Dashboard › craft › Session 0c3Bh4hxzkdq
0c3Bh4hxzkdqsVC4BPerform a strict final READ-ONLY adversarial audit. Do not edit files or git state. Inspect complete current uncommitted diffs in BOTH:
Prior DO-NOT-MERGE blockers claimed fixed:
A) Publish detailsFromContext validates repository identities and release versions BEFORE workflow target checkout, state filename construction, and craft publish. Verify repo rejects empty/dot/dotdot/proto/leading-dash/non-token; version follows Craft-compatible complete semantic version behavior, permits known 4.2.6+sentry1, and rejects option-like/incomplete/path values. Verify parser/diagnostics/tests/docs.
B) Craft glob matches must not escape workspace base physically through symlink directories. Verify realpath containment occurs before admitting a directory; non-existent/racy matches fail closed; regular internal paths and supported globs remain correct. Verify an external symlink glob regression genuinely catches the old code.
Also audit all existing workspace contracts: exact full action title paths; path/workspace mutual exclusion; CI revision before checkout/discovery; exact suffix workspace matching and missing root config path fallback; all untrusted values rejected before side effects; glob/literal safety plus remote config root; fresh ci-ready gate; external scoped state and --rev; intentional path-only grammar; generated parser parity, docs, tests, and no formatter churn.
Return only severity-ordered findings with current exact file:line citations. Give PASS/CONCERN/MUST-FIX per contract and end exactly MERGE or DO-NOT-MERGE. No generic summary. Never return empty.
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation</path> <type>directory</type> <entries> .craft.yml .dockerignore .eslintcache .git .github/ .gitignore .lore.md .nojekyll .npmignore .prettierignore .prettierrc.yml .tsbuildinfo .vscode/ action.yml AGENTS.md blog-post-draft.md build.mjs CHANGELOG.md CONTRIBUTING.md dist/ Dockerfile docs/ eslint.config.mjs img/ LICENSE node_modules/ package.json pnpm-lock.yaml README.md src/ tsconfig.build.json tsconfig.json vitest.config.mts (33 entries) </entries>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance</path> <type>directory</type> <entries> .eslintrc.js .git .github/ .gitignore AGENTS.md auto-approve-repos.txt docs/ LICENSE node_modules/ package.json README.md scripts/ src/ vitest.config.js yarn.lock (15 entries) </entries>
M action.yml
M docs/src/content/docs/targets/github.md
M src/__tests__/action.test.ts
M src/__tests__/config.test.ts
M src/commands/prepare.ts
M src/config.ts
M src/schemas/project_config.ts
action.yml | 4 +-
docs/src/content/docs/targets/github.md | 20 ++--
src/__tests__/action.test.ts | 59 +++++++---
src/__tests__/config.test.ts | 175 +++++++++++++++++++++++++++++-
src/commands/prepare.ts | 3 +-
src/config.ts | 183 +++++++++++++++++++++++++++++---
src/schemas/project_config.ts | 20 ++++
7 files changed, 422 insertions(+), 42 deletions(-)
diff --git a/action.yml b/action.yml
index 94f3158..84377a8 100644
--- a/action.yml
+++ b/action.yml
@@ -81,8 +81,8 @@ runs:
echo "::error::The path and workspace inputs cannot be used together."
exit 1
fi
- if [[ -n "$WORKSPACE" ]] && ! node -e ...
M .github/workflows/publish.yml M docs/publish-issue-format.md M src/modules/__tests__/ci-poller-input.js M src/modules/__tests__/details-from-context.js M src/modules/__tests__/publish-location.js M src/modules/__tests__/publish-workflow.js M src/modules/details-from-context.js M src/modules/publish-issue-title.js M src/modules/publish-issue-title.peggy M src/modules/publish-location.js M src/publish/resolve-location.js .github/workflows/publish.yml | 7 +- docs/publish-issue-format.md | 56 +++---- src/modules/__tests__/ci-poller-input.js | 4 +- src/modules/__tests__/details-from-context.js | 219 ++++++------------------- src/modules/__tests__/publish-location.js | 94 +++++------ src/modules/__tests__/publish-workflow.js | 18 ++- src/modules/details-from-context.js | 47 +++--- src/modules/publish-issue-title.js | 225 +++----------------------- src/modules/publish-issue-title.peggy | ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/config.ts</path>
<type>file</type>
<content>
1: import { existsSync, lstatSync, readFileSync, realpathSync } from 'fs';
2: import path from 'path';
3: import { globSync, hasMagic } from 'glob';
4:
5: import { load } from 'js-yaml';
6: import GitUrlParse from 'git-url-parse';
7: import { createGitClient } from './utils/git';
8: import { ZodError } from 'zod';
9:
10: import { logger } from './logger';
11: import {
12: CraftProjectConfig,
13: CraftProjectConfigSchema,
14: GitHubGlobalConfig,
15: ArtifactProviderName,
16: StatusProviderName,
17: TargetConfig,
18: ChangelogPolicy,
19: VersioningPolicy,
20: Workspace,
21: } from './schemas/project_config';
22: import { ConfigurationError } from './utils/errors';
23: import { isCompiledGitHubAction } from './utils/detection';
24: import {
25: getPackageVersion,
26: parseVersion,
27: versionGreaterOrEqualThan,
28: SemVer,
29: } from ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/schemas/project_config.ts</path> <type>file</type> <content> 190: statusProvider: BaseStatusProviderSchema.optional(), 191: artifactProvider: BaseArtifactProviderSchema.optional(), 192: versioning: VersioningConfigSchema.optional(), 193: /** 194: * Do not merge the release branch after publishing. 195: * Defaults to true for compiled GitHub Actions (Node.js actions with dist/ folder). 196: */ 197: noMerge: z.boolean().optional(), 198: } as const; 199: 200: /** 201: * Configuration for a single named workspace (release unit). 202: * 203: * A workspace mirrors the release-relevant subset of the top-level config; 204: * every field is optional and inherits the top-level value when omitted. The 205: * `github` block is *partial* (all fields optional) so a workspace can override 206: * `owner` and/or `repo` while inheriting the rest from the top-level `github`. ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/action.yml</path>
<type>file</type>
<content>
1: name: 'Craft Prepare Release'
2: description: 'Prepare a new release using Craft'
3:
4: inputs:
5: version:
6: description: >
7: Version to release. Can be a semver string (e.g., "1.2.3"),
8: a bump type ("major", "minor", "patch"), or "auto" for automatic detection.
9: required: false
10: merge_target:
11: description: Target branch to merge into. Uses the default branch as a fallback. ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/action.yml</path>
<type>file</type>
<content>
170: echo "::error::Downloaded Craft binary is empty or missing"
171: exit 1
172: fi
173: fi
174:
175: - name: Craft Prepare
176: id: craft
177: shell: bash
178: env:
179: CRAFT_LOG_LEVEL: Debug
180: CRAFT_CONFIG_FROM_MERGE_TARGET: ${{ inputs.craft_config_from_merge_target }}
181: MERGE_TARGET: ${{ inputs.merge_target }}
182: VERSION: ${{ inputs.version }}
183: WORKSPACE: ${{ inputs.workspace }}
184: working-directory: ${{ inputs.path }}
185: run: |
186: # Ensure we have origin/HEAD set
187: git remote set-head origin --auto
188:
189: # Build command with optional flags
190: CRAFT_ARGS=()
191: if [[ "$CRAFT_CONFIG_FROM_MERGE_TARGET" == 'true' && -n "$MERGE_TARGET" ]]; then
192: CRAFT_ARGS=(--config-from ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/__tests__/config.test.ts</path>
<type>file</type>
<content>
1: import { describe, test, expect, vi, afterEach, beforeEach } from 'vitest';
2: import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from 'fs';
3: import { tmpdir } from 'os';
4: import { join } from 'path';
5: /**
6: * Tests of our ability to read craft config files. (This is NOT general test
7: * configuration).
8: */
9:
10: import {
11: getGitTagPrefix,
12: loadConfigurationFromString,
13: validateConfiguration,
14: setActiveWorkspace,
15: getActiveWorkspace,
16: getConfiguration,
17: getVersioningPolicy,
18: getWorkspaceNames,
19: WORKSPACES_MIN_VERSION,
20: } from '../config';
21: import { CraftProjectConfigSchema } from '../schemas/project_config';
22: import { logger } from '../logger';
23:
24: describe('validateConfiguration', () => {
25: test('parses minimal configuration', () => {
26: const data = { ...
Found 1 matches /home/byk/Code/getsentry/craft-workspace-action-propagation/package.json: Line 49: "glob": "^11.0.0",
Found 11 matches
/home/byk/Code/getsentry/craft-workspace-action-propagation/node_modules/glob/README.md:
Line 198: -f --follow Follow symlinked directories when expanding '**'
Line 522: > When `follow` and `nodir` are both set, then symbolic
Line 558: - `follow` Follow symlinked directories when expanding `**`
Line 562: By default, a `**` in a pattern will follow 1 symbolic link if
Line 564: first item in the pattern, following the same behavior as Bash.
Line 567: > When `follow` and `nodir` are both set, then symbolic
Line 683: The following characters have special magic meaning when used in
Line 714: `{follow:true}` is passed in the options object. A pattern
Line 717: or 0 if it is the first item, unless `follow:true` is set, in
Line 718: which case it follows all symbolic links.
Line 772: > setting `{follow:true}` in the options.
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/node_modules/glob/README.md</path> <type>file</type> <content> 540: `childrenIgnored(path)` methods, then these methods will be 541: called to determine whether any Path is a match or if its 542: children should be traversed, respectively. 543: 544: The `path` argument to the methods will be a 545: [`path-scurry`](https://isaacs.github.io/path-scurry/index.html) 546: [`Path`](https://isaacs.github.io/path-scurry/classes/PathBase) 547: object, which extends 548: [`fs.Dirent`](https://nodejs.org/docs/latest/api/fs.html#class-fsdirent) 549: with additional useful methods like 550: [`.fullpath()`](https://isaacs.github.io/path-scurry/classes/PathBase.html#fullpath), 551: [`.relative()`](https://isaacs.github.io/path-scurry/classes/PathBase.html#relative), 552: and more. 553: 554: > [!NOTE] 555: > `ignore` patterns are _always_ in `dot:true` mode, 556: > regardless of any other settings. ...
Found 100 matches (more matches available)
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/workspaces.ts:
Line 15: /** Information about a workspace package */
Line 25: /** Dependencies that are also workspace packages */
Line 26: workspaceDependencies: string[];
Line 29: /** Result of workspace discovery */
Line 31: /** The type of workspace manager detected */
Line 37: /** Structure of pnpm-workspace.yaml */
Line 45: workspaces?: string[] | { packages?: string[] };
Line 93: * Extract workspaces array from package.json workspaces field
Line 97: workspaces: string[] | { packages?: string[] } | undefined,
Line 99: if (!workspaces) {
Line 102: if (Array.isArray(workspaces)) {
Line 103: return workspaces;
Line 105: return workspaces.packages || [];
Line 115: // First: collect all workspace package names and locations
Line 116: const workspaceLocations: Array<{
Line 120: const workspaceNames = ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/helpers.ts</path>
<type>file</type>
<content>
1: import { appendFileSync, mkdirSync, writeFileSync } from 'fs';
2: import path from 'path';
3: import { parseArgs } from 'node:util';
4:
5: import prompts from 'prompts';
6: import { logger, LogLevel, setLevel } from '../logger';
7:
8: /**
9: * Maximum size (in bytes) for step output values passed through GITHUB_OUTPUT.
10: * Values exceeding this are truncated to avoid E2BIG errors when GitHub Actions
11: * expands them into environment variables for subsequent steps.
12: *
13: * 64 KB is well under the ~2 MB ARG_MAX kernel limit and also under GitHub's
14: * ~65 536-character issue body limit, so truncated changelogs still render. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/details-from-context.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const { isPublishPath } = require("./publish-location");
3:
4: /**
5: * Matches the entire "Targets" section of a github publish issue body.
6: */
7: const TARGETS_SECTION_PARSER_REGEX =
8: /^(?!### Targets$\s)(?: *- \[[ xX]\] \S+\s*$(?:\r?\n)?)+/m;
9:
10: /**
11: * Matches all targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
12: * The "id" of the targets is captured within a capture group.
13: */
14: const TARGETS_PARSER_REGEX = /^\s*- \[[ x]\] (\S+)/gim;
15:
16: /**
17: * Matches checked targets of a github publish issue body in a section that was already matched and extracted with `TARGETS_PARSER_REGEX`.
18: * The "id" of the targets is captured within a capture group. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-issue-title.peggy</path>
<type>file</type>
<content>
1: {
2: function join(characters) {
3: return characters.join("");
4: }
5: }
6:
7: // Canonical grammar for publish issue titles. A path suffix is syntactic only:
8: // the controller resolves the complete suffix as a workspace after checking
9: // out the CI-approved revision.
10: PublishIssueTitle
11: = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. {
12: return {
13: repo,
14: path: path || "",
15: version,
16: };
17: }
18:
19: Repository
20: = characters:RepositoryCharacter+ { return join(characters); }
21:
22: RepositoryCharacter
23: = [A-Za-z0-9_.-]
24:
25: Path
26: = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
27:
28: PathSegment
29: = characters:RepositoryCharacter+ { return join(characters); }
30:
31: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-location.js</path>
<type>file</type>
<content>
1: function resolvePublishLocation({ path, workspaceNames }) {
2: if (!isPublishPath(path)) {
3: throw new Error("Invalid publish path.");
4: }
5:
6: if (!workspaceNames.every(isWorkspaceName)) {
7: throw new Error(
8: "Craft workspace discovery returned an invalid workspace list."
9: );
10: }
11:
12: if (path === ".") {
13: return { path };
14: }
15:
16: const workspace = path.slice(2);
17: if (workspaceNames.includes(workspace)) {
18: return { path: ".", workspace };
19: }
20:
21: return { path };
22: }
23:
24: function isPublishPath(path) {
25: return (
26: typeof path === "string" &&
27: (path === "." ||
28: (path.startsWith("./") &&
29: path
30: .slice(2)
31: .split("/")
32: .every(isSafeWorkspaceSegment)))
33: );
34: }
35:
36: function ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-location.js</path>
<type>file</type>
<content>
1: const core = require("@actions/core");
2: const { resolvePublishLocation } = require("../modules/publish-location");
3:
4: function resolveLocation() {
5: const input = JSON.parse(process.env.PUBLISH_ARGS || "");
6: const workspaceNames = JSON.parse(process.env.CRAFT_WORKSPACE_NAMES || "");
7:
8: if (!Array.isArray(workspaceNames)) {
9: throw new Error(
10: "Craft workspace discovery returned an invalid workspace list."
11: );
12: }
13:
14: core.setOutput(
15: "result",
16: resolvePublishLocation({
17: path: input.path,
18: workspaceNames,
19: })
20: );
21: }
22:
23: resolveLocation();
(End of file - total 23 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/publish.yml</path>
<type>file</type>
<content>
1: name: Publish
2: on:
3: issues:
4: types: [labeled]
5:
6: concurrency:
7: # Use the issue title (e.g. "publish: getsentry/foo@1.2.3") so duplicate
8: # issues for the same repo@version share a concurrency group.
9: group: ${{ github.event.issue.title }}
10: cancel-in-progress: false
11:
12: permissions:
13: contents: read
14: issues: write
15: packages: write
16:
17: jobs:
18: # When accepted is added to a publish issue:
19: # - Add ci-pending (and remove ci-failed if retrying)
20: # - Enable the poller via CI_POLLER_HAS_PENDING=true
21: # - Comment on the issue
22: # - Trigger the poller immediately so we don't wait for the next cron tick
23: # The publish job below requires ci-ready, so it will not fire until the
24: # poller flips ci-pending → ci-ready (which also prevents publishing without
25: # CI ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/version.ts</path>
<type>file</type>
<content>
1: import { getGitTagPrefix } from '../config';
2:
3: /**
4: * Regular expression for matching semver versions.
5: *
6: * Modified to match version components
7: * Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
8: * @see https://github.com/sindresorhus/semver-regex
9: */
10: const semverRegex = () =>
11: /\bv?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-?([\da-z-]+(?:\.[\da-z-]+)*))?(?:\+([\da-z-]+(?:\.[\da-z-]+)*))?\b/gi;
12:
13: /**
14: * Extracts a version number from the given text.
15: *
16: * In case the version contains a leading "v", it is stripped from the result.
17: * All semantic versions are supported. See {@link http://semver.org/} for
18: * more information. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/inputs.js</path>
<type>file</type>
<content>
1: const github = require('@actions/github');
2: const core = require('@actions/core');
3: const { detailsFromContext } = require('../modules/details-from-context');
4:
5: async function inputs() {
6: const result = await detailsFromContext({
7: context: github.context,
8: });
9: core.setOutput('result', result);
10: }
11:
12:
13: inputs();
(End of file - total 13 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/details-from-context.js</path>
<type>file</type>
<content>
1: import { test, expect } from "vitest";
2:
3: const { detailsFromContext } = require("../details-from-context.js");
4:
5: const inputsArgs = {
6: context: {
7: repo: { owner: "getsentry", repo: "publish" },
8: payload: {
9: issue: {
10: number: "223",
11: title: "publish: getsentry/sentry@21.3.1",
12: body: `
13: Requested by: @BYK
14:
15: Merge target: custom-branch
16:
17: Quick links:
18: - [View changes](https://github.com/getsentry/sentry/compare/21.3.0...refs/heads/releases/21.3.1)
19: - [View check runs](https://github.com/getsentry/sentry/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)
20:
21: Assign the **accepted** label to this issue to approve the release. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/publish-workflow.js</path>
<type>file</type>
<content>
1: import { spawnSync } from "child_process";
2: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
3: import { tmpdir } from "os";
4: import { join } from "path";
5:
6: import { afterEach, expect, test } from "vitest";
7:
8: const { resolvePublishLocation } = require("../publish-location.js");
9:
10: const temporaryDirectories = [];
11:
12: function getWorkflow() {
13: return readFileSync(
14: join(__dirname, "../../../.github/workflows/publish.yml"),
15: "utf8"
16: );
17: }
18:
19: function getSetTargetsScript() {
20: const workflow = getWorkflow();
21: const section = workflow.match(
22: / {6}- name: Set targets[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- uses: docker:\/\/getsentry\/craft:latest/
23: );
24: if (!section?.groups?.script) {
25: throw new Error("Missing Set targets workflow ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/publishState.ts</path> <type>file</type> <content> 1: /** 2: * Helpers for locating Craft's publish-state file in a path that is NOT 3: * writable by the repository being published. 4: * 5: * Background: `craft publish` writes a small JSON file listing targets 6: * that have completed so a resumed run can skip them. Before this module 7: * existed, the file lived at `.craft-publish-<version>.json` in the 8: * project's cwd. That path is inside the repository checkout, so any 9: * committed file at the same path (or any earlier CI step) could 10: * pre-populate the "published" set and trick Craft into silently 11: * skipping targets. 12: * 13: * The file now lives under `$XDG_STATE_HOME/craft/` (falling back to 14: * `$HOME/.local/state/craft/`). The filename is keyed on 15: * owner, repo, a hash of cwd (to disambiguate monorepo subpaths), and 16: * the version being published. ...
Found 8 matches
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/index.ts:
Line 29: import * as workspace from './commands/workspace';
Line 92: // Resolve the active workspace BEFORE parsing. yargs runs command `builder`s
Line 94: // choices from config.targets) *before* middleware, so setting the workspace
Line 96: // config without a selection and fail. We therefore extract --workspace (or
Line 112: .command(workspace)
Line 126: .option('workspace', {
Line 129: 'Select a named workspace (release unit) from the configuration. ' +
Line 130: 'Required when the config defines "workspaces". Env: CRAFT_WORKSPACE',
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/workspace.ts</path>
<type>file</type>
<content>
1: import { Argv, CommandBuilder } from 'yargs';
2:
3: import * as list from './workspace_cmds/list';
4:
5: export const command = ['workspace <command>'];
6: export const description = 'Manage release workspaces';
7:
8: export const builder: CommandBuilder = (yargs: Argv) =>
9: yargs.demandCommand().command(list);
10:
11: export const handler = (): void => {
12: /* pass */
13: };
(End of file - total 13 lines)
</content>
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/workspace_cmds/list.ts</path>
<type>file</type>
<content>
1: import { getWorkspaceNames } from '../../config';
2: import { formatJson } from '../../utils/strings';
3:
4: export const command = ['list'];
5: export const description = 'List defined release workspaces as a JSON array';
6:
7: export function handler(): void {
8: console.log(formatJson(getWorkspaceNames()));
9: }
(End of file - total 9 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/publish/resolve-release-revision.js</path>
<type>file</type>
<content>
1: const core = require("@actions/core");
2: const { getReleaseRevision } = require("../modules/release-revision");
3:
4: function resolveReleaseRevision() {
5: const { repo } = JSON.parse(process.env.PUBLISH_ARGS || "");
6: core.setOutput(
7: "revision",
8: getReleaseRevision({
9: issueBody: process.env.PUBLISH_ISSUE_BODY || "",
10: repo,
11: })
12: );
13: }
14:
15: resolveReleaseRevision();
(End of file - total 15 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/release-revision.js</path>
<type>file</type>
<content>
1: const CHECK_RUNS_LINK =
2: /^Requested by: @[^\r\n]+\r?\n(?:[ \t]*\r?\n)?[ \t]*Merge target: [^\r\n]+\r?\n(?:[ \t]*\r?\n)?[ \t]*Quick links:\r?\n(?:[ \t]*\r?\n)?[ \t]*- \[View changes\]\([^\r\n]+\)\r?\n[ \t]*- \[View check runs\]\(https:\/\/github\.com\/getsentry\/(?<repo>[A-Za-z0-9_.-]+)\/commit\/(?<revision>[0-9a-f]{40})\/checks\/?\)(?=\r?\n|$)/;
3: const CHECK_RUNS_LINK_COUNT = /^[ \t]*- \[View check runs\]\(/gm;
4:
5: function getReleaseRevision({ issueBody, repo }) {
6: if ((issueBody.match(CHECK_RUNS_LINK_COUNT) || []).length !== 1) {
7: throw new Error(
8: `Expected exactly one View check runs link in Quick links for getsentry/${repo}.`
9: );
10: }
11:
12: const match = issueBody.match(CHECK_RUNS_LINK);
13: if (!match?.groups || match.groups.repo !== repo) {
14: throw new Error(
15: `Expected a View check runs link ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/__tests__/ci-poller-input.js</path>
<type>file</type>
<content>
1: import { readFileSync } from "fs";
2: import { join } from "path";
3:
4: import { expect, test } from "vitest";
5:
6: const { getCiPollerInput } = require("../ci-poller-input.js");
7:
8: const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
9: const issueBody = `Requested by: @byk
10:
11: Merge target: (default)
12:
13: Quick links:
14: - [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
15: - [View check runs](https://github.com/getsentry/toolkit/commit/${REVISION}/checks/)`;
16:
17: test("parses root and full-path publish titles", () => {
18: expect(
19: getCiPollerInput({
20: issueBody,
21: title: "publish: getsentry/toolkit/cli@1.2.3",
22: })
23: ).toEqual({
24: repo: "getsentry/toolkit",
25: revision: REVISION,
26: version: "1.2.3",
27: });
28:
29: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/ci-poller-input.js</path>
<type>file</type>
<content>
1: const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
2: const {
3: getReleaseRevision,
4: updateReleaseRevision,
5: } = require("./release-revision");
6:
7: function getCiPollerInput({ title, issueBody, revision }) {
8: let parsedTitle;
9: try {
10: parsedTitle = parsePublishIssueTitle(title);
11: } catch {
12: throw new Error(`Invalid publish issue title: '${title}'`);
13: }
14: const { repo, version } = parsedTitle;
15: const currentRevision = getReleaseRevision({ issueBody, repo });
16:
17: return {
18: ...(revision
19: ? { issueBody: updateReleaseRevision({ issueBody, repo, revision }) }
20: : {}),
21: repo: `getsentry/${repo}`,
22: revision: currentRevision,
23: version,
24: };
25: }
26:
27: module.exports = { getCiPollerInput };
(End of file - total 27 lines)
</content>
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/.github/workflows/ci-poller.yml</path> <type>file</type> <content> 1: name: CI Status Poller 2: 3: on: 4: schedule: 5: - cron: "*/5 * * * *" 6: workflow_dispatch: 7: inputs: 8: attempt: 9: description: Self-dispatch attempt counter (internal use) 10: required: false 11: default: "0" 12: 13: permissions: 14: contents: read 15: issues: read 16: 17: jobs: 18: check-ci: 19: runs-on: ubuntu-latest 20: environment: production 21: # Skip entirely (no runner provisioned) when there's nothing to check. 22: # Set to "true" by ci-pending.yml, reset to "false" here when done. 23: # Always allow workflow_dispatch for manual recovery. 24: if: vars.CI_POLLER_HAS_PENDING == 'true' || github.event_name == 'workflow_dispatch' 25: concurrency: 26: group: ci-status-poller 27: cancel-in-progress: false 28: steps: 29: # sentry-internal-app token ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/__tests__/action.test.ts</path>
<type>file</type>
<content>
1: import {
2: chmodSync,
3: mkdtempSync,
4: mkdirSync,
5: readFileSync,
6: rmSync,
7: writeFileSync,
8: } from 'fs';
9: import { tmpdir } from 'os';
10: import { join } from 'path';
11: import { spawnSync } from 'child_process';
12:
13: import { load } from 'js-yaml';
14: import { afterEach, expect, test } from 'vitest';
15:
16: interface ActionStep {
17: env?: Record<string, string>;
18: name?: string;
19: run?: string;
20: }
21:
22: function getActionSteps(): ActionStep[] {
23: const action = load(
24: readFileSync(join(__dirname, '../../action.yml'), 'utf8'),
25: ) as {
26: runs?: { steps?: ActionStep[] };
27: };
28: return action.runs?.steps || [];
29: }
30:
31: function getActionStep(name: string): ActionStep {
32: const step = getActionSteps().find(step => step.name === name);
33: if (!step?.run) {
34: ...
Found 7 matches /home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__fixtures__/workspaces/pnpm-workspace/packages/pkg-b/package.json: Line 3: "version": "1.0.0" /home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__fixtures__/workspaces/pnpm-workspace/packages/pkg-a/package.json: Line 3: "version": "1.0.0" /home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__fixtures__/workspaces/npm-workspace/packages/pkg-b/package.json: Line 3: "version": "1.0.0", /home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__fixtures__/workspaces/npm-workspace/packages/pkg-a/package.json: Line 3: "version": "1.0.0" /home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__fixtures__/workspaces/no-workspace/package.json: Line 3: "version": "1.0.0" /home/byk/Code/getsentry/craft-workspace-action-propagation/package.json: Line 3: "version": ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/prepare.ts</path>
<type>file</type>
<content>
750: // Handle automatic version detection or version bump types
751: if (version === 'auto' || isBumpType(version)) {
752: if (!requiresMinVersion(AUTO_VERSION_MIN_VERSION)) {
753: const featureName = isBumpType(version)
754: ? 'Version bump types'
755: : 'Auto-versioning';
756: throw new ConfigurationError(
757: `${featureName} requires minVersion >= ${AUTO_VERSION_MIN_VERSION} in .craft.yml. ` +
758: 'Please update your configuration or specify the version explicitly.',
759: );
760: }
761:
762: const latestTag = await getLatestTag(git, getGitTagPrefix());
763:
764: // Determine bump type - either from arg or from commit analysis
765: let bumpType: BumpType;
766: if (version === 'auto') {
767: const changelogResult = await getChangelogWithBumpType(git, latestTag);
768: ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/package.json</path>
<type>file</type>
<content>
1: {
2: "name": "publish",
3: "private": true,
4: "version": "0.0.1",
5: "description": "Approval-based publishing system for Sentry",
6: "main": "index.js",
7: "repository": "git@github.com:getsentry/publish.git",
8: "author": "Sentry Open Source <oss@sentry.io>",
9: "license": "Apache-2.0",
10: "volta": {
11: "node": "24.0.0",
12: "yarn": "1.22.22"
13: },
14: "resolutions": {
15: "undici": "^6.23.0"
16: },
17: "scripts": {
18: "generate": "node scripts/generate-publish-issue-title-parser.js",
19: "check:generated": "node scripts/generate-publish-issue-title-parser.js --check",
20: "test": "yarn check:generated && vitest run",
21: "test:watch": "vitest",
22: "lint": "eslint src .github --ignore-pattern '!.github'",
23: "prettier": "prettier --write src"
24: },
25: "devDependencies": {
26: "eslint": ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/docs/publish-issue-format.md</path>
<type>file</type>
<content>
1: # Publish Issue Format
2:
3: The Publish workflow treats a publish issue as a release request. The title identifies
4: the release; the body supplies the merge target and selected targets. Do not edit the
5: title by hand unless it remains valid under this format.
6:
7: ## Title
8:
9: Every title starts with `publish: `. This EBNF is canonical:
10:
11: ```text
12: title = "publish: ", [ "getsentry/" ], repository, [ path ],
13: "@", version ;
14: repository = token, { token } ;
15: path = "/", path-segment, { "/", path-segment } ;
16: path-segment = token, { token } ;
17: version = version-character, { version-character } ;
18: token = ? ASCII letter, digit, ".", "_", or "-" ? ...
ripgrep execution failed
No files found
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/node_modules/glob</path> <type>directory</type> <entries> dist/ LICENSE.md package.json README.md (4 entries) </entries>
Found 12 matches
/home/byk/Code/getsentry/craft-workspace-action-propagation/node_modules/glob/dist/commonjs/index.js:
Line 3: exports.glob = exports.sync = exports.iterate = exports.iterateSync = exports.stream = exports.streamSync = exports.Ignore = exports.hasMagic = exports.Glob = exports.unescape = exports.escape = void 0;
Line 18: Object.defineProperty(exports, "hasMagic", { enumerable: true, get: function () { return has_magic_js_2.hasMagic; } });
Line 63: hasMagic: has_magic_js_1.hasMagic,
/home/byk/Code/getsentry/craft-workspace-action-propagation/node_modules/glob/dist/commonjs/has-magic.js:
Line 3: exports.hasMagic = void 0;
Line 16: const hasMagic = (pattern, options = {}) => {
Line 21: if (new minimatch_1.Minimatch(p, options).hasMagic())
Line 26: exports.hasMagic = hasMagic;
/home/byk/Code/getsentry/craft-workspace-action-propagation/node_modules/glob/dist/esm/index.js:
Line 3: import { hasMagic } from './has-magic.js';
Line 6: ...
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/node_modules/glob/dist/commonjs/has-magic.js</path>
<type>file</type>
<content>
1: "use strict";
2: Object.defineProperty(exports, "__esModule", { value: true });
3: exports.hasMagic = void 0;
4: const minimatch_1 = require("minimatch");
5: /**
6: * Return true if the patterns provided contain any magic glob characters,
7: * given the options provided.
8: *
9: * Brace expansion is not considered "magic" unless the `magicalBraces` option
10: * is set, as brace expansion just turns one string into an array of strings.
11: * So a pattern like `'x{a,b}y'` would return `false`, because `'xay'` and
12: * `'xby'` both do not contain any magic glob characters, and it's treated the
13: * same as if you had called it on `['xay', 'xby']`. When `magicalBraces:true`
14: * is in the options, brace expansion _is_ treated as a pattern having magic.
15: */
16: const hasMagic = (pattern, options = {}) => {
17: if ...
Found 3 matches
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/publish.ts:
Line 180: .CRAFT_PUBLISH_STATE_GITHUB_REPO,
Line 191: 'CRAFT_PUBLISH_STATE_GITHUB_REPO must be a GitHub owner/repository pair.',
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/__tests__/publish.test.ts:
Line 209: ).toThrow('CRAFT_PUBLISH_STATE_GITHUB_REPO');
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/commands/publish.ts</path>
<type>file</type>
<content>
130: description: 'Do not check for build status',
131: type: 'boolean',
132: })
133: .option('no-git-checks', {
134: default: false,
135: description: 'Ignore local git changes and unsynchronized remotes',
136: type: 'boolean',
137: })
138: .check(checkVersion)
139: .demandOption('new-version', 'Please specify the version to publish');
140: };
141:
142: /** Command line options. */
143: export interface PublishOptions {
144: /** The git remote to use when pushing */
145: remote: string;
146: /** Revision to publish (can be commit, tag, etc.) */
147: rev?: string;
148: /** Target branch to merge the release into, auto detected when empty */
149: mergeTarget?: string;
150: /** One or more targets we want to publish */
151: target?: string | string[];
152: /** The new version to publish */
153: ...
/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__tests__/helpers.test.ts
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/utils/__tests__/helpers.test.ts</path>
<type>file</type>
<content>
1: import { existsSync, mkdirSync, readFileSync, rmSync } from 'fs';
2: import path from 'path';
3: import { tmpdir } from 'os';
4:
5: import { afterEach, beforeEach, describe, expect, test } from 'vitest';
6:
7: import {
8: disableChangelogMentions,
9: envToBool,
10: extractWorkspaceSelection,
11: MAX_STEP_OUTPUT_BYTES,
12: setGitHubActionsOutput,
13: truncateForOutput,
14: writeGitHubActionsFile,
15: } from '../helpers';
16:
17: describe('envToBool', () =>
18: test.each([
19: [undefined, false],
20: [null, false],
21: [false, false],
22: ['undefined', false],
23: ['null', false],
24: ['', false],
25: ['0', false],
26: ['no', false],
27: [true, true],
28: ['true', true],
29: [1, true],
30: ['1', true],
31: ['yes', true],
32: ['dogs are great!', true],
33: ])('From %j we ...
Found 1 matches /home/byk/Code/getsentry/craft-workspace-action-propagation/docs/src/content/docs/targets/github.md: Line 82: `CRAFT_WORKSPACE`:
File not found: /home/byk/Code/getsentry/craft-workspace-action-propagation/.github/workflows/ci.yml
<path>/home/byk/Code/getsentry/craft-workspace-action-propagation/src/index.ts</path>
<type>file</type>
<content>
80: */
81: async function main(): Promise<void> {
82: // Strip dynamic-linker env vars (LD_PRELOAD, DYLD_*, ...) before anything
83: // else so they cannot leak into subprocesses Craft spawns.
84: sanitizeDynamicLinkerEnv();
85:
86: printVersion();
87:
88: warnIfCraftEnvFileExists();
89:
90: const argv = fixGlobalBooleanFlags(process.argv.slice(2));
91:
92: // Resolve the active workspace BEFORE parsing. yargs runs command `builder`s
93: // (which may read the configuration, e.g. `publish` derives its --target
94: // choices from config.targets) *before* middleware, so setting the workspace
95: // via middleware would be too late — the builder would resolve/validate the
96: // config without a selection and fail. ...
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/scripts/generate-publish-issue-title-parser.js</path>
<type>file</type>
<content>
1: const fs = require("fs");
2: const path = require("path");
3: const peggy = require("peggy");
4: const prettier = require("prettier");
5:
6: const grammarPath = path.join(
7: __dirname,
8: "..",
9: "src",
10: "modules",
11: "publish-issue-title.peggy"
12: );
13: const outputPath = path.join(
14: __dirname,
15: "..",
16: "src",
17: "modules",
18: "publish-issue-title.js"
19: );
20: const grammar = fs.readFileSync(grammarPath, "utf8");
21: const parser = peggy.generate(grammar, {
22: format: "commonjs",
23: grammarSource: "publish-issue-title.peggy",
24: output: "source",
25: });
26:
27: const generatedParser = prettier.format(`/* eslint-disable */\n${parser}`, {
28: filepath: outputPath,
29: });
30:
31: if (process.argv.includes("--check")) {
32: const currentParser = fs.readFileSync(outputPath, "utf8");
33: ...
(no output)
M action.yml M docs/src/content/docs/targets/github.md M src/__tests__/action.test.ts M src/__tests__/config.test.ts M src/commands/prepare.ts M src/config.ts M src/schemas/project_config.ts
M .github/workflows/publish.yml M docs/publish-issue-format.md M src/modules/__tests__/ci-poller-input.js M src/modules/__tests__/details-from-context.js M src/modules/__tests__/publish-location.js M src/modules/__tests__/publish-workflow.js M src/modules/details-from-context.js M src/modules/publish-issue-title.js M src/modules/publish-issue-title.peggy M src/modules/publish-location.js M src/publish/resolve-location.js
<path>/home/byk/Code/getsentry/publish-workspace-acceptance/src/modules/publish-issue-title.js</path>
<type>file</type>
<content>
200: let peg$startRuleFunction = peg$parsePublishIssueTitle;
201:
202: const peg$c0 = "publish: ";
203: const peg$c1 = "getsentry/";
204: const peg$c2 = "@";
205: const peg$c3 = "/";
206:
207: const peg$r0 = /^[A-Za-z0-9_.\-]/;
208: const peg$r1 = /^[A-Za-z0-9_.+\-]/;
209:
210: const peg$e0 = peg$literalExpectation("publish: ", false);
211: const peg$e1 = peg$literalExpectation("getsentry/", false);
212: const peg$e2 = peg$literalExpectation("@", false);
213: const peg$e3 = peg$anyExpectation();
214: const peg$e4 = peg$classExpectation(
215: [["A", "Z"], ["a", "z"], ["0", "9"], "_", ".", "-"],
216: false,
217: false,
218: false
219: );
220: const peg$e5 = peg$literalExpectation("/", false);
221: const peg$e6 = peg$classExpectation(
222: [["A", "Z"], ["a", "z"], ["0", "9"], "_", ".", "+", "-"],
223: ...
MUST-FIX — action path can escape before validation. With an empty workspace, Validate workspace accepts any PATH_INPUT; the next step runs from that path and mutates Git before Publish validates the eventual title. This violates rejection-before-side-effects. [action.yml:80-87] [action.yml:184-187] [action.yml:238-268]
MUST-FIX — ambient CRAFT_WORKSPACE breaks workspace identity propagation. The action only considers inputs.workspace; when it is empty, it omits --workspace and titles a root release. Craft then selects the inherited CRAFT_WORKSPACE environment value, so prepare/targets can use a workspace while the controller resolves and publishes root state. [action.yml:179-204] [action.yml:210-218] [action.yml:241-268] [src/utils/helpers.ts:46-71] [src/index.ts:92-99]
MUST-FIX — the CI poller accepts unsafe repository/version title components before authenticated API calls. It uses only the permissive grammar result, unlike detailsFromContext’s semantic checks, then interpolates repo into release-bot API endpoints. An accepted publish: getsentry/.@--config issue can reach this path. [src/modules/ci-poller-input.js:7-24] [src/modules/publish-issue-title.peggy:19-32] [src/modules/details-from-context.js:35-40] [.github/workflows/ci-poller.yml:61-76] [.github/workflows/ci-poller.yml:114-167]
CONCERN — A’s regression matrix omits explicitly required empty and non-token repository cases. It covers leading dash, dot, dotdot, and __proto__, but not getsentry/@… or a non-token repository. [src/modules/__tests__/details-from-context.js:177-212]
PASS — A controller validation and ordering. The parser requires a nonempty token repository; detailsFromContext rejects unsafe repository identities and validates Craft-compatible complete versions before target checkout, state construction, and craft publish. Build metadata is covered. [src/modules/publish-issue-title.peggy:11-32] ...
Date: Sep 4, 2026 * 🔴 (12:08) User stated that action publish titles always carry the full concrete workspace path. * 🟡 (12:08) Tool inspection listed `/home/byk/Code/getsentry/craft-workspace-action-propagation` as a 33-entry directory containing `.craft.yml`, `.github/`, `action.yml`, `AGENTS.md`, `docs/`, `dist/`, `node_modules/`, `package.json`, `pnpm-lock.yaml`, `README.md`, `src/`, `tscon…
Date: Sep 4, 2026 * 🔴 (12:07) User directive: Never return empty. * 🔴 [requested-read-only-audit] (12:07) User requested a strict final READ-ONLY adversarial audit; instructed not to edit files or git state. * 🔴 (12:07) User specified audit targets: `/home/byk/Code/getsentry/craft-workspace-action-propagation` and `/home/byk/Code/getsentry/publish-workspace-acceptance`; requested inspection of…