Dashboard › spotlight › Session s35d132b2bdf
s35d132b2bdf690f7completed success Release Release main workflow_dispatch 27308967325 29s 2026-06-10T21:56:46Z completed success Release Release main workflow_dispatch 26970327939 34s 2026-06-04T18:06:44Z completed success Release Release main workflow_dispatch 25918051244 32s 2026-05-15T12:35:02Z === watch latest release run === run id: 27308967325 ✓ main Release · 27308967325 Triggered via workflow_dispatch less than a minute ago JOBS ✓ Release a new version in 25s (ID 80674085670) ANNOTATIONS ! Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/create-github-app-token@v2.2.1, pnpm/action-setup@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment ...
The Release workflow completed successfully and created a publish request in the Sentry publish repository. This follows their standard release process where craft prepare sets up the release branch and version changes, then a maintainer needs to approve it by adding a label to trigger the actual publish to npm, Docker, and GitHub.
Now I need to verify the release branch was created properly with the version bump and changelog, check that CI passes on that branch, and then add the accepted label to issue #8526 to complete the publish.
craft prepare succeeded and opened a publish request: getsentry/publish#8526. This is the Sentry flow — the release branch + changelog/version bump were created, and publishing completes when the accepted label is added to that issue. Let me verify the release branch, version, and the publish issue.
=== changelog diff on release commit ===
* [new branch] release/4.11.6 -> origin/release/4.11.6
commit fc7a46de68a13f390d51a90c0ec488118d7293ed
Author: BYK <126780+BYK@users.noreply.github.com>
Date: Wed Jun 10 21:57:08 2026 +0000
release: 4.11.6
packages/spotlight/CHANGELOG.md | 10 ++++++++++
packages/spotlight/package.json | 6 ++++--
2 files changed, 14 insertions(+), 2 deletions(-)
=== CHANGELOG 4.11.6 section ===
# @spotlightjs/spotlight
## 4.11.6
### Security 🔒
- (deps) Resolve 5 open dependabot alerts (shell-quote, hono) by @BYK in [#1321](https://github.com/getsentry/spotlight/pull/1321)
### Other
- Fix path stacking in sidebar and detail tabs (React Router v7 splat routes) by @zhiyan114 in [#1320](https://github.com/getsentry/spotlight/pull/1320)
## 4.11.5
### Security 🔒
#### Deps
- Add react-router override for open redirect (#273) by @BYK in [#1317](https://github.com/getsentry/spotlight/pull/1317)
- Resolve 6 open dependabot alerts by @BYK in ...
Looking at the release commit fc7a46d for version 4.11.6, I see it updated the CHANGELOG with two entries — a security fix (#1321) and another item (#1320) credited to @zhiyan114. My PR #1320 ended up categorized under "Other" since the squash commit message didn't follow the conventional fix: prefix format, even though the PR title itself was more specific.
Now I need to verify the CI passes on that release commit and then add the accepted label to the publish issue #8526 to kick off the release process. Let me check the build workflow status for fc7a46d.
The release: 4.11.6 commit bumped the version and changelog (with #1321 under Security and #1320 credited to @zhiyan114). Now let me verify CI is green on the release branch before approving the publish.
=== check runs on release commit fc7a46d ===
{"conclusion":"success","name":"JUnit Test Report","status":"completed"}
{"conclusion":"success","name":"Vercel Preview Comments","status":"completed"}
{"conclusion":"success","name":"Unit Tests (24)","status":"completed"}
{"conclusion":"success","name":"Unit Tests (20)","status":"completed"}
{"conclusion":"success","name":"Unit Tests (22)","status":"completed"}
{"conclusion":null,"name":"Build","status":"in_progress"}
=== workflow runs for release branch ===
in_progress release: 4.11.6 Build & Test release/4.11.6 push 27308989003 1m17s 2026-06-10T21:57:12Z
The Build & Test workflow on the release branch is still running and needs to complete successfully first—it's generating the npm package, spotlight binaries, and electron binaries that the publish step will need. I can't add the accepted label to trigger publishing until those artifacts are ready.
Release-branch CI is running (Build & Test builds the npm/binary/electron artifacts that craft will publish). I must wait for it to fully pass before approving. Let me watch it.
! Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4, mikepenz/action-junit-report@cf701569b05ccdd861a76b8607a66d76f6fd4857, pnpm/action-setup@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/ Unit Tests (24): .github#2 ! Failed to report status 'codecov/patch': Resource not accessible by integration - ...
Please address this message and continue with your tasks. </system-reminder>
The user mentioned I don't need to wait for CI on the release branch—I can just add the accepted label and the publish system will handle it automatically. The Build & Test run actually completed successfully anyway, but either way, I should add the accepted label to getsentry/publish#8526.
Understood — the publish bot waits for the build itself. Let me add the accepted label to the publish issue to approve the release.
https://github.com/getsentry/publish/issues/8526
=== confirm label ===
{"labels":["accepted"],"state":"OPEN"}
I've added the accepted label, which triggers the publish system to wait for the release branch CI and artifacts before running craft publish to deploy to npm, GitHub, and Docker registries. The issue will close automatically once publishing finishes. I could check back to verify the publish completes, but the system handles this automatically, so I'll give a brief status update and optionally follow up on the issue afterward.
The accepted label is applied to getsentry/publish#8526. The publish bot will now wait for the release-branch build artifacts and then run craft publish to all targets (npm, GitHub release, docker versioned + latest), closing the issue when done.
[
{
"content": "Self-review + address review findings",
"status": "completed",
"priority": "high"
},
{
"content": "Resolve merge conflicts + merge PR #1320",
"status": "completed",
"priority": "high"
},
{
"content": "Trigger craft Release workflow (auto → 4.11.6)",
"status": "completed",
"priority": "high"
},
{
"content": "Approve publish: add `accepted` label to getsentry/publish#8526",
"status": "completed",
"priority": "high"
},
{
"content": "Confirm publish completes (issue closes, targets published)",
"status": "in_progress",
"priority": "medium"
}
]
Release 4.11.6 is cut and approved. Summary of the release flow:
craft prepare (Release workflow run 27308967325) → created branch release/4.11.6, commit fc7a46d bumping the version + changelog, and opened publish request getsentry/publish#8526.accepted label to #8526 → the publish bot will wait for the build artifacts and then craft publish to npm, GitHub release (@spotlightjs/spotlight@4.11.6), and docker (versioned + latest), auto-closing the issue when done.Nothing more is required from you — the publish completes automatically once the release build finishes. Want me to keep an eye on #8526 and confirm once all four targets are published, or wrap up here?
original is Mach-O signed: true size: 108619024 inject SUCCEEDED after inject, signature still present: false size: 107541216
The postject injection actually succeeded on the signed binary without throwing an error, but it removed the code signature in the process—the file size decreased from 108.6 MB to 107.5 MB, and postject stripped out the LC_CODE_SIGNATURE load command entirely. So postject actually handles the signature removal itself during injection — it strips the existing code signature cleanly rather than corrupting it, which means fossilize's pre-injection unsign() step might be partially redundant for signature removal, though it's still done to ensure a clean binary and follow Node SEA recommendations. This changes the answer to the user's question: postject doesn't require an unsigned binary as input and doesn't leave a corrupt signature behind; it actively removes the old signature during the injection process. ...