configuration', () => {
26: const data = { ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/__tests__/config.test.ts</path>
<type>file</type>
<content>
630: test('resolved config exposes the workspace targets (publish builder contract)', () => {
631: // Regression for the parse-time interaction: the `publish` builder reads
632: // getConfiguration().targets to compute --target choices. With a workspace
633: // selected up front, this must resolve to that workspace's targets and must
634: // not throw the "select a workspace" error.
635: setActiveWorkspace('cli');
636: const config = loadConfigurationFromString(WS_CONFIG);
637: expect(config.targets).toEqual([{ name: 'github', tagPrefix: 'cli@' }]);
638: });
639:
640: test('shallow-merges a workspace github owner/repo override', () => {
641: setActiveWorkspace('cli');
642: const config = loadConfigurationFromString(
643: [
644: `minVersion: ${WORKSPACES_MIN_VERSION}`,
645: 'workspaces:',
646: ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__tests__/publishState.test.ts</path>
<type>file</type>
<content>
1: import { describe, test, expect, beforeEach, afterEach } from 'vitest';
2: import { homedir } from 'os';
3: import { join } from 'path';
4:
5: import {
6: getCraftStateDir,
7: getPublishStateFilename,
8: getPublishStatePath,
9: } from '../publishState';
10:
11: describe('publishState', () => {
12: const savedEnv = { ...process.env };
13:
14: beforeEach(() => {
15: delete process.env.XDG_STATE_HOME;
16: });
17:
18: afterEach(() => {
19: process.env = { ...savedEnv };
20: });
21:
22: describe('getCraftStateDir', () => {
23: test('defaults to $HOME/.local/state/craft when XDG_STATE_HOME is unset', () => {
24: expect(getCraftStateDir()).toBe(
25: join(homedir(), '.local', 'state', 'craft'),
26: );
27: });
28:
29: test('honours XDG_STATE_HOME when set', () => {
30: ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/config.ts</path>
<type>file</type>
<content>
681: throw new ConfigurationError(
682: `Incompatible "craft" versions. Current version: ${currentVersionRaw}, minimal version: ${minVersionRaw} (taken from .craft.yml).`,
683: );
684: }
685: }
686:
687: /**
688: * Checks if the project's minVersion configuration meets a required minimum.
689: *
690: * This is used to gate features that require a certain version of craft.
691: * For example, auto-versioning requires minVersion >= 2.14.0.
692: *
693: * @param requiredVersion The minimum version required for the feature
694: * @returns true if the project's minVersion is >= requiredVersion, false otherwise
695: */
696: export function requiresMinVersion(requiredVersion: string): boolean {
697: const config = getConfiguration();
698: return isVersionGteMinVersion(config.minVersion, requiredVersion);
699: }
700:
701: /** Minimum craft version ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/prepare.ts</path>
<type>file</type>
<content>
760: }
761:
762: const latestTag = await getLatestTag(git, getGitTagPrefix());
763:
764: // Determine bump type - either from arg or from commit analysis
765: let bumpType: BumpType;
766: if (version === 'auto') {
767: const changelogResult = await getChangelogWithBumpType(git, latestTag);
768: validateBumpType(changelogResult);
769: bumpType = changelogResult.bumpType;
770: } else {
771: bumpType = version as BumpType;
772: }
773:
774: // Calculate new version from latest tag
775: const currentVersion = (latestTag && getVersion(latestTag)) || '0.0.0';
776:
777: const newVersion = calculateNextVersion(currentVersion, bumpType);
778: logger.info(
779: `Version bump: ${currentVersion} -> ${newVersion} (${bumpType} bump)`,
780: );
781: return newVersion;
782: }
783:
784: // ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/docs/publish-issue-format.md</path>
<type>file</type>
<content>
1: # Publish Issue Format
2:
3: The Publish workflow treats a publish issue as a release request. The title identifies
4: the release; the body supplies the merge target and selected targets. Do not edit the
5: title by hand unless it remains valid under this format.
6:
7: ## Title
8:
9: Every title starts with `publish: `. This EBNF is canonical:
10:
11: ```text
12: title = "publish: ", [ "getsentry/" ], repository, [ path ],
13: "@", version ;
14: repository = token, { token } ;
15: path = "/", path-segment, { "/", path-segment } ;
16: path-segment = token, { token } ;
17: version = version-character, { version-character } ;
18: token = ? ASCII letter, digit, ".", "_", or "-" ? ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-issue-title.peggy</path>
<type>file</type>
<content>
1: {
2: function join(characters) {
3: return characters.join("");
4: }
5: }
6:
7: // Canonical grammar for publish issue titles. A path suffix is syntactic only:
8: // the controller resolves the complete suffix as a workspace after checking
9: // out the CI-approved revision.
10: PublishIssueTitle
11: = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. {
12: return {
13: repo,
14: path: path || "",
15: version,
16: };
17: }
18:
19: Repository
20: = characters:RepositoryCharacter+ { return join(characters); }
21:
22: RepositoryCharacter
23: = [A-Za-z0-9_.-]
24:
25: Path
26: = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
27:
28: PathSegment
29: = characters:RepositoryCharacter+ { return join(characters); }
30:
31: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-issue-title.js</path>
<type>file</type>
<content>
1: /* eslint-disable */
2: // @generated by Peggy 5.1.0.
3: //
4: // https://peggyjs.org/
5:
6: "use strict";
7:
8: class peg$SyntaxError extends SyntaxError {
9: constructor(message, expected, found, location) {
10: super(message);
11: this.expected = expected;
12: this.found = found;
13: this.location = location;
14: this.name = "SyntaxError";
15: }
16:
17: format(sources) {
18: let str = "Error: " + this.message;
19: if (this.location) {
20: let src = null;
21: const st = sources.find((s) => s.source === this.location.source);
22: if (st) {
23: src = st.text.split(/\r\n|\n|\r/g);
24: }
25: const s = this.location.start;
26: const offset_s =
27: this.location.source &&
28: typeof this.location.source.offset === "function"
29: ? ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-location.js</path>
<type>file</type>
<content>
1: const core = require("@actions/core");
2: const { resolvePublishLocation } = require("../modules/publish-location");
3:
4: function resolveLocation() {
5: const input = JSON.parse(process.env.PUBLISH_ARGS || "");
6: const workspaceNames = JSON.parse(process.env.CRAFT_WORKSPACE_NAMES || "");
7:
8: if (!Array.isArray(workspaceNames)) {
9: throw new Error(
10: "Craft workspace discovery returned an invalid workspace list."
11: );
12: }
13:
14: core.setOutput(
15: "result",
16: resolvePublishLocation({
17: path: input.path,
18: workspaceNames,
19: })
20: );
21: }
22:
23: resolveLocation();
(End of file - total 23 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/ci-poller-input.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { join } from "path";
3:
4: import { expect, test } from "vitest";
5:
6: const { getCiPollerInput } = require("../ci-poller-input.js");
7:
8: const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
9: const issueBody = `Requested by: @byk
10:
11: Merge target: (default)
12:
13: Quick links:
14: - [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
15: - [View check runs](https://github.com/getsentry/toolkit/commit/${REVISION}/checks/)`;
16:
17: test("parses root and full-path publish titles", () => {
18: expect(
19: getCiPollerInput({
20: issueBody,
21: title: "publish: getsentry/toolkit/cli@1.2.3",
22: })
23: ).toEqual({
24: repo: "getsentry/toolkit",
25: revision: REVISION,
26: version: "1.2.3",
27: });
28:
29: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/details-from-context.js</path>
<type>file</type>
<content>
1: import { test, expect } from "vitest";
2:
3: const { detailsFromContext } = require("../details-from-context.js");
4:
5: const inputsArgs = {
6: context: {
7: repo: { owner: "getsentry", repo: "publish" },
8: payload: {
9: issue: {
10: number: "223",
11: title: "publish: getsentry/sentry@21.3.1",
12: body: `
13: Requested by: @BYK
14:
15: Merge target: custom-branch
16:
17: Quick links:
18: - [View changes](https://github.com/getsentry/sentry/compare/21.3.0...refs/heads/releases/21.3.1)
19: - [View check runs](https://github.com/getsentry/sentry/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)
20:
21: Assign the **accepted** label to this issue to approve the release. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/publish-location.js</path>
<type>file</type>
<content>
1: import { expect, test } from "vitest";
2:
3: const { resolvePublishLocation } = require("../publish-location.js");
4:
5: test("classifies an exact full workspace path without normalizing it", () => {
6: expect(
7: resolvePublishLocation({
8: path: "./packages/CLI",
9: workspaceNames: ["packages/cli", "packages/CLI"],
10: })
11: ).toStrictEqual({ path: ".", workspace: "packages/CLI" });
12: });
13:
14: test("keeps a non-workspace suffix as a checkout path", () => {
15: expect(
16: resolvePublishLocation({
17: path: "./packages",
18: workspaceNames: ["cli"],
19: })
20: ).toStrictEqual({ path: "./packages" });
21: });
22:
23: test("keeps a multi-segment suffix that is not an exact workspace path", () => {
24: expect(
25: resolvePublishLocation({
26: path: "./packages/cli",
27: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { spawnSync } from "child_process";
2: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
3: import { tmpdir } from "os";
4: import { join } from "path";
5:
6: import { afterEach, expect, test } from "vitest";
7:
8: const { resolvePublishLocation } = require("../publish-location.js");
9:
10: const temporaryDirectories = [];
11:
12: function getWorkflow() {
13: return readFileSync(
14: join(__dirname, "../../../.github/workflows/publish.yml"),
15: "utf8"
16: );
17: }
18:
19: function getSetTargetsScript() {
20: const workflow = getWorkflow();
21: const section = workflow.match(
22: / {6}- name: Set targets[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- uses: docker:\/\/getsentry\/craft:latest/
23: );
24: if (!section?.groups?.script) {
25: throw new Error("Missing Set targets workflow ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/ci-poller.yml</path> <type>file</type> <content> 1: name: CI Status Poller 2: 3: on: 4: schedule: 5: - cron: "*/5 * * * *" 6: workflow_dispatch: 7: inputs: 8: attempt: 9: description: Self-dispatch attempt counter (internal use) 10: required: false 11: default: "0" 12: 13: permissions: 14: contents: read 15: issues: read 16: 17: jobs: 18: check-ci: 19: runs-on: ubuntu-latest 20: environment: production 21: # Skip entirely (no runner provisioned) when there's nothing to check. 22: # Set to "true" by ci-pending.yml, reset to "false" here when done. 23: # Always allow workflow_dispatch for manual recovery. 24: if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch' 25: concurrency: 26: group: ci-status-poller 27: cancel-in-progress: false 28: steps: 29: # sentry-internal-app token ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/package.json</path>
<type>file</type>
<content>
1: {
2: "name": "publish",
3: "private": true,
4: "version": "0.0.1",
5: "description": "Approval-based publishing system for Sentry",
6: "main": "index.js",
7: "repository": "git@github.com:getsentry/publish.git",
8: "author": "Sentry Open Source <oss@sentry.io>",
9: "license": "Apache-2.0",
10: "volta": {
11: "node": "24.0.0",
12: "yarn": "1.22.22"
13: },
14: "resolutions": {
15: "undici": "^6.23.0"
16: },
17: "scripts": {
18: "generate": "node scripts/generate-publish-issue-title-parser.js",
19: "check:generated": "node scripts/generate-publish-issue-title-parser.js --check",
20: "test": "yarn check:generated && vitest run",
21: "test:watch": "vitest",
22: "lint": "eslint src .github --ignore-pattern '!.github'",
23: "prettier": "prettier --write src"
24: },
25: "devDependencies": {
26: "eslint": ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/scripts/generate-publish-issue-title-parser.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const path = require("path");
3: const peggy = require("peggy");
4: const prettier = require("prettier");
5:
6: const grammarPath = path.join(
7: __dirname,
8: "..",
9: "src",
10: "modules",
11: "publish-issue-title.peggy"
12: );
13: const outputPath = path.join(
14: __dirname,
15: "..",
16: "src",
17: "modules",
18: "publish-issue-title.js"
19: );
20: const grammar = fs.readFileSync(grammarPath, "utf8");
21: const parser = peggy.generate(grammar, {
22: format: "commonjs",
23: grammarSource: "publish-issue-title.peggy",
24: output: "source",
25: });
26:
27: const generatedParser = prettier.format(`/* eslint-disable */\n${parser}`, {
28: filepath: outputPath,
29: });
30:
31: if (process.argv.includes("--check")) {
32: const currentParser = fs.readFileSync(outputPath, "utf8");
33: ...
Found 44 matches
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/index.ts:
Line 20: import { setActiveWorkspace } from './config';
Line 99: setActiveWorkspace(extractWorkspaceSelection(argv));
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/config.ts:
Line 72: * (single implicit release unit). Set once via `setActiveWorkspace` from the
Line 84: export function setActiveWorkspace(name: string | undefined): void {
Line 124: const available = getWorkspaceNamesFromConfig(base, workspaceDirectory);
Line 201: function getWorkspaceNamesFromConfig(
Line 462: const available = getWorkspaceNamesFromConfig(
Line 614: export function getWorkspaceNames(): string[] {
Line 622: const workspaceNames = getWorkspaceNamesFromConfig(
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/workspace_cmds/__tests__/list.test.ts:
Line 4: getWorkspaceNames: vi.fn(),
Line 10: import { getWorkspaceNames } from ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/index.ts</path>
<type>file</type>
<content>
1: #!/usr/bin/env node
2: // Import Sentry instrumentation first, before any other code
3: import './instrument';
4:
5: import isCI from 'is-ci';
6: import yargs from 'yargs';
7:
8: import { logger, LogLevel } from './logger';
9: import {
10: sanitizeDynamicLinkerEnv,
11: warnIfCraftEnvFileExists,
12: } from './utils/env';
13: import {
14: envToBool,
15: setGlobals,
16: extractWorkspaceSelection,
17: } from './utils/helpers';
18: import { getPackageVersion } from './utils/version';
19: import { withTracing } from './utils/tracing';
20: import { setActiveWorkspace } from './config';
21:
22: // Commands
23: import * as prepare from './commands/prepare';
24: import * as publish from './commands/publish';
25: import * as targets from './commands/targets';
26: import * as config from './commands/config';
27: import * as artifacts from './commands/artifacts';
28: ...
Found 1 matches /home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/helpers.ts: Line 42: export function extractWorkspaceSelection(
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/helpers.ts</path>
<type>file</type>
<content>
1: import { appendFileSync, mkdirSync, writeFileSync } from 'fs';
2: import path from 'path';
3: import { parseArgs } from 'node:util';
4:
5: import prompts from 'prompts';
6: import { logger, LogLevel, setLevel } from '../logger';
7:
8: /**
9: * Maximum size (in bytes) for step output values passed through GITHUB_OUTPUT.
10: * Values exceeding this are truncated to avoid E2BIG errors when GitHub Actions
11: * expands them into environment variables for subsequent steps.
12: *
13: * 64 KB is well under the ~2 MB ARG_MAX kernel limit and also under GitHub's
14: * ~65 536-character issue body limit, so truncated changelogs still render. ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/package.json</path>
<type>file</type>
<content>
1: {
2: "name": "@sentry/craft",
3: "version": "2.31.0-dev.0",
4: "description": "The universal sentry workflow CLI",
5: "main": "dist/craft",
6: "repository": "https://github.com/getsentry/craft",
7: "author": "Sentry",
8: "license": "MIT",
9: "bin": {
10: "craft": "dist/craft",
11: "sentry-craft": "dist/craft"
12: },
13: "devDependencies": {
14: "@aws-sdk/client-lambda": "^3.984.0",
15: "@eslint/js": "^9.17.0",
16: "@google-cloud/storage": "^7.14.0",
17: "@octokit/plugin-retry": "^7.1.2",
18: "@octokit/request-error": "^7.0.0",
19: "@octokit/rest": "^21.0.2",
20: "@sentry/esbuild-plugin": "^2.23.0",
21: "@sentry/node": "^10.27.0",
22: "@types/async": "^3.0.1",
23: "@types/aws4": "^1.5.1",
24: "@types/cli-table": "^0.3.0",
25: "@types/git-url-parse": "^9.0.0",
26: "@types/is-ci": "^2.0.0",
27: ...
No files found
(no output)
M action.yml M docs/src/content/docs/targets/github.md M src/__tests__/action.test.ts M src/__tests__/config.test.ts M src/commands/prepare.ts M src/config.ts M src/schemas/project_config.ts M src/utils/__tests__/publishState.test.ts M src/utils/publishState.ts action.yml docs/src/content/docs/targets/github.md src/__tests__/action.test.ts src/__tests__/config.test.ts src/commands/prepare.ts src/config.ts src/schemas/project_config.ts src/utils/__tests__/publishState.test.ts src/utils/publishState.ts
M .github/workflows/publish.yml M docs/publish-issue-format.md M src/modules/__tests__/ci-poller-input.js M src/modules/__tests__/details-from-context.js M src/modules/__tests__/publish-location.js M src/modules/__tests__/publish-workflow.js M src/modules/ci-poller-input.js M src/modules/details-from-context.js M src/modules/publish-issue-title.js M src/modules/publish-issue-title.peggy M src/modules/publish-location.js M src/publish/resolve-location.js ?? src/modules/publish-issue-validation.js .github/workflows/publish.yml docs/publish-issue-format.md src/modules/__tests__/ci-poller-input.js src/modules/__tests__/details-from-context.js src/modules/__tests__/publish-location.js src/modules/__tests__/publish-workflow.js src/modules/ci-poller-input.js src/modules/details-from-context.js src/modules/publish-issue-title.js src/modules/publish-issue-title.peggy src/modules/publish-location.js src/publish/resolve-location.js
Found 1 matches /home/byk/Code/getsentry/craft-workspace-action-propagation/package.json: Line 49: "glob": "^11.0.0",
No MUST-FIX or CONCERN findings.
git diff --check passed in both worktrees. The final file lists match the initial lists; .github/workflows/cocoapods-keepalive.yml is absent. Generated-parser parity check passed with node scripts/generate-publish-issue-title-parser.js --check.
| Check | Grade | Evidence |
|---|---|---|
| 1. Craft glob validation, braces, POSIX paths, overlap, root, symlinks | PASS | Schema and runtime reject malformed/empty brace branches before globSync: src/schemas/project_config.ts:249-334, src/config.ts:231-390. Nested expansion, unsafe paths, overlap, remote root, and symlink containment have focused coverage: src/__tests__/config.test.ts:408-570. |
| 2. Craft Action input validation and titles | PASS | Validation is the first step and rejects unsafe paths, unsafe workspace segments, and non-root path plus workspace: action.yml:74-92. Root commands clear inherited state: action.yml:191-223. Titles retain the complete workspace suffix: action.yml:245-275; tests cover both: src/__tests__/action.test.ts:204-312. |
| 3. Publish parser, validation, CI authority, discovery, gate, --rev | PASS | Parser grammar and generated output agree: src/modules/publish-issue-title.peggy:7-32, src/modules/publish-issue-title.js:202-249. Controller and poller validate repository, version, and path before repo-derived API/checkout work: src/modules/details-from-context.js:31-50, src/modules/ci-poller-input.js:12-39. The exact SHA resolves before checkout/discovery: .github/workflows/publish.yml:134-182; the immutable link parser requires a 40-char SHA: src/modules/release-revision.js:1-20. Discovery uses exact case-sensitive matches and validates all output: src/modules/publish-location.js:1-50. The fresh ci-ready gate and --rev are present: .github/workflows/publish.yml:108-114,247-258. |
| 4. ...
Date: Sep 5, 2026 * 🔴 (01:25) User stated new Craft requests always include the checkout repository identity. * 🔴 (01:25) User stated a missing root `.craft.yml` always means checkout-path behavior. * 🔴 (01:25) User stated the controller never normalizes names. * 🟡 (01:25) Publish workflow diff removes the `requires_workspace_discovery` Node invocation from `.github/workflows/publish.yml` aro…
Date: Sep 5, 2026 * 🟡 [requested-read-only-audit] (01:21) User requested a COMPLETE evidence-based strict READ-ONLY audit of the current exact uncommitted trees `/home/byk/Code/getsentry/craft-workspace-action-propagation` and `/home/byk/Code/getsentry/publish-workspace-acceptance`; prohibited editing files, formatting, generating, mutating commands, and altering git state. * 🔴 (01:21) User req…