From 33de3f1df5bdb9a6a480e9217d566df7b5a48b8e Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 26 Aug 2026 14:15:22 +0000
Subject: [PATCH 1/3] feat: accept workspace publish requests

---
 .github/workflows/publish.yml                 |  27 ++-
 src/modules/__tests__/details-from-context.js | 212 +++++++++++++++++-
 src/modules/__tests__/publish-workflow.js     |  82 +++++++
 src/modules/__tests__/update-issue.js         |  15 +-
 src/modules/details-from-context.js           |  27 ++-
 src/modules/update-issue.js                   |  54 +++--
 6 files changed, 377 insertions(+), 40 deletions(-)
 create mode 100644 src/modules/__tests__/publish-workflow.js

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cff6bc3..c283b79 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -184,12 +184,14 @@ jobs:
           fetch-depth: 0
 
       - name: Set targets
+        id: craft-state
         shell: bash
         if: fromJSON(steps.inputs.outputs.result).targets
         env:
           CRAFT_PUBLISH_REPO: ${{ fromJSON(steps.inputs.outputs.result).repo }}
           CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.inputs.outputs.result).path }}
           CRAFT_PUBLISH_VERSION: ${{ fromJSON(steps.inputs.outputs.result).version }}
+          CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.inputs.outputs.result).workspace || '' }}
           CRAFT_PUBLISH_TARGETS_JSON: ${{ toJSON(fromJSON(steps.inputs.outputs.result).targets) }}
         run: |
           # Render the "already published" JSON.
@@ -209,22 +211,26 @@ jobs:
           # __repo__/<path>` and Node's process.cwd() canonicalisation,
           # the cwd is `/github/workspace/__repo__` (root) or
           # `/github/workspace/__repo__/subdir/...` (monorepo).
-          case "$CRAFT_PUBLISH_PATH" in
-            .|./) container_cwd="/github/workspace/__repo__" ;;
-            ./*) container_cwd="/github/workspace/__repo__/${CRAFT_PUBLISH_PATH#./}" ;;
-            *)   container_cwd="/github/workspace/__repo__/${CRAFT_PUBLISH_PATH}" ;;
-          esac
-          # Strip any trailing slash to match Node's canonicalisation.
-          container_cwd="${container_cwd%/}"
+          container_cwd="$(realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH")"
+          if [[ "$container_cwd" != "/github/workspace/__repo__" && "$container_cwd" != /github/workspace/__repo__/* ]]; then
+            echo "::error::Publish path must remain inside the target checkout."
+            exit 1
+          fi
           cwd_hash="$(printf %s "$container_cwd" | sha1sum | cut -c1-12)"
           sanitise() { printf %s "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9._-]\+/_/g; s/^_\+//; s/_\+$//'; }
           owner_sanitised="$(sanitise getsentry)"
           repo_sanitised="$(sanitise "$CRAFT_PUBLISH_REPO")"
           version_sanitised="$(sanitise "$CRAFT_PUBLISH_VERSION")"
+          workspace_prefix=""
+          if [[ -n "$CRAFT_PUBLISH_WORKSPACE" ]]; then
+            workspace_encoded="$(printf %s "$CRAFT_PUBLISH_WORKSPACE" | base64 -w 0 | tr '+/' '-_' | tr -d '=')"
+            workspace_prefix="workspace-${workspace_encoded}-"
+          fi
           state_dir="$GITHUB_WORKSPACE/.craft-state/craft"
-          state_file="$state_dir/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json"
+          state_file="$state_dir/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${workspace_prefix}${version_sanitised}.json"
           mkdir -p "$state_dir"
           printf %s "$payload" > "$state_file"
+          echo "state_file=$state_file" >> "$GITHUB_OUTPUT"
           echo "Wrote state file: $state_file"
 
       - uses: docker://getsentry/craft:latest
@@ -246,6 +252,10 @@ jobs:
           CRAFT_MERGE_TARGET: ${{ fromJSON(steps.inputs.outputs.result).merge_target }}
           CRAFT_LOG_LEVEL: ${{ vars.CRAFT_LOG_LEVEL || 'Info' }}
           CRAFT_DRY_RUN: ${{ fromJSON(steps.inputs.outputs.result).dry_run }}
+          CRAFT_WORKSPACE: ${{ fromJSON(steps.inputs.outputs.result).workspace || '' }}
+          # State must follow the issue checkout identity, not a workspace's
+          # optional GitHub release-repository override.
+          CRAFT_PUBLISH_STATE_GITHUB_REPO: getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }}
           GIT_COMMITTER_NAME: sentry-release-bot[bot]
           GIT_AUTHOR_NAME: sentry-release-bot[bot]
           EMAIL: 180476844+sentry-release-bot[bot]@users.noreply.github.com
@@ -287,6 +297,7 @@ jobs:
         if: ${{ cancelled() || failure() }}
         env:
           PUBLISH_ARGS: ${{ steps.inputs.outputs.result }}
+          CRAFT_STATE_FILE_PATH: ${{ steps.craft-state.outputs.state_file }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: node .__publish__/src/publish/update-issue.js
 
diff --git a/src/modules/__tests__/details-from-context.js b/src/modules/__tests__/details-from-context.js
index e6411c5..5b1ccdb 100644
--- a/src/modules/__tests__/details-from-context.js
+++ b/src/modules/__tests__/details-from-context.js
@@ -36,7 +36,7 @@ Assign the **accepted** label to this issue to approve the release.
 
 test("parse inputs", async () => {
   const result = await detailsFromContext(inputsArgs);
-  expect(result).toEqual({
+  expect(result).toStrictEqual({
     dry_run: "",
     merge_target: "custom-branch",
     path: ".",
@@ -91,7 +91,7 @@ Assign the **accepted** label to this issue to approve the release.
 
 test("Do not extract merge_target value if its a default value", async () => {
   const result = await detailsFromContext(defaultTargetInputsArgs);
-  expect(result).toEqual({
+  expect(result).toStrictEqual({
     dry_run: "",
     merge_target: "",
     path: ".",
@@ -101,6 +101,214 @@ test("Do not extract merge_target value if its a default value", async () => {
   });
 });
 
+test("parses a human-readable workspace from the title", async () => {
+  const result = await detailsFromContext({
+    context: {
+      repo: { owner: "getsentry", repo: "publish" },
+      payload: {
+        issue: {
+          number: "123",
+          title: 'publish: getsentry/toolkit [workspace: "cli/v2"] @1.2.3',
+          body: "Requested by: @example",
+          labels: [],
+        },
+      },
+    },
+  });
+
+  expect(result).toMatchObject({
+    repo: "toolkit",
+    version: "1.2.3",
+    workspace: "cli/v2",
+  });
+});
+
+test("parses escaped workspace characters from the title", async () => {
+  const result = await detailsFromContext({
+    context: {
+      repo: { owner: "getsentry", repo: "publish" },
+      payload: {
+        issue: {
+          number: "123",
+          title:
+            'publish: getsentry/toolkit [workspace: "cli [preview] \\"next\\""] @1.2.3',
+          body: "Requested by: @example",
+          labels: [],
+        },
+      },
+    },
+  });
+
+  expect(result.workspace).toBe('cli [preview] "next"');
+});
+
+test("parses a safe Unicode workspace from the title", async () => {
+  const result = await detailsFromContext({
+    context: {
+      repo: { owner: "getsentry", repo: "publish" },
+      payload: {
+        issue: {
+          number: "123",
+          title:
+            'publish: getsentry/toolkit [workspace: "cli-\u65e5\u672c\u8a9e"] @1.2.3',
+          body: "Requested by: @example",
+          labels: [],
+        },
+      },
+    },
+  });
+
+  expect(result.workspace).toBe("cli-\u65e5\u672c\u8a9e");
+});
+
+test("rejects a legacy title with an unexpected space before its version", async () => {
+  const fn = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title: "publish: getsentry/toolkit @1.2.3",
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+
+  await expect(fn).rejects.toThrow("Invalid publish issue title");
+});
+
+test("rejects an empty or unsafe Unicode workspace", async () => {
+  const emptyWorkspace = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title: 'publish: getsentry/toolkit [workspace: ""] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+  const multilineWorkspace = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title:
+              'publish: getsentry/toolkit [workspace: "cli\\nnext"] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+  const nulWorkspace = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title: 'publish: getsentry/toolkit [workspace: "\\u0000"] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+  const tabWorkspace = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title:
+              'publish: getsentry/toolkit [workspace: "cli\\tnext"] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+  const bidiWorkspace = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title:
+              'publish: getsentry/toolkit [workspace: "cli\\u202enext"] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+  const lineSeparatorWorkspace = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title:
+              'publish: getsentry/toolkit [workspace: "cli\\u2028next"] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+  const paragraphSeparatorWorkspace = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title:
+              'publish: getsentry/toolkit [workspace: "cli\\u2029next"] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+
+  await expect(emptyWorkspace).rejects.toThrow(
+    "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"
+  );
+  await expect(multilineWorkspace).rejects.toThrow(
+    "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"
+  );
+  await expect(nulWorkspace).rejects.toThrow(
+    "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"
+  );
+  await expect(tabWorkspace).rejects.toThrow(
+    "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"
+  );
+  await expect(bidiWorkspace).rejects.toThrow(
+    "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"
+  );
+  await expect(lineSeparatorWorkspace).rejects.toThrow(
+    "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"
+  );
+  await expect(paragraphSeparatorWorkspace).rejects.toThrow(
+    "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"
+  );
+});
+
+test("rejects a path that escapes the target checkout", async () => {
+  const fn = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title: "publish: getsentry/toolkit/../other@1.2.3",
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+
+  await expect(fn).rejects.toThrow("Invalid publish issue path");
+});
+
 test("throw error when context is missing the issue payload", async () => {
   const fn = () => detailsFromContext({ context: {} });
   await expect(fn).rejects.toThrow("Issue context is not defined");
diff --git a/src/modules/__tests__/publish-workflow.js b/src/modules/__tests__/publish-workflow.js
new file mode 100644
index 0000000..e29085c
--- /dev/null
+++ b/src/modules/__tests__/publish-workflow.js
@@ -0,0 +1,82 @@
+import { spawnSync } from "child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+
+import { afterEach, expect, test } from "vitest";
+
+const temporaryDirectories = [];
+
+function getSetTargetsScript() {
+  const workflow = readFileSync(
+    join(__dirname, "../../../.github/workflows/publish.yml"),
+    "utf8"
+  );
+  const section = workflow.match(
+    / {6}- name: Set targets[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- uses: docker:\/\/getsentry\/craft:latest/
+  );
+  if (!section?.groups?.script) {
+    throw new Error("Missing Set targets workflow script");
+  }
+  return section.groups.script.replace(/^ {10}/gm, "");
+}
+
+function runSetTargets({ path, repo, version, workspace = "" }) {
+  const directory = mkdtempSync(join(tmpdir(), "publish-workflow-test-"));
+  temporaryDirectories.push(directory);
+  const output = join(directory, "github-output");
+  writeFileSync(output, "");
+
+  const result = spawnSync("bash", ["-e", "-c", getSetTargetsScript()], {
+    env: {
+      ...process.env,
+      CRAFT_PUBLISH_PATH: path,
+      CRAFT_PUBLISH_REPO: repo,
+      CRAFT_PUBLISH_TARGETS_JSON: '["github"]',
+      CRAFT_PUBLISH_VERSION: version,
+      CRAFT_PUBLISH_WORKSPACE: workspace,
+      GITHUB_OUTPUT: output,
+      GITHUB_WORKSPACE: directory,
+    },
+    encoding: "utf8",
+  });
+
+  expect(result.status, result.stderr).toBe(0);
+  const stateFile = readFileSync(output, "utf8")
+    .trim()
+    .replace("state_file=", "");
+  return { stateFile, state: readFileSync(stateFile, "utf8") };
+}
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test("uses Craft's legacy root state filename", () => {
+  const { stateFile, state } = runSetTargets({
+    path: ".",
+    repo: "sentry",
+    version: "21.3.1",
+  });
+
+  expect(stateFile).toMatch(
+    /\.craft-state\/craft\/publish-state-getsentry-sentry-c232c383e26f-21\.3\.1\.json$/
+  );
+  expect(JSON.parse(state)).toEqual({ published: { github: true } });
+});
+
+test("matches Craft's workspace state filename for a monorepo release", () => {
+  const { stateFile, state } = runSetTargets({
+    path: "./cli",
+    repo: "toolkit",
+    version: "1.2.3",
+    workspace: "cli",
+  });
+
+  expect(stateFile).toMatch(
+    /\.craft-state\/craft\/publish-state-getsentry-toolkit-21cf7beaeda4-workspace-Y2xp-1\.2\.3\.json$/
+  );
+  expect(JSON.parse(state)).toEqual({ published: { github: true } });
+});
diff --git a/src/modules/__tests__/update-issue.js b/src/modules/__tests__/update-issue.js
index 954ef51..bc17165 100644
--- a/src/modules/__tests__/update-issue.js
+++ b/src/modules/__tests__/update-issue.js
@@ -42,6 +42,8 @@ const updateTargetsArgs = {
 
 beforeAll(() => {
   process.env.GITHUB_WORKSPACE = ".";
+  process.env.CRAFT_STATE_FILE_PATH =
+    ".craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json";
   mockExistsSync = vi.spyOn(fs, "existsSync");
   vi.spyOn(fs.promises, "readFile").mockResolvedValue(
     JSON.stringify({ published: { lol: true, hey: false, github: true } })
@@ -75,9 +77,9 @@ describe.each([false, true])("state file exists: %s", (stateFileExists) => {
     mockExistsSync.mockReturnValue(stateFileExists);
     await updateIssue(updateTargetsArgs);
     expect(mockExistsSync).toHaveBeenCalledTimes(1);
-    // This is process.env.GITHUB_WORKSPACE + / filename
+    // This path comes from the workflow's secure state-file step output.
     expect(mockExistsSync).toHaveBeenCalledWith(
-      "./__repo__/.craft-publish-21.3.1.json"
+      ".craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json"
     );
   });
 
@@ -129,6 +131,15 @@ describe.each([false, true])("state file exists: %s", (stateFileExists) => {
   });
 });
 
+test("does not read a state file when target setup was skipped", async () => {
+  delete process.env.CRAFT_STATE_FILE_PATH;
+  mockExistsSync.mockClear();
+  await updateIssue(updateTargetsArgs);
+
+  expect(mockExistsSync).not.toHaveBeenCalled();
+  expect(updateTargetsArgs.octokit.rest.issues.update).not.toHaveBeenCalled();
+});
+
 describe("transformIssueBody", () => {
   it("should correctly transform an issue body", () => {
     const result = transformIssueBody(
diff --git a/src/modules/details-from-context.js b/src/modules/details-from-context.js
index e58b0be..1cbc1ea 100644
--- a/src/modules/details-from-context.js
+++ b/src/modules/details-from-context.js
@@ -22,12 +22,30 @@ async function detailsFromContext({ context }) {
   }
 
   const titleParser =
-    /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/;
-  const titleMatch = context.payload.issue.title.match(titleParser).groups;
+    /^publish: (?:getsentry\/)?(?<repo>[A-Za-z0-9_.-]+)(?<path>\/[\w./-]+)?(?: \[workspace: (?<workspace>"(?:[^"\\]|\\.)*")\] )?@(?<version>[\w.+-]+)$/;
+  const titleMatch = context.payload.issue.title.match(titleParser);
+  if (!titleMatch || !titleMatch.groups) {
+    throw new Error(
+      `Invalid publish issue title: '${context.payload.issue.title}'`
+    );
+  }
+  const { workspace: workspaceJson, ...titleDetails } = titleMatch.groups;
+  let workspace = "";
+  if (workspaceJson) {
+    workspace = JSON.parse(workspaceJson);
+    if (!workspace || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(workspace)) {
+      throw new Error(
+        "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"
+      );
+    }
+  }
   const dry_run = context.payload.issue.labels.some((l) => l.name === "dry-run")
     ? "1"
     : "";
-  const path = "." + (titleMatch.path || "");
+  const path = "." + (titleDetails.path || "");
+  if (path.split("/").includes("..")) {
+    throw new Error(`Invalid publish issue path: '${path}'`);
+  }
 
   // https://docs.github.com/en/get-started/using-git/dealing-with-special-characters-in-branch-and-tag-names#naming-branches-and-tags
   const mergeTargetParser = /^Merge target: (?<merge_target>[\w.\-/]+)$/m;
@@ -48,11 +66,12 @@ async function detailsFromContext({ context }) {
   }
 
   return {
-    ...titleMatch,
+    ...titleDetails,
     dry_run,
     merge_target,
     path,
     targets,
+    ...(workspace ? { workspace } : {}),
   };
 }
 
diff --git a/src/modules/update-issue.js b/src/modules/update-issue.js
index 9b600cc..0dc5c30 100644
--- a/src/modules/update-issue.js
+++ b/src/modules/update-issue.js
@@ -4,10 +4,13 @@ const {
   TARGETS_PARSER_REGEX,
 } = require("./details-from-context");
 
-async function updateTargets({octokit, version, publishRepo, issue_number}) {
-  const CRAFT_STATE_FILE_PATH = `${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json`;
-
-  if (!fs.existsSync(CRAFT_STATE_FILE_PATH)) {
+async function updateTargets({
+  octokit,
+  stateFilePath,
+  publishRepo,
+  issue_number,
+}) {
+  if (!stateFilePath || !fs.existsSync(stateFilePath)) {
     return;
   }
 
@@ -17,7 +20,7 @@ async function updateTargets({octokit, version, publishRepo, issue_number}) {
   });
 
   const craftStateRequest = fs.promises
-    .readFile(CRAFT_STATE_FILE_PATH, { encoding: "utf-8" })
+    .readFile(stateFilePath, { encoding: "utf-8" })
     .then((data) => JSON.parse(data));
 
   const [{ data: issue }, craftState] = await Promise.all([
@@ -36,37 +39,40 @@ async function updateTargets({octokit, version, publishRepo, issue_number}) {
 
 function transformIssueBody(craftState, issueBody) {
   const declaredTargets = new Set();
-  return issueBody.replace(
-    TARGETS_SECTION_PARSER_REGEX,
-    (targetsSection) => {
-      let targetsText = targetsSection.trimEnd();
-      targetsText = targetsText.replace(
-        TARGETS_PARSER_REGEX,
-        (_match, targetId) => {
-          declaredTargets.add(targetId);
-          const x = craftState.published[targetId] ? "x" : " ";
-          return `- [${x}] ${targetId}`;
-        }
-      );
-      const unlistedTargets = Object.keys(craftState.published)
+  return issueBody.replace(TARGETS_SECTION_PARSER_REGEX, (targetsSection) => {
+    let targetsText = targetsSection.trimEnd();
+    targetsText = targetsText.replace(
+      TARGETS_PARSER_REGEX,
+      (_match, targetId) => {
+        declaredTargets.add(targetId);
+        const x = craftState.published[targetId] ? "x" : " ";
+        return `- [${x}] ${targetId}`;
+      }
+    );
+    const unlistedTargets =
+      Object.keys(craftState.published)
         .filter((target) => !declaredTargets.has(target))
         .map(
           (target) =>
             `- [${craftState.published[target] ? "x" : " "}] ${target}`
         )
-        .join("\n") + '\n';
-      targetsText += `\n${unlistedTargets}\n`;
-      return targetsText;
+        .join("\n") + "\n";
+    targetsText += `\n${unlistedTargets}\n`;
+    return targetsText;
   });
 }
 
-async function updateIssue({ context, octokit, inputs }) {
-  const { version } = inputs;
+async function updateIssue({ context, octokit }) {
   const { repo: publishRepo } = context;
   const { number: issue_number } = context.payload.issue;
 
   await Promise.all([
-    updateTargets({octokit, version, publishRepo, issue_number}),
+    updateTargets({
+      octokit,
+      stateFilePath: process.env.CRAFT_STATE_FILE_PATH,
+      publishRepo,
+      issue_number,
+    }),
     octokit.rest.issues.removeLabel({
       ...publishRepo,
       issue_number,

From b658ffa0299fedf78c9dd9a2121cd740691ca157 Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Thu, 27 Aug 2026 09:14:38 +0000
Subject: [PATCH 2/3] fix: validate publish workspace JSON

---
 .github/workflows/cocoapods-keepalive.yml     |  2 +-
 README.md                                     |  5 ++
 docs/publish-issue-format.md                  | 81 +++++++++++++++++++
 src/modules/__tests__/details-from-context.js | 18 +++++
 src/modules/details-from-context.js           |  8 +-
 5 files changed, 112 insertions(+), 2 deletions(-)
 create mode 100644 docs/publish-issue-format.md

diff --git a/.github/workflows/cocoapods-keepalive.yml b/.github/workflows/cocoapods-keepalive.yml
index 21c0696..9c11b0e 100644
--- a/.github/workflows/cocoapods-keepalive.yml
+++ b/.github/workflows/cocoapods-keepalive.yml
@@ -1,4 +1,4 @@
-name: "CocoaPods Token Keep-Alive"
+name: CocoaPods Token Keep-Alive
 
 on:
   schedule:
diff --git a/README.md b/README.md
index b8e07f0..4cbc9b9 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,11 @@ flowchart TD
 1. Observe the issue for information about the triggered run
 1. The issue will automatically be closed when publishing succeeds
 
+## Publish Issue Format
+
+The release workflow creates publish requests with a stable title and body contract. See
+[Publish Issue Format](docs/publish-issue-format.md) for the accepted syntax and fields.
+
 ## CalVer
 
 To enable calendar versioning, add the following to your `.craft.yml`:
diff --git a/docs/publish-issue-format.md b/docs/publish-issue-format.md
new file mode 100644
index 0000000..55d230f
--- /dev/null
+++ b/docs/publish-issue-format.md
@@ -0,0 +1,81 @@
+# Publish Issue Format
+
+The Publish workflow treats a publish issue as a release request. The title identifies
+the release; the body supplies the merge target and selected targets. Do not edit the
+title by hand unless it remains valid under this format.
+
+## Title
+
+Every title starts with `publish: `.
+
+Legacy releases without a workspace use this form:
+
+```text
+publish: getsentry/<repository><optional-path>@<version>
+```
+
+Workspace releases use this form:
+
+```text
+publish: getsentry/<repository><optional-path> [workspace: <json-string>] @<version>
+```
+
+Examples:
+
+```text
+publish: getsentry/sentry@21.3.1
+publish: getsentry/toolkit/cli@1.2.3
+publish: getsentry/toolkit/cli [workspace: "cli/v2"] @1.2.3
+publish: getsentry/toolkit [workspace: "cli [preview] \"next\""] @1.2.3
+```
+
+`getsentry/` is optional when parsing existing issues. New requests created by Craft
+always include the checkout repository identity.
+
+`<repository>` contains only ASCII letters, digits, `.`, `_`, and `-`. An optional
+path starts with `/` and contains letters, digits, `_`, `.`, `/`, and `-`; it must not
+include a `..` path segment. `<version>` contains letters, digits, `_`, `.`, `+`, and
+`-`.
+
+`<json-string>` is one valid JSON string, including its double quotes. It must decode
+to a nonempty workspace name and must not contain Unicode control (`Cc`), format
+(`Cf`), line-separator (`Zl`), or paragraph-separator (`Zp`) characters. JSON escaping
+makes brackets, quotes, and other printable characters unambiguous.
+
+The legacy and workspace forms intentionally use different separators: legacy titles
+have no space before `@`; workspace titles have one space after the closing `]` before
+`@`.
+
+## Body
+
+The workflow reads these body fields:
+
+```markdown
+Requested by: @<actor>
+
+Merge target: <branch-or-(default)>
+
+Quick links:
+
+- [View changes](compare-url)
+- [View check runs](checks-url)
+
+Assign the **accepted** label to this issue to approve the release.
+
+### Targets
+
+- [ ] <target-id>
+
+Checked targets will be skipped (either already published or user-requested skip). Uncheck to retry a target.
+```
+
+`Merge target` is optional. `(default)` means the target repository's default branch.
+When present, the branch may contain letters, digits, `_`, `.`, `/`, and `-`.
+
+The workflow reads checked entries (`- [x] <target-id>`) in the `### Targets` section.
+It preserves checked entries when Craft refreshes an existing request. During a failed
+release, the controller updates target checkboxes from the secure Craft publish-state
+file; targets marked checked are skipped on retry unless manually unchecked.
+
+The requester, quick links, approval guidance, and optional changelog section are
+informational. The `accepted` label starts publishing; `dry-run` requests dry-run mode.
diff --git a/src/modules/__tests__/details-from-context.js b/src/modules/__tests__/details-from-context.js
index 5b1ccdb..c89d548 100644
--- a/src/modules/__tests__/details-from-context.js
+++ b/src/modules/__tests__/details-from-context.js
@@ -178,6 +178,24 @@ test("rejects a legacy title with an unexpected space before its version", async
   await expect(fn).rejects.toThrow("Invalid publish issue title");
 });
 
+test("rejects an invalid JSON workspace escape with a clear error", async () => {
+  const fn = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title:
+              'publish: getsentry/toolkit [workspace: "cli\\qnext"] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+
+  await expect(fn).rejects.toThrow("Invalid publish workspace JSON in title");
+});
+
 test("rejects an empty or unsafe Unicode workspace", async () => {
   const emptyWorkspace = () =>
     detailsFromContext({
diff --git a/src/modules/details-from-context.js b/src/modules/details-from-context.js
index 1cbc1ea..87aa547 100644
--- a/src/modules/details-from-context.js
+++ b/src/modules/details-from-context.js
@@ -32,7 +32,13 @@ async function detailsFromContext({ context }) {
   const { workspace: workspaceJson, ...titleDetails } = titleMatch.groups;
   let workspace = "";
   if (workspaceJson) {
-    workspace = JSON.parse(workspaceJson);
+    try {
+      workspace = JSON.parse(workspaceJson);
+    } catch {
+      throw new Error(
+        `Invalid publish workspace JSON in title: '${context.payload.issue.title}'`
+      );
+    }
     if (!workspace || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(workspace)) {
       throw new Error(
         "Workspace names must be nonempty and cannot contain Unicode control, format, or separator characters"

From 52ef600d6759911d4b76d7f3108c5a41c3e0ec2a Mon Sep 17 00:00:00 2001
From: Burak Yigit Kaya <byk@sentry.io>
Date: Wed, 2 Sep 2026 16:18:27 +0000
Subject: [PATCH 3/3] feat: resolve compact workspace publish requests

---
 .github/workflows/ci-poller.yml               |  32 +-
 .github/workflows/publish.yml                 |  65 +-
 docs/publish-issue-format.md                  |  65 +-
 package.json                                  |   5 +-
 .../generate-publish-issue-title-parser.js    |  40 +
 src/modules/__tests__/ci-poller-input.js      |  53 +
 src/modules/__tests__/details-from-context.js |  20 +
 src/modules/__tests__/publish-location.js     |  99 ++
 src/modules/__tests__/publish-workflow.js     |  54 +-
 src/modules/__tests__/release-revision.js     | 103 ++
 src/modules/ci-poller-input.js                |  27 +
 src/modules/details-from-context.js           |  19 +-
 src/modules/publish-issue-title.js            | 902 ++++++++++++++++++
 src/modules/publish-issue-title.peggy         |  45 +
 src/modules/publish-location.js               |  45 +
 src/modules/release-revision.js               |  29 +
 src/publish/resolve-ci-poller-input.js        |  11 +
 src/publish/resolve-location.js               |  29 +
 src/publish/resolve-release-revision.js       |  15 +
 yarn.lock                                     |  31 +
 20 files changed, 1601 insertions(+), 88 deletions(-)
 create mode 100644 scripts/generate-publish-issue-title-parser.js
 create mode 100644 src/modules/__tests__/ci-poller-input.js
 create mode 100644 src/modules/__tests__/publish-location.js
 create mode 100644 src/modules/__tests__/release-revision.js
 create mode 100644 src/modules/ci-poller-input.js
 create mode 100644 src/modules/publish-issue-title.js
 create mode 100644 src/modules/publish-issue-title.peggy
 create mode 100644 src/modules/publish-location.js
 create mode 100644 src/modules/release-revision.js
 create mode 100644 src/publish/resolve-ci-poller-input.js
 create mode 100644 src/publish/resolve-location.js
 create mode 100644 src/publish/resolve-release-revision.js

diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index a3db430..324b63f 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -48,6 +48,11 @@ jobs:
           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
           owner: getsentry # create token with access to all getsentry repos
 
+      - name: Check out publish controller
+        uses: actions/checkout@v5
+        with:
+          path: .__publish__
+
       - name: Check CI status for ci-pending issues
         env:
           # Use the sentry-internal-app token for label changes on this
@@ -92,26 +97,14 @@ jobs:
             title=$(echo "$issue" | jq -r '.title')
             body=$(echo "$issue" | jq -r '.body')
 
-            # Parse repo and version from title: "publish: owner/repo[/path]@version"
-            # Only take owner/repo (first two segments) — monorepos like
-            # "getsentry/relay/py@0.9.26" have a path suffix that isn't part
-            # of the GitHub repo name.
-            repo=$(echo "$title" | sed -n 's|^publish: \([^/]*/[^/@]*\).*@.*|\1|p')
-            version=$(echo "$title" | sed -n 's/^publish: .*@\(.*\)/\1/p')
-
-            if [[ -z "$repo" || -z "$version" ]]; then
-              echo "::warning::Could not parse repo/version from issue #${number}: ${title}"
-              continue
-            fi
-
-            # Extract the commit SHA from the "View check runs" link in the issue body.
-            # Link format: https://github.com/{owner}/{repo}/commit/{SHA}/checks/
-            issue_sha=$(echo "$body" | grep -oP '(?<=commit/)[0-9a-f]{40}(?=/checks)' || true)
-
-            if [[ -z "$issue_sha" ]]; then
-              echo "::warning::Could not extract commit SHA from issue #${number} body, skipping."
+            if ! publish_input=$(PUBLISH_ISSUE_BODY="$body" PUBLISH_TITLE="$title" \
+              node .__publish__/src/publish/resolve-ci-poller-input.js); then
+              echo "::warning::Could not parse canonical publish input for issue #${number}, skipping."
               continue
             fi
+            repo=$(echo "$publish_input" | jq -r '.repo')
+            version=$(echo "$publish_input" | jq -r '.version')
+            issue_sha=$(echo "$publish_input" | jq -r '.revision')
 
             # Resolve the release branch name from the original commit's check
             # suites (avoids hard-coding "release/{version}" since repos can
@@ -149,7 +142,8 @@ jobs:
             # for humans and for subsequent poller runs.
             if [[ "$sha" != "$issue_sha" ]]; then
               echo "  Branch ${branch} moved: ${issue_sha:0:8} → ${sha:0:8}. Updating issue."
-              updated_body="${body//${issue_sha}/${sha}}"
+              updated_body=$(PUBLISH_ISSUE_BODY="$body" PUBLISH_REVISION="$sha" PUBLISH_TITLE="$title" \
+                node .__publish__/src/publish/resolve-ci-poller-input.js | jq -r '.issueBody')
               gh issue edit "$number" -R "$GITHUB_REPOSITORY" --body "$updated_body"
             fi
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c283b79..f6dc96a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -135,36 +135,19 @@ jobs:
         id: inputs
         run: node .__publish__/src/publish/inputs.js
 
+      - name: Resolve CI-approved release revision
+        id: release-revision
+        env:
+          PUBLISH_ARGS: ${{ steps.inputs.outputs.result }}
+          PUBLISH_ISSUE_BODY: ${{ github.event.issue.body }}
+        run: node .__publish__/src/publish/resolve-release-revision.js
+
       - name: Inform start
-        if: steps.inputs.outcome == 'success'
+        if: steps.inputs.outcome == 'success' && steps.release-revision.outcome == 'success'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: node .__publish__/src/publish/post-workflow-details.js
 
-      # Setting the target repo branch will cause the craft config (.craft.yml) to be taken from the checked out branch
-      # By default, we check out the default branch of the repo.
-      # If you need to maintain diverging craft configs on different branches, add your repo and the merge target branch
-      # (i.e. the branch craft will merge the release branch into) into the if condition below.
-      - name: Set target repo checkout branch
-        # Note: Branches registered here MUST BE protected in the target repo!
-        if: |
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-migr8' && fromJSON(steps.inputs.outputs.result).merge_target == 'tmp-merge-target' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'v10' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'v9' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'v8' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'v7' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'master' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-python' && fromJSON(steps.inputs.outputs.result).merge_target == 'alpha' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-wizard' && fromJSON(steps.inputs.outputs.result).merge_target == '1.x' ||
-          false
-        id: target-repo-branch
-        env:
-          MERGE_TARGET: ${{ fromJSON(steps.inputs.outputs.result).merge_target }}
-          REPO: ${{ fromJSON(steps.inputs.outputs.result).repo }}
-        run: |
-          echo "taking craft config from branch \"$MERGE_TARGET\" in \"$REPO\""
-          echo "target_repo_branch=$MERGE_TARGET" >> "$GITHUB_OUTPUT"
-
       - name: Get Release Bot auth token
         id: token
         uses: actions/create-github-app-token@v3
@@ -178,20 +161,40 @@ jobs:
         if: ${{ steps.inputs.outputs.result }}
         with:
           path: __repo__
-          ref: ${{ steps.target-repo-branch.outputs.target_repo_branch || ''}}
+          ref: ${{ steps.release-revision.outputs.revision }}
           repository: getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }}
           token: ${{ steps.token.outputs.token }}
           fetch-depth: 0
 
+      - name: Resolve publish location
+        id: location
+        env:
+          PUBLISH_ARGS: ${{ steps.inputs.outputs.result }}
+        run: |
+          workspace_names='[]'
+          requires_workspace_discovery="$(node -e '
+            const { needsWorkspaceDiscovery } = require("./.__publish__/src/modules/publish-location");
+            const input = JSON.parse(process.env.PUBLISH_ARGS || "");
+            process.stdout.write(String(needsWorkspaceDiscovery(input)));
+          ')"
+          if [[ "$requires_workspace_discovery" == "true" && -f __repo__/.craft.yml ]]; then
+            workspace_names="$(docker run --rm \
+              --volume "$GITHUB_WORKSPACE/__repo__:/github/workspace/__repo__" \
+              --workdir /github/workspace/__repo__ \
+              getsentry/craft:latest workspace list)"
+          fi
+          CRAFT_WORKSPACE_NAMES="$workspace_names" \
+            node .__publish__/src/publish/resolve-location.js
+
       - name: Set targets
         id: craft-state
         shell: bash
         if: fromJSON(steps.inputs.outputs.result).targets
         env:
           CRAFT_PUBLISH_REPO: ${{ fromJSON(steps.inputs.outputs.result).repo }}
-          CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.inputs.outputs.result).path }}
+          CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.location.outputs.result).path }}
           CRAFT_PUBLISH_VERSION: ${{ fromJSON(steps.inputs.outputs.result).version }}
-          CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.inputs.outputs.result).workspace || '' }}
+          CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}
           CRAFT_PUBLISH_TARGETS_JSON: ${{ toJSON(fromJSON(steps.inputs.outputs.result).targets) }}
         run: |
           # Render the "already published" JSON.
@@ -241,8 +244,8 @@ jobs:
             -e
             -c "
             export HOME=/root &&
-            cd __repo__/${{ fromJSON(steps.inputs.outputs.result).path }} &&
-            exec craft publish ${{ fromJSON(steps.inputs.outputs.result).version }}
+            cd __repo__/${{ fromJSON(steps.location.outputs.result).path }} &&
+            exec craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}
             "
         env:
           # Pin Craft's publish-state directory to a path outside
@@ -252,7 +255,7 @@ jobs:
           CRAFT_MERGE_TARGET: ${{ fromJSON(steps.inputs.outputs.result).merge_target }}
           CRAFT_LOG_LEVEL: ${{ vars.CRAFT_LOG_LEVEL || 'Info' }}
           CRAFT_DRY_RUN: ${{ fromJSON(steps.inputs.outputs.result).dry_run }}
-          CRAFT_WORKSPACE: ${{ fromJSON(steps.inputs.outputs.result).workspace || '' }}
+          CRAFT_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}
           # State must follow the issue checkout identity, not a workspace's
           # optional GitHub release-repository override.
           CRAFT_PUBLISH_STATE_GITHUB_REPO: getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }}
diff --git a/docs/publish-issue-format.md b/docs/publish-issue-format.md
index 55d230f..3092030 100644
--- a/docs/publish-issue-format.md
+++ b/docs/publish-issue-format.md
@@ -6,49 +6,60 @@ title by hand unless it remains valid under this format.
 
 ## Title
 
-Every title starts with `publish: `.
-
-Legacy releases without a workspace use this form:
+Every title starts with `publish: `. This EBNF is canonical:
 
 ```text
-publish: getsentry/<repository><optional-path>@<version>
+title             = "publish: ", [ "getsentry/" ], repository, [ path ],
+                    [ legacy-workspace ], "@", version ;
+repository        = token, { token } ;
+path              = "/", path-segment, { "/", path-segment } ;
+path-segment      = token, { token } ;
+legacy-workspace  = " [workspace: ", json-string, "] " ;
+version           = version-character, { version-character } ;
+token             = ? ASCII letter, digit, ".", "_", or "-" ? ;
+version-character = token | "+" ;
 ```
 
-Workspace releases use this form:
+New Craft requests always include the checkout repository identity. Root workspace
+releases use one trailing path segment for the workspace name:
 
 ```text
-publish: getsentry/<repository><optional-path> [workspace: <json-string>] @<version>
+publish: getsentry/sentry@21.3.1
+publish: getsentry/toolkit/cli@1.2.3
 ```
 
-Examples:
+Craft rejects a workspace with a non-root checkout path. Workspace names in new titles
+must match `^[A-Za-z0-9_.-]+$`; Craft preserves their exact spelling.
+
+The controller resolves a one-segment suffix only after it checks out the exact
+CI-approved revision from the `View check runs` link. When that checkout has a root
+`.craft.yml`, `craft workspace list` supplies the exact workspace keys. A suffix that
+exactly matches one of those keys is a workspace; every other suffix remains a checkout
+path. The controller never normalizes names. A missing root `.craft.yml` always means
+checkout-path behavior. Discovery errors with a root configuration fail the release.
+
+Existing JSON-qualified workspace titles remain supported for compatibility, but Craft
+does not create them:
 
 ```text
-publish: getsentry/sentry@21.3.1
-publish: getsentry/toolkit/cli@1.2.3
-publish: getsentry/toolkit/cli [workspace: "cli/v2"] @1.2.3
+publish: getsentry/toolkit [workspace: "cli/v2"] @1.2.3
 publish: getsentry/toolkit [workspace: "cli [preview] \"next\""] @1.2.3
 ```
 
-`getsentry/` is optional when parsing existing issues. New requests created by Craft
-always include the checkout repository identity.
-
-`<repository>` contains only ASCII letters, digits, `.`, `_`, and `-`. An optional
-path starts with `/` and contains letters, digits, `_`, `.`, `/`, and `-`; it must not
-include a `..` path segment. `<version>` contains letters, digits, `_`, `.`, `+`, and
-`-`.
+Legacy workspace titles must also use the repository root path.
 
 `<json-string>` is one valid JSON string, including its double quotes. It must decode
 to a nonempty workspace name and must not contain Unicode control (`Cc`), format
-(`Cf`), line-separator (`Zl`), or paragraph-separator (`Zp`) characters. JSON escaping
-makes brackets, quotes, and other printable characters unambiguous.
+(`Cf`), line-separator (`Zl`), or paragraph-separator (`Zp`) characters. Legacy
+workspace titles have one space after `]` before `@`; unqualified titles have no space
+before `@`.
 
-The legacy and workspace forms intentionally use different separators: legacy titles
-have no space before `@`; workspace titles have one space after the closing `]` before
-`@`.
+`getsentry/` remains optional when parsing existing issues. Paths must not contain a
+`..` segment.
 
 ## Body
 
-The workflow reads these body fields:
+The request must start with these body fields:
 
 ```markdown
 Requested by: @<actor>
@@ -77,5 +88,9 @@ It preserves checked entries when Craft refreshes an existing request. During a
 release, the controller updates target checkboxes from the secure Craft publish-state
 file; targets marked checked are skipped on retry unless manually unchecked.
 
-The requester, quick links, approval guidance, and optional changelog section are
-informational. The `accepted` label starts publishing; `dry-run` requests dry-run mode.
+The requester, approval guidance, and optional changelog section are informational. The
+`Quick links` must follow `Requested by` and `Merge target`, and contain exactly one `View
+changes` line followed by exactly one `View check runs` line for the checkout repository.
+The controller and CI poller use that check-runs revision as the release authority. The
+`accepted` label starts publishing;
+`dry-run` requests dry-run mode.
diff --git a/package.json b/package.json
index d59a8b6..0790379 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,9 @@
     "undici": "^6.23.0"
   },
   "scripts": {
-    "test": "vitest run",
+    "generate": "node scripts/generate-publish-issue-title-parser.js",
+    "check:generated": "node scripts/generate-publish-issue-title-parser.js --check",
+    "test": "yarn check:generated && vitest run",
     "test:watch": "vitest",
     "lint": "eslint src .github --ignore-pattern '!.github'",
     "prettier": "prettier --write src"
@@ -24,6 +26,7 @@
     "eslint": "^8.9.0",
     "eslint-config-prettier": "^8.3.0",
     "eslint-plugin-yml": "^0.13.0",
+    "peggy": "5.1.0",
     "prettier": "^2.2.1",
     "vitest": "^4.1.0"
   },
diff --git a/scripts/generate-publish-issue-title-parser.js b/scripts/generate-publish-issue-title-parser.js
new file mode 100644
index 0000000..b812306
--- /dev/null
+++ b/scripts/generate-publish-issue-title-parser.js
@@ -0,0 +1,40 @@
+const fs = require("fs");
+const path = require("path");
+const peggy = require("peggy");
+const prettier = require("prettier");
+
+const grammarPath = path.join(
+  __dirname,
+  "..",
+  "src",
+  "modules",
+  "publish-issue-title.peggy"
+);
+const outputPath = path.join(
+  __dirname,
+  "..",
+  "src",
+  "modules",
+  "publish-issue-title.js"
+);
+const grammar = fs.readFileSync(grammarPath, "utf8");
+const parser = peggy.generate(grammar, {
+  format: "commonjs",
+  grammarSource: "publish-issue-title.peggy",
+  output: "source",
+});
+
+const generatedParser = prettier.format(`/* eslint-disable */\n${parser}`, {
+  filepath: outputPath,
+});
+
+if (process.argv.includes("--check")) {
+  const currentParser = fs.readFileSync(outputPath, "utf8");
+  if (currentParser !== generatedParser) {
+    throw new Error(
+      "The generated publish issue title parser is stale. Run `yarn generate`."
+    );
+  }
+} else {
+  fs.writeFileSync(outputPath, generatedParser);
+}
diff --git a/src/modules/__tests__/ci-poller-input.js b/src/modules/__tests__/ci-poller-input.js
new file mode 100644
index 0000000..8c80856
--- /dev/null
+++ b/src/modules/__tests__/ci-poller-input.js
@@ -0,0 +1,53 @@
+import { readFileSync } from "fs";
+import { join } from "path";
+
+import { expect, test } from "vitest";
+
+const { getCiPollerInput } = require("../ci-poller-input.js");
+
+const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
+const issueBody = `Requested by: @byk
+
+Merge target: (default)
+
+Quick links:
+- [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
+- [View check runs](https://github.com/getsentry/toolkit/commit/${REVISION}/checks/)`;
+
+test("parses compact and legacy workspace publish titles", () => {
+  expect(
+    getCiPollerInput({
+      issueBody,
+      title: "publish: getsentry/toolkit/cli@1.2.3",
+    })
+  ).toEqual({
+    repo: "getsentry/toolkit",
+    revision: REVISION,
+    version: "1.2.3",
+  });
+
+  expect(
+    getCiPollerInput({
+      issueBody,
+      title: 'publish: toolkit [workspace: "cli/v2"] @1.2.3',
+    })
+  ).toEqual({
+    repo: "getsentry/toolkit",
+    revision: REVISION,
+    version: "1.2.3",
+  });
+});
+
+test("uses the shared resolver in the CI poller", () => {
+  const workflow = readFileSync(
+    join(__dirname, "../../../.github/workflows/ci-poller.yml"),
+    "utf8"
+  );
+
+  expect(workflow).toContain("name: Check out publish controller");
+  expect(workflow).toContain("path: .__publish__");
+  expect(workflow).toContain(
+    "node .__publish__/src/publish/resolve-ci-poller-input.js"
+  );
+  expect(workflow).not.toContain("grep -oP '(?<=commit/");
+});
diff --git a/src/modules/__tests__/details-from-context.js b/src/modules/__tests__/details-from-context.js
index c89d548..d75c587 100644
--- a/src/modules/__tests__/details-from-context.js
+++ b/src/modules/__tests__/details-from-context.js
@@ -123,6 +123,26 @@ test("parses a human-readable workspace from the title", async () => {
   });
 });
 
+test("rejects a legacy workspace with a non-root path", async () => {
+  const fn = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title:
+              'publish: getsentry/toolkit/packages/cli [workspace: "cli/v2"] @1.2.3',
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+
+  await expect(fn).rejects.toThrow(
+    "A publish workspace must use the repository root path."
+  );
+});
+
 test("parses escaped workspace characters from the title", async () => {
   const result = await detailsFromContext({
     context: {
diff --git a/src/modules/__tests__/publish-location.js b/src/modules/__tests__/publish-location.js
new file mode 100644
index 0000000..b75192f
--- /dev/null
+++ b/src/modules/__tests__/publish-location.js
@@ -0,0 +1,99 @@
+import { expect, test } from "vitest";
+
+const {
+  needsWorkspaceDiscovery,
+  resolvePublishLocation,
+} = require("../publish-location.js");
+
+test.each([
+  [{ path: "./cli" }, true],
+  [{ path: "./packages/cli" }, false],
+  [{ path: "." }, false],
+  [{ path: "./cli", workspace: "cli" }, false],
+])("workspace discovery is %s for %j", (input, expected) => {
+  expect(needsWorkspaceDiscovery(input)).toBe(expected);
+});
+
+test("classifies an exact one-segment workspace without normalizing it", () => {
+  expect(
+    resolvePublishLocation({
+      path: "./CLI",
+      workspaceNames: ["cli", "CLI"],
+    })
+  ).toStrictEqual({ path: ".", workspace: "CLI" });
+});
+
+test("keeps a non-workspace suffix as a checkout path", () => {
+  expect(
+    resolvePublishLocation({
+      path: "./packages",
+      workspaceNames: ["cli"],
+    })
+  ).toStrictEqual({ path: "./packages" });
+});
+
+test("keeps multi-segment paths even when the last segment is a workspace", () => {
+  expect(
+    resolvePublishLocation({
+      path: "./packages/cli",
+      workspaceNames: ["cli"],
+    })
+  ).toStrictEqual({ path: "./packages/cli" });
+});
+
+test("keeps root releases at the checkout root", () => {
+  expect(
+    resolvePublishLocation({
+      path: ".",
+      workspaceNames: ["cli"],
+    })
+  ).toStrictEqual({ path: "." });
+});
+
+test("preserves the legacy explicit workspace", () => {
+  expect(
+    resolvePublishLocation({
+      path: ".",
+      workspace: "cli/v2",
+      workspaceNames: [],
+    })
+  ).toStrictEqual({ path: ".", workspace: "cli/v2" });
+});
+
+test("rejects a workspace with a non-root path", () => {
+  expect(() =>
+    resolvePublishLocation({
+      path: "./packages/cli",
+      workspace: "cli/v2",
+      workspaceNames: [],
+    })
+  ).toThrow("A publish workspace must use the repository root path.");
+});
+
+test("does not validate discovery for a legacy explicit workspace", () => {
+  expect(
+    resolvePublishLocation({
+      path: ".",
+      workspace: "cli/v2",
+      workspaceNames: ["invalid/workspace"],
+    })
+  ).toStrictEqual({ path: ".", workspace: "cli/v2" });
+});
+
+test("rejects an invalid workspace returned by discovery", () => {
+  expect(() =>
+    resolvePublishLocation({
+      path: "./cli",
+      workspaceNames: ["cli-日本語"],
+    })
+  ).toThrow("Craft workspace discovery returned an invalid workspace list");
+});
+
+test.each([".", ".."])("rejects traversal workspace name %s", (workspace) => {
+  expect(() =>
+    resolvePublishLocation({
+      path: `./${workspace}`,
+      workspaceNames: [workspace],
+    })
+  ).toThrow("Craft workspace discovery returned an invalid workspace list.");
+});
diff --git a/src/modules/__tests__/publish-workflow.js b/src/modules/__tests__/publish-workflow.js
index e29085c..7409e0d 100644
--- a/src/modules/__tests__/publish-workflow.js
+++ b/src/modules/__tests__/publish-workflow.js
@@ -5,13 +5,19 @@ import { join } from "path";
 
 import { afterEach, expect, test } from "vitest";
 
+const { resolvePublishLocation } = require("../publish-location.js");
+
 const temporaryDirectories = [];
 
-function getSetTargetsScript() {
-  const workflow = readFileSync(
+function getWorkflow() {
+  return readFileSync(
     join(__dirname, "../../../.github/workflows/publish.yml"),
     "utf8"
   );
+}
+
+function getSetTargetsScript() {
+  const workflow = getWorkflow();
   const section = workflow.match(
     / {6}- name: Set targets[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- uses: docker:\/\/getsentry\/craft:latest/
   );
@@ -54,6 +60,40 @@ afterEach(() => {
   }
 });
 
+test("uses the CI-approved revision for checkout, location resolution, and publishing", () => {
+  const workflow = getWorkflow();
+  const revision = workflow.indexOf(
+    "name: Resolve CI-approved release revision"
+  );
+  const informStart = workflow.indexOf("name: Inform start");
+  const checkout = workflow.indexOf("name: Check out target repo");
+  const location = workflow.indexOf("name: Resolve publish location");
+  const state = workflow.indexOf("name: Set targets");
+  const publish = workflow.indexOf("name: Publish using Craft");
+
+  expect(checkout).toBeGreaterThan(-1);
+  expect(informStart).toBeGreaterThan(revision);
+  expect(checkout).toBeGreaterThan(informStart);
+  expect(location).toBeGreaterThan(checkout);
+  expect(state).toBeGreaterThan(location);
+  expect(publish).toBeGreaterThan(state);
+  expect(workflow).toContain(
+    "ref: ${{ steps.release-revision.outputs.revision }}"
+  );
+  expect(workflow).toContain("getsentry/craft:latest workspace list");
+  expect(workflow).toContain('if [[ "$requires_workspace_discovery" == "true"');
+  expect(workflow).not.toContain("getsentry/craft:2.31.0");
+  expect(workflow).toContain(
+    "CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.location.outputs.result).path }}"
+  );
+  expect(workflow).toContain(
+    "CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}"
+  );
+  expect(workflow).toContain(
+    "craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}"
+  );
+});
+
 test("uses Craft's legacy root state filename", () => {
   const { stateFile, state } = runSetTargets({
     path: ".",
@@ -68,15 +108,19 @@ test("uses Craft's legacy root state filename", () => {
 });
 
 test("matches Craft's workspace state filename for a monorepo release", () => {
-  const { stateFile, state } = runSetTargets({
+  const location = resolvePublishLocation({
     path: "./cli",
+    workspaceNames: ["cli"],
+  });
+  const { stateFile, state } = runSetTargets({
+    path: location.path,
     repo: "toolkit",
     version: "1.2.3",
-    workspace: "cli",
+    workspace: location.workspace,
   });
 
   expect(stateFile).toMatch(
-    /\.craft-state\/craft\/publish-state-getsentry-toolkit-21cf7beaeda4-workspace-Y2xp-1\.2\.3\.json$/
+    /\.craft-state\/craft\/publish-state-getsentry-toolkit-c232c383e26f-workspace-Y2xp-1\.2\.3\.json$/
   );
   expect(JSON.parse(state)).toEqual({ published: { github: true } });
 });
diff --git a/src/modules/__tests__/release-revision.js b/src/modules/__tests__/release-revision.js
new file mode 100644
index 0000000..542dd22
--- /dev/null
+++ b/src/modules/__tests__/release-revision.js
@@ -0,0 +1,103 @@
+import { expect, test } from "vitest";
+
+const {
+  getReleaseRevision,
+  updateReleaseRevision,
+} = require("../release-revision.js");
+
+const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
+
+function requestBody(quickLinks) {
+  return `Requested by: @byk
+
+Merge target: (default)
+
+Quick links:
+${quickLinks}`;
+}
+
+function canonicalQuickLinks(revision = REVISION) {
+  return `- [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
+- [View check runs](https://github.com/getsentry/toolkit/commit/${revision}/checks/)`;
+}
+
+test("gets the CI-approved revision from the request header", () => {
+  expect(
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: requestBody(canonicalQuickLinks()),
+    })
+  ).toBe(REVISION);
+});
+
+test("accepts CRLF request bodies", () => {
+  expect(
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: requestBody(canonicalQuickLinks()).replace(/\n/g, "\r\n"),
+    })
+  ).toBe(REVISION);
+});
+
+test("rejects a check-runs link for another repository", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: requestBody(
+        canonicalQuickLinks().replace(
+          "https://github.com/getsentry/toolkit/commit",
+          "https://github.com/getsentry/other/commit"
+        )
+      ),
+    })
+  ).toThrow("Expected a View check runs link for getsentry/toolkit");
+});
+
+test("rejects a decoy check-runs link outside the request header", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: `${requestBody(canonicalQuickLinks())}
+
+<details>
+Quick links:
+- [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
+- [View check runs](https://github.com/getsentry/toolkit/commit/${"a".repeat(
+        40
+      )}/checks/)
+</details>`,
+    })
+  ).toThrow("Expected exactly one View check runs link in Quick links");
+});
+
+test("rejects a complete Quick links block outside the request header", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: `### Changelog
+
+Quick links:
+${canonicalQuickLinks()}`,
+    })
+  ).toThrow("Expected a View check runs link for getsentry/toolkit");
+});
+
+test("rejects a complete request header outside the issue start", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: `### Changelog
+
+${requestBody(canonicalQuickLinks())}`,
+    })
+  ).toThrow("Expected a View check runs link for getsentry/toolkit");
+});
+
+test("updates only the canonical request-header revision", () => {
+  const replacement = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+  const issueBody = requestBody(canonicalQuickLinks());
+
+  expect(
+    updateReleaseRevision({ issueBody, repo: "toolkit", revision: replacement })
+  ).toContain(`/commit/${replacement}/checks/`);
+});
diff --git a/src/modules/ci-poller-input.js b/src/modules/ci-poller-input.js
new file mode 100644
index 0000000..9e2c060
--- /dev/null
+++ b/src/modules/ci-poller-input.js
@@ -0,0 +1,27 @@
+const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
+const {
+  getReleaseRevision,
+  updateReleaseRevision,
+} = require("./release-revision");
+
+function getCiPollerInput({ title, issueBody, revision }) {
+  let parsedTitle;
+  try {
+    parsedTitle = parsePublishIssueTitle(title);
+  } catch {
+    throw new Error(`Invalid publish issue title: '${title}'`);
+  }
+  const { repo, version } = parsedTitle;
+  const currentRevision = getReleaseRevision({ issueBody, repo });
+
+  return {
+    ...(revision
+      ? { issueBody: updateReleaseRevision({ issueBody, repo, revision }) }
+      : {}),
+    repo: `getsentry/${repo}`,
+    revision: currentRevision,
+    version,
+  };
+}
+
+module.exports = { getCiPollerInput };
diff --git a/src/modules/details-from-context.js b/src/modules/details-from-context.js
index 87aa547..afce326 100644
--- a/src/modules/details-from-context.js
+++ b/src/modules/details-from-context.js
@@ -1,3 +1,5 @@
+const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
+
 /**
  * Matches the entire "Targets" section of a github publish issue body.
  */
@@ -21,15 +23,15 @@ async function detailsFromContext({ context }) {
     throw new Error("Issue context is not defined");
   }
 
-  const titleParser =
-    /^publish: (?:getsentry\/)?(?<repo>[A-Za-z0-9_.-]+)(?<path>\/[\w./-]+)?(?: \[workspace: (?<workspace>"(?:[^"\\]|\\.)*")\] )?@(?<version>[\w.+-]+)$/;
-  const titleMatch = context.payload.issue.title.match(titleParser);
-  if (!titleMatch || !titleMatch.groups) {
+  let titleDetails;
+  try {
+    titleDetails = parsePublishIssueTitle(context.payload.issue.title);
+  } catch {
     throw new Error(
       `Invalid publish issue title: '${context.payload.issue.title}'`
     );
   }
-  const { workspace: workspaceJson, ...titleDetails } = titleMatch.groups;
+  const { workspace: workspaceJson, ...parsedTitleDetails } = titleDetails;
   let workspace = "";
   if (workspaceJson) {
     try {
@@ -48,10 +50,13 @@ async function detailsFromContext({ context }) {
   const dry_run = context.payload.issue.labels.some((l) => l.name === "dry-run")
     ? "1"
     : "";
-  const path = "." + (titleDetails.path || "");
+  const path = "." + parsedTitleDetails.path;
   if (path.split("/").includes("..")) {
     throw new Error(`Invalid publish issue path: '${path}'`);
   }
+  if (workspace && path !== ".") {
+    throw new Error("A publish workspace must use the repository root path.");
+  }
 
   // https://docs.github.com/en/get-started/using-git/dealing-with-special-characters-in-branch-and-tag-names#naming-branches-and-tags
   const mergeTargetParser = /^Merge target: (?<merge_target>[\w.\-/]+)$/m;
@@ -72,7 +77,7 @@ async function detailsFromContext({ context }) {
   }
 
   return {
-    ...titleDetails,
+    ...parsedTitleDetails,
     dry_run,
     merge_target,
     path,
diff --git a/src/modules/publish-issue-title.js b/src/modules/publish-issue-title.js
new file mode 100644
index 0000000..4d5c63a
--- /dev/null
+++ b/src/modules/publish-issue-title.js
@@ -0,0 +1,902 @@
+/* eslint-disable */
+// @generated by Peggy 5.1.0.
+//
+// https://peggyjs.org/
+
+"use strict";
+
+class peg$SyntaxError extends SyntaxError {
+  constructor(message, expected, found, location) {
+    super(message);
+    this.expected = expected;
+    this.found = found;
+    this.location = location;
+    this.name = "SyntaxError";
+  }
+
+  format(sources) {
+    let str = "Error: " + this.message;
+    if (this.location) {
+      let src = null;
+      const st = sources.find((s) => s.source === this.location.source);
+      if (st) {
+        src = st.text.split(/\r\n|\n|\r/g);
+      }
+      const s = this.location.start;
+      const offset_s =
+        this.location.source &&
+        typeof this.location.source.offset === "function"
+          ? this.location.source.offset(s)
+          : s;
+      const loc =
+        this.location.source + ":" + offset_s.line + ":" + offset_s.column;
+      if (src) {
+        const e = this.location.end;
+        const filler = "".padEnd(offset_s.line.toString().length, " ");
+        const line = src[s.line - 1];
+        const last = s.line === e.line ? e.column : line.length + 1;
+        const hatLen = last - s.column || 1;
+        str +=
+          "\n --> " +
+          loc +
+          "\n" +
+          filler +
+          " |\n" +
+          offset_s.line +
+          " | " +
+          line +
+          "\n" +
+          filler +
+          " | " +
+          "".padEnd(s.column - 1, " ") +
+          "".padEnd(hatLen, "^");
+      } else {
+        str += "\n at " + loc;
+      }
+    }
+    return str;
+  }
+
+  static buildMessage(expected, found) {
+    function hex(ch) {
+      return ch.codePointAt(0).toString(16).toUpperCase();
+    }
+
+    const nonPrintable = Object.prototype.hasOwnProperty.call(
+      RegExp.prototype,
+      "unicode"
+    )
+      ? new RegExp("[\\p{C}\\p{Mn}\\p{Mc}]", "gu")
+      : null;
+    function unicodeEscape(s) {
+      if (nonPrintable) {
+        return s.replace(nonPrintable, (ch) => "\\u{" + hex(ch) + "}");
+      }
+      return s;
+    }
+
+    function literalEscape(s) {
+      return unicodeEscape(
+        s
+          .replace(/\\/g, "\\\\")
+          .replace(/"/g, '\\"')
+          .replace(/\0/g, "\\0")
+          .replace(/\t/g, "\\t")
+          .replace(/\n/g, "\\n")
+          .replace(/\r/g, "\\r")
+          .replace(/[\x00-\x0F]/g, (ch) => "\\x0" + hex(ch))
+          .replace(/[\x10-\x1F\x7F-\x9F]/g, (ch) => "\\x" + hex(ch))
+      );
+    }
+
+    function classEscape(s) {
+      return unicodeEscape(
+        s
+          .replace(/\\/g, "\\\\")
+          .replace(/\]/g, "\\]")
+          .replace(/\^/g, "\\^")
+          .replace(/-/g, "\\-")
+          .replace(/\0/g, "\\0")
+          .replace(/\t/g, "\\t")
+          .replace(/\n/g, "\\n")
+          .replace(/\r/g, "\\r")
+          .replace(/[\x00-\x0F]/g, (ch) => "\\x0" + hex(ch))
+          .replace(/[\x10-\x1F\x7F-\x9F]/g, (ch) => "\\x" + hex(ch))
+      );
+    }
+
+    const DESCRIBE_EXPECTATION_FNS = {
+      literal(expectation) {
+        return '"' + literalEscape(expectation.text) + '"';
+      },
+
+      class(expectation) {
+        const escapedParts = expectation.parts.map((part) =>
+          Array.isArray(part)
+            ? classEscape(part[0]) + "-" + classEscape(part[1])
+            : classEscape(part)
+        );
+
+        return (
+          "[" +
+          (expectation.inverted ? "^" : "") +
+          escapedParts.join("") +
+          "]" +
+          (expectation.unicode ? "u" : "")
+        );
+      },
+
+      any() {
+        return "any character";
+      },
+
+      end() {
+        return "end of input";
+      },
+
+      other(expectation) {
+        return expectation.description;
+      },
+    };
+
+    function describeExpectation(expectation) {
+      return DESCRIBE_EXPECTATION_FNS[expectation.type](expectation);
+    }
+
+    function describeExpected(expected) {
+      const descriptions = expected.map(describeExpectation);
+      descriptions.sort();
+
+      if (descriptions.length > 0) {
+        let j = 1;
+        for (let i = 1; i < descriptions.length; i++) {
+          if (descriptions[i - 1] !== descriptions[i]) {
+            descriptions[j] = descriptions[i];
+            j++;
+          }
+        }
+        descriptions.length = j;
+      }
+
+      switch (descriptions.length) {
+        case 1:
+          return descriptions[0];
+
+        case 2:
+          return descriptions[0] + " or " + descriptions[1];
+
+        default:
+          return (
+            descriptions.slice(0, -1).join(", ") +
+            ", or " +
+            descriptions[descriptions.length - 1]
+          );
+      }
+    }
+
+    function describeFound(found) {
+      return found ? '"' + literalEscape(found) + '"' : "end of input";
+    }
+
+    return (
+      "Expected " +
+      describeExpected(expected) +
+      " but " +
+      describeFound(found) +
+      " found."
+    );
+  }
+}
+
+function peg$parse(input, options) {
+  options = options !== undefined ? options : {};
+
+  const peg$FAILED = {};
+  const peg$source = options.grammarSource;
+
+  const peg$startRuleFunctions = {
+    PublishIssueTitle: peg$parsePublishIssueTitle,
+  };
+  let peg$startRuleFunction = peg$parsePublishIssueTitle;
+
+  const peg$c0 = "publish: ";
+  const peg$c1 = "getsentry/";
+  const peg$c2 = "@";
+  const peg$c3 = "/";
+  const peg$c4 = " [workspace: ";
+  const peg$c5 = "] ";
+  const peg$c6 = '"';
+  const peg$c7 = "\\";
+
+  const peg$r0 = /^[A-Za-z0-9_.\-]/;
+  const peg$r1 = /^[^"\\\0-\x1F]/;
+  const peg$r2 = /^[^\0-\x1F]/;
+  const peg$r3 = /^[A-Za-z0-9_.+\-]/;
+
+  const peg$e0 = peg$literalExpectation("publish: ", false);
+  const peg$e1 = peg$literalExpectation("getsentry/", false);
+  const peg$e2 = peg$literalExpectation("@", false);
+  const peg$e3 = peg$anyExpectation();
+  const peg$e4 = peg$classExpectation(
+    [["A", "Z"], ["a", "z"], ["0", "9"], "_", ".", "-"],
+    false,
+    false,
+    false
+  );
+  const peg$e5 = peg$literalExpectation("/", false);
+  const peg$e6 = peg$literalExpectation(" [workspace: ", false);
+  const peg$e7 = peg$literalExpectation("] ", false);
+  const peg$e8 = peg$literalExpectation('"', false);
+  const peg$e9 = peg$classExpectation(
+    ['"', "\\", ["\0", "\x1F"]],
+    true,
+    false,
+    false
+  );
+  const peg$e10 = peg$literalExpectation("\\", false);
+  const peg$e11 = peg$classExpectation([["\0", "\x1F"]], true, false, false);
+  const peg$e12 = peg$classExpectation(
+    [["A", "Z"], ["a", "z"], ["0", "9"], "_", ".", "+", "-"],
+    false,
+    false,
+    false
+  );
+
+  function peg$f0(repo, path, workspace, version) {
+    return {
+      repo,
+      path: path || "",
+      version,
+      ...(workspace ? { workspace } : {}),
+    };
+  }
+  function peg$f1(characters) {
+    return join(characters);
+  }
+  function peg$f2(segment) {
+    return `/${segment}`;
+  }
+  function peg$f3(segments) {
+    return join(segments);
+  }
+  function peg$f4(characters) {
+    return join(characters);
+  }
+  function peg$f5(workspace) {
+    return workspace;
+  }
+  function peg$f6(value) {
+    return value;
+  }
+  function peg$f7(characters) {
+    return join(characters);
+  }
+  let peg$currPos = options.peg$currPos | 0;
+  let peg$savedPos = peg$currPos;
+  const peg$posDetailsCache = [{ line: 1, column: 1 }];
+  let peg$maxFailPos = peg$currPos;
+  let peg$maxFailExpected = options.peg$maxFailExpected || [];
+  let peg$silentFails = options.peg$silentFails | 0;
+
+  let peg$result;
+
+  if (options.startRule) {
+    if (!(options.startRule in peg$startRuleFunctions)) {
+      throw new Error(
+        "Can't start parsing from rule \"" + options.startRule + '".'
+      );
+    }
+
+    peg$startRuleFunction = peg$startRuleFunctions[options.startRule];
+  }
+
+  function text() {
+    return input.substring(peg$savedPos, peg$currPos);
+  }
+
+  function offset() {
+    return peg$savedPos;
+  }
+
+  function range() {
+    return {
+      source: peg$source,
+      start: peg$savedPos,
+      end: peg$currPos,
+    };
+  }
+
+  function location() {
+    return peg$computeLocation(peg$savedPos, peg$currPos);
+  }
+
+  function expected(description, location) {
+    location =
+      location !== undefined
+        ? location
+        : peg$computeLocation(peg$savedPos, peg$currPos);
+
+    throw peg$buildStructuredError(
+      [peg$otherExpectation(description)],
+      input.substring(peg$savedPos, peg$currPos),
+      location
+    );
+  }
+
+  function error(message, location) {
+    location =
+      location !== undefined
+        ? location
+        : peg$computeLocation(peg$savedPos, peg$currPos);
+
+    throw peg$buildSimpleError(message, location);
+  }
+
+  function peg$getUnicode(pos = peg$currPos) {
+    const cp = input.codePointAt(pos);
+    if (cp === undefined) {
+      return "";
+    }
+    return String.fromCodePoint(cp);
+  }
+
+  function peg$literalExpectation(text, ignoreCase) {
+    return { type: "literal", text, ignoreCase };
+  }
+
+  function peg$classExpectation(parts, inverted, ignoreCase, unicode) {
+    return { type: "class", parts, inverted, ignoreCase, unicode };
+  }
+
+  function peg$anyExpectation() {
+    return { type: "any" };
+  }
+
+  function peg$endExpectation() {
+    return { type: "end" };
+  }
+
+  function peg$otherExpectation(description) {
+    return { type: "other", description };
+  }
+
+  function peg$computePosDetails(pos) {
+    let details = peg$posDetailsCache[pos];
+    let p;
+
+    if (details) {
+      return details;
+    } else {
+      if (pos >= peg$posDetailsCache.length) {
+        p = peg$posDetailsCache.length - 1;
+      } else {
+        p = pos;
+        while (!peg$posDetailsCache[--p]) {}
+      }
+
+      details = peg$posDetailsCache[p];
+      details = {
+        line: details.line,
+        column: details.column,
+      };
+
+      while (p < pos) {
+        if (input.charCodeAt(p) === 10) {
+          details.line++;
+          details.column = 1;
+        } else {
+          details.column++;
+        }
+
+        p++;
+      }
+
+      peg$posDetailsCache[pos] = details;
+
+      return details;
+    }
+  }
+
+  function peg$computeLocation(startPos, endPos, offset) {
+    const startPosDetails = peg$computePosDetails(startPos);
+    const endPosDetails = peg$computePosDetails(endPos);
+
+    const res = {
+      source: peg$source,
+      start: {
+        offset: startPos,
+        line: startPosDetails.line,
+        column: startPosDetails.column,
+      },
+      end: {
+        offset: endPos,
+        line: endPosDetails.line,
+        column: endPosDetails.column,
+      },
+    };
+    if (offset && peg$source && typeof peg$source.offset === "function") {
+      res.start = peg$source.offset(res.start);
+      res.end = peg$source.offset(res.end);
+    }
+    return res;
+  }
+
+  function peg$fail(expected) {
+    if (peg$currPos < peg$maxFailPos) {
+      return;
+    }
+
+    if (peg$currPos > peg$maxFailPos) {
+      peg$maxFailPos = peg$currPos;
+      peg$maxFailExpected = [];
+    }
+
+    peg$maxFailExpected.push(expected);
+  }
+
+  function peg$buildSimpleError(message, location) {
+    return new peg$SyntaxError(message, null, null, location);
+  }
+
+  function peg$buildStructuredError(expected, found, location) {
+    return new peg$SyntaxError(
+      peg$SyntaxError.buildMessage(expected, found),
+      expected,
+      found,
+      location
+    );
+  }
+
+  function peg$parsePublishIssueTitle() {
+    let s0, s1, s2, s3, s4, s5, s6, s7, s8, s9;
+
+    s0 = peg$currPos;
+    if (input.substr(peg$currPos, 9) === peg$c0) {
+      s1 = peg$c0;
+      peg$currPos += 9;
+    } else {
+      s1 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e0);
+      }
+    }
+    if (s1 !== peg$FAILED) {
+      if (input.substr(peg$currPos, 10) === peg$c1) {
+        s2 = peg$c1;
+        peg$currPos += 10;
+      } else {
+        s2 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e1);
+        }
+      }
+      if (s2 === peg$FAILED) {
+        s2 = null;
+      }
+      s3 = peg$parseRepository();
+      if (s3 !== peg$FAILED) {
+        s4 = peg$parsePath();
+        if (s4 === peg$FAILED) {
+          s4 = null;
+        }
+        s5 = peg$parseLegacyWorkspace();
+        if (s5 === peg$FAILED) {
+          s5 = null;
+        }
+        if (input.charCodeAt(peg$currPos) === 64) {
+          s6 = peg$c2;
+          peg$currPos++;
+        } else {
+          s6 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e2);
+          }
+        }
+        if (s6 !== peg$FAILED) {
+          s7 = peg$parseVersion();
+          if (s7 !== peg$FAILED) {
+            s8 = peg$currPos;
+            peg$silentFails++;
+            if (input.length > peg$currPos) {
+              s9 = input.charAt(peg$currPos);
+              peg$currPos++;
+            } else {
+              s9 = peg$FAILED;
+              if (peg$silentFails === 0) {
+                peg$fail(peg$e3);
+              }
+            }
+            peg$silentFails--;
+            if (s9 === peg$FAILED) {
+              s8 = undefined;
+            } else {
+              peg$currPos = s8;
+              s8 = peg$FAILED;
+            }
+            if (s8 !== peg$FAILED) {
+              peg$savedPos = s0;
+              s0 = peg$f0(s3, s4, s5, s7);
+            } else {
+              peg$currPos = s0;
+              s0 = peg$FAILED;
+            }
+          } else {
+            peg$currPos = s0;
+            s0 = peg$FAILED;
+          }
+        } else {
+          peg$currPos = s0;
+          s0 = peg$FAILED;
+        }
+      } else {
+        peg$currPos = s0;
+        s0 = peg$FAILED;
+      }
+    } else {
+      peg$currPos = s0;
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function peg$parseRepository() {
+    let s0, s1, s2;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = peg$parseRepositoryCharacter();
+    if (s2 !== peg$FAILED) {
+      while (s2 !== peg$FAILED) {
+        s1.push(s2);
+        s2 = peg$parseRepositoryCharacter();
+      }
+    } else {
+      s1 = peg$FAILED;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f1(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parseRepositoryCharacter() {
+    let s0;
+
+    s0 = input.charAt(peg$currPos);
+    if (peg$r0.test(s0)) {
+      peg$currPos++;
+    } else {
+      s0 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e4);
+      }
+    }
+
+    return s0;
+  }
+
+  function peg$parsePath() {
+    let s0, s1, s2, s3, s4;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = peg$currPos;
+    if (input.charCodeAt(peg$currPos) === 47) {
+      s3 = peg$c3;
+      peg$currPos++;
+    } else {
+      s3 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e5);
+      }
+    }
+    if (s3 !== peg$FAILED) {
+      s4 = peg$parsePathSegment();
+      if (s4 !== peg$FAILED) {
+        peg$savedPos = s2;
+        s2 = peg$f2(s4);
+      } else {
+        peg$currPos = s2;
+        s2 = peg$FAILED;
+      }
+    } else {
+      peg$currPos = s2;
+      s2 = peg$FAILED;
+    }
+    if (s2 !== peg$FAILED) {
+      while (s2 !== peg$FAILED) {
+        s1.push(s2);
+        s2 = peg$currPos;
+        if (input.charCodeAt(peg$currPos) === 47) {
+          s3 = peg$c3;
+          peg$currPos++;
+        } else {
+          s3 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e5);
+          }
+        }
+        if (s3 !== peg$FAILED) {
+          s4 = peg$parsePathSegment();
+          if (s4 !== peg$FAILED) {
+            peg$savedPos = s2;
+            s2 = peg$f2(s4);
+          } else {
+            peg$currPos = s2;
+            s2 = peg$FAILED;
+          }
+        } else {
+          peg$currPos = s2;
+          s2 = peg$FAILED;
+        }
+      }
+    } else {
+      s1 = peg$FAILED;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f3(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parsePathSegment() {
+    let s0, s1, s2;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = peg$parseRepositoryCharacter();
+    if (s2 !== peg$FAILED) {
+      while (s2 !== peg$FAILED) {
+        s1.push(s2);
+        s2 = peg$parseRepositoryCharacter();
+      }
+    } else {
+      s1 = peg$FAILED;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f4(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parseLegacyWorkspace() {
+    let s0, s1, s2, s3;
+
+    s0 = peg$currPos;
+    if (input.substr(peg$currPos, 13) === peg$c4) {
+      s1 = peg$c4;
+      peg$currPos += 13;
+    } else {
+      s1 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e6);
+      }
+    }
+    if (s1 !== peg$FAILED) {
+      s2 = peg$parseJsonString();
+      if (s2 !== peg$FAILED) {
+        if (input.substr(peg$currPos, 2) === peg$c5) {
+          s3 = peg$c5;
+          peg$currPos += 2;
+        } else {
+          s3 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e7);
+          }
+        }
+        if (s3 !== peg$FAILED) {
+          peg$savedPos = s0;
+          s0 = peg$f5(s2);
+        } else {
+          peg$currPos = s0;
+          s0 = peg$FAILED;
+        }
+      } else {
+        peg$currPos = s0;
+        s0 = peg$FAILED;
+      }
+    } else {
+      peg$currPos = s0;
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function peg$parseJsonString() {
+    let s0, s1, s2, s3, s4, s5;
+
+    s0 = peg$currPos;
+    s1 = peg$currPos;
+    s2 = peg$currPos;
+    if (input.charCodeAt(peg$currPos) === 34) {
+      s3 = peg$c6;
+      peg$currPos++;
+    } else {
+      s3 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e8);
+      }
+    }
+    if (s3 !== peg$FAILED) {
+      s4 = [];
+      s5 = peg$parseJsonCharacter();
+      while (s5 !== peg$FAILED) {
+        s4.push(s5);
+        s5 = peg$parseJsonCharacter();
+      }
+      if (input.charCodeAt(peg$currPos) === 34) {
+        s5 = peg$c6;
+        peg$currPos++;
+      } else {
+        s5 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e8);
+        }
+      }
+      if (s5 !== peg$FAILED) {
+        s3 = [s3, s4, s5];
+        s2 = s3;
+      } else {
+        peg$currPos = s2;
+        s2 = peg$FAILED;
+      }
+    } else {
+      peg$currPos = s2;
+      s2 = peg$FAILED;
+    }
+    if (s2 !== peg$FAILED) {
+      s1 = input.substring(s1, peg$currPos);
+    } else {
+      s1 = s2;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f6(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parseJsonCharacter() {
+    let s0, s1, s2;
+
+    s0 = input.charAt(peg$currPos);
+    if (peg$r1.test(s0)) {
+      peg$currPos++;
+    } else {
+      s0 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e9);
+      }
+    }
+    if (s0 === peg$FAILED) {
+      s0 = peg$currPos;
+      if (input.charCodeAt(peg$currPos) === 92) {
+        s1 = peg$c7;
+        peg$currPos++;
+      } else {
+        s1 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e10);
+        }
+      }
+      if (s1 !== peg$FAILED) {
+        s2 = input.charAt(peg$currPos);
+        if (peg$r2.test(s2)) {
+          peg$currPos++;
+        } else {
+          s2 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e11);
+          }
+        }
+        if (s2 !== peg$FAILED) {
+          s1 = [s1, s2];
+          s0 = s1;
+        } else {
+          peg$currPos = s0;
+          s0 = peg$FAILED;
+        }
+      } else {
+        peg$currPos = s0;
+        s0 = peg$FAILED;
+      }
+    }
+
+    return s0;
+  }
+
+  function peg$parseVersion() {
+    let s0, s1, s2;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = input.charAt(peg$currPos);
+    if (peg$r3.test(s2)) {
+      peg$currPos++;
+    } else {
+      s2 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e12);
+      }
+    }
+    if (s2 !== peg$FAILED) {
+      while (s2 !== peg$FAILED) {
+        s1.push(s2);
+        s2 = input.charAt(peg$currPos);
+        if (peg$r3.test(s2)) {
+          peg$currPos++;
+        } else {
+          s2 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e12);
+          }
+        }
+      }
+    } else {
+      s1 = peg$FAILED;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f7(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function join(characters) {
+    return characters.join("");
+  }
+
+  peg$result = peg$startRuleFunction();
+
+  const peg$success = peg$result !== peg$FAILED && peg$currPos === input.length;
+  function peg$throw() {
+    if (peg$result !== peg$FAILED && peg$currPos < input.length) {
+      peg$fail(peg$endExpectation());
+    }
+
+    throw peg$buildStructuredError(
+      peg$maxFailExpected,
+      peg$maxFailPos < input.length ? peg$getUnicode(peg$maxFailPos) : null,
+      peg$maxFailPos < input.length
+        ? peg$computeLocation(peg$maxFailPos, peg$maxFailPos + 1)
+        : peg$computeLocation(peg$maxFailPos, peg$maxFailPos)
+    );
+  }
+  if (options.peg$library) {
+    return /** @type {any} */ ({
+      peg$result,
+      peg$currPos,
+      peg$FAILED,
+      peg$maxFailExpected,
+      peg$maxFailPos,
+      peg$success,
+      peg$throw: peg$success ? undefined : peg$throw,
+    });
+  }
+  if (peg$success) {
+    return peg$result;
+  } else {
+    peg$throw();
+  }
+}
+
+module.exports = {
+  StartRules: ["PublishIssueTitle"],
+  SyntaxError: peg$SyntaxError,
+  parse: peg$parse,
+};
diff --git a/src/modules/publish-issue-title.peggy b/src/modules/publish-issue-title.peggy
new file mode 100644
index 0000000..cc9123a
--- /dev/null
+++ b/src/modules/publish-issue-title.peggy
@@ -0,0 +1,45 @@
+{
+  function join(characters) {
+    return characters.join("");
+  }
+}
+
+// Canonical grammar for publish issue titles. A path suffix is syntactic only:
+// the controller resolves a single segment as a workspace after checking out
+// the CI-approved revision.
+PublishIssueTitle
+  = "publish: " "getsentry/"? repo:Repository path:Path? workspace:LegacyWorkspace? "@" version:Version !. {
+      return {
+        repo,
+        path: path || "",
+        version,
+        ...(workspace ? { workspace } : {}),
+      };
+    }
+
+Repository
+  = characters:RepositoryCharacter+ { return join(characters); }
+
+RepositoryCharacter
+  = [A-Za-z0-9_.-]
+
+Path
+  = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
+
+PathSegment
+  = characters:RepositoryCharacter+ { return join(characters); }
+
+LegacyWorkspace
+  = " [workspace: " workspace:JsonString "] " { return workspace; }
+
+JsonString
+  = value:$("\"" JsonCharacter* "\"") { return value; }
+
+JsonCharacter
+  = [^"\\\u0000-\u001F]
+  // JSON.parse provides the authoritative escape validation so malformed
+  // legacy workspace values retain their existing clear diagnostic.
+  / "\\" [^\u0000-\u001F]
+
+Version
+  = characters:[A-Za-z0-9_.+-]+ { return join(characters); }
diff --git a/src/modules/publish-location.js b/src/modules/publish-location.js
new file mode 100644
index 0000000..5d7bbaf
--- /dev/null
+++ b/src/modules/publish-location.js
@@ -0,0 +1,45 @@
+function needsWorkspaceDiscovery({ path, workspace }) {
+  return !workspace && /^\.\/[A-Za-z0-9_.-]+$/.test(path);
+}
+
+function resolvePublishLocation({ path, workspace, workspaceNames }) {
+  if (workspace) {
+    if (path !== ".") {
+      throw new Error("A publish workspace must use the repository root path.");
+    }
+    return { path, workspace };
+  }
+
+  if (!needsWorkspaceDiscovery({ path, workspace })) {
+    return { path };
+  }
+
+  if (!workspaceNames.every(isWorkspaceName)) {
+    throw new Error(
+      "Craft workspace discovery returned an invalid workspace list."
+    );
+  }
+
+  const segments = path.slice(2).split("/");
+  if (
+    path.startsWith("./") &&
+    segments.length === 1 &&
+    workspaceNames.includes(segments[0])
+  ) {
+    return { path: ".", workspace: segments[0] };
+  }
+
+  return { path };
+}
+
+function isWorkspaceName(name) {
+  return (
+    typeof name === "string" &&
+    name !== "__proto__" &&
+    name !== "." &&
+    name !== ".." &&
+    /^[A-Za-z0-9_.-]+$/.test(name)
+  );
+}
+
+module.exports = { needsWorkspaceDiscovery, resolvePublishLocation };
diff --git a/src/modules/release-revision.js b/src/modules/release-revision.js
new file mode 100644
index 0000000..279dacf
--- /dev/null
+++ b/src/modules/release-revision.js
@@ -0,0 +1,29 @@
+const CHECK_RUNS_LINK =
+  /^Requested by: @[^\r\n]+\r?\n(?:[ \t]*\r?\n)?[ \t]*Merge target: [^\r\n]+\r?\n(?:[ \t]*\r?\n)?[ \t]*Quick links:\r?\n(?:[ \t]*\r?\n)?[ \t]*- \[View changes\]\([^\r\n]+\)\r?\n[ \t]*- \[View check runs\]\(https:\/\/github\.com\/getsentry\/(?<repo>[A-Za-z0-9_.-]+)\/commit\/(?<revision>[0-9a-f]{40})\/checks\/?\)(?=\r?\n|$)/;
+const CHECK_RUNS_LINK_COUNT = /^[ \t]*- \[View check runs\]\(/gm;
+
+function getReleaseRevision({ issueBody, repo }) {
+  if ((issueBody.match(CHECK_RUNS_LINK_COUNT) || []).length !== 1) {
+    throw new Error(
+      `Expected exactly one View check runs link in Quick links for getsentry/${repo}.`
+    );
+  }
+
+  const match = issueBody.match(CHECK_RUNS_LINK);
+  if (!match?.groups || match.groups.repo !== repo) {
+    throw new Error(
+      `Expected a View check runs link for getsentry/${repo} in the publish issue body.`
+    );
+  }
+
+  return match.groups.revision;
+}
+
+function updateReleaseRevision({ issueBody, repo, revision }) {
+  const currentRevision = getReleaseRevision({ issueBody, repo });
+  return issueBody.replace(CHECK_RUNS_LINK, (link) =>
+    link.replace(currentRevision, revision)
+  );
+}
+
+module.exports = { getReleaseRevision, updateReleaseRevision };
diff --git a/src/publish/resolve-ci-poller-input.js b/src/publish/resolve-ci-poller-input.js
new file mode 100644
index 0000000..f3ec4c4
--- /dev/null
+++ b/src/publish/resolve-ci-poller-input.js
@@ -0,0 +1,11 @@
+const { getCiPollerInput } = require("../modules/ci-poller-input");
+
+process.stdout.write(
+  JSON.stringify(
+    getCiPollerInput({
+      issueBody: process.env.PUBLISH_ISSUE_BODY || "",
+      title: process.env.PUBLISH_TITLE || "",
+      revision: process.env.PUBLISH_REVISION || "",
+    })
+  )
+);
diff --git a/src/publish/resolve-location.js b/src/publish/resolve-location.js
new file mode 100644
index 0000000..77b3472
--- /dev/null
+++ b/src/publish/resolve-location.js
@@ -0,0 +1,29 @@
+const core = require("@actions/core");
+const {
+  needsWorkspaceDiscovery,
+  resolvePublishLocation,
+} = require("../modules/publish-location");
+
+function resolveLocation() {
+  const input = JSON.parse(process.env.PUBLISH_ARGS || "");
+  const workspaceNames = needsWorkspaceDiscovery(input)
+    ? JSON.parse(process.env.CRAFT_WORKSPACE_NAMES || "")
+    : [];
+
+  if (!Array.isArray(workspaceNames)) {
+    throw new Error(
+      "Craft workspace discovery returned an invalid workspace list."
+    );
+  }
+
+  core.setOutput(
+    "result",
+    resolvePublishLocation({
+      path: input.path,
+      workspace: input.workspace,
+      workspaceNames,
+    })
+  );
+}
+
+resolveLocation();
diff --git a/src/publish/resolve-release-revision.js b/src/publish/resolve-release-revision.js
new file mode 100644
index 0000000..71f62cc
--- /dev/null
+++ b/src/publish/resolve-release-revision.js
@@ -0,0 +1,15 @@
+const core = require("@actions/core");
+const { getReleaseRevision } = require("../modules/release-revision");
+
+function resolveReleaseRevision() {
+  const { repo } = JSON.parse(process.env.PUBLISH_ARGS || "");
+  core.setOutput(
+    "revision",
+    getReleaseRevision({
+      issueBody: process.env.PUBLISH_ISSUE_BODY || "",
+      repo,
+    })
+  );
+}
+
+resolveReleaseRevision();
diff --git a/yarn.lock b/yarn.lock
index 571d807..1fcddf4 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -535,6 +535,13 @@
   resolved "https://registry.yarnpkg.com/@oxc-project/types/-/types-0.133.0.tgz#2e282ef9e1d26e06b68ccd14b73f310a3b2cf7f8"
   integrity sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==
 
+"@peggyjs/from-mem@3.1.3":
+  version "3.1.3"
+  resolved "https://registry.yarnpkg.com/@peggyjs/from-mem/-/from-mem-3.1.3.tgz#2956c3c68ec2e08e55178049a327009ee61541b8"
+  integrity sha512-LLlgtfXIaeYXoOYovOI0spLM8ZXaqkAlmcRRrLzHJzLMqkU6Sw0R4KMoCoHx1PjaP815pSCBlS+BN6aD8t1Jgg==
+  dependencies:
+    semver "7.7.4"
+
 "@prisma/instrumentation@6.19.0":
   version "6.19.0"
   resolved "https://registry.yarnpkg.com/@prisma/instrumentation/-/instrumentation-6.19.0.tgz#46d15adc8bc4a5a3167032eea6d0a7aa64fb7d93"
@@ -944,6 +951,11 @@ color-name@~1.1.4:
   resolved "https://registry.yarnpkg.com/color-name/-/color-name-1.1.4.tgz#c2a09a87acbde69543de6f63fa3995c826c536a2"
   integrity sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==
 
+commander@^14.0.3:
+  version "14.0.3"
+  resolved "https://registry.yarnpkg.com/commander/-/commander-14.0.3.tgz#425d79b48f9af82fcd9e4fc1ea8af6c5ec07bbc2"
+  integrity sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==
+
 concat-map@0.0.1:
   version "0.0.1"
   resolved "https://registry.yarnpkg.com/concat-map/-/concat-map-0.0.1.tgz#d8a96bd77fd68df7793a73036a3ba0d5405d477b"
@@ -1523,6 +1535,15 @@ pathe@^2.0.3:
   resolved "https://registry.yarnpkg.com/pathe/-/pathe-2.0.3.tgz#3ecbec55421685b70a9da872b2cff3e1cbed1716"
   integrity sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==
 
+peggy@5.1.0:
+  version "5.1.0"
+  resolved "https://registry.yarnpkg.com/peggy/-/peggy-5.1.0.tgz#8e2a681128cf776648417f60394a40b4a712f503"
+  integrity sha512-IEo5aYRZ2kXH4Qby06cjtL114PZnwLoTiA41vUmg2vPZgANn+c87m5BUurhuDr5/cu758ZlpgsAfBVx+hhO5+w==
+  dependencies:
+    "@peggyjs/from-mem" "3.1.3"
+    commander "^14.0.3"
+    source-map-generator "2.0.6"
+
 pg-int8@1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/pg-int8/-/pg-int8-1.0.1.tgz#943bd463bf5b71b4170115f80f8efc9a0c0eb78c"
@@ -1661,6 +1682,11 @@ run-parallel@^1.1.9:
   dependencies:
     queue-microtask "^1.2.2"
 
+semver@7.7.4:
+  version "7.7.4"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.4.tgz#28464e36060e991fa7a11d0279d2d3f3b57a7e8a"
+  integrity sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==
+
 shebang-command@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/shebang-command/-/shebang-command-2.0.0.tgz#ccd0af4f8835fbdc265b82461aaf0c36663f34ea"
@@ -1678,6 +1704,11 @@ siginfo@^2.0.0:
   resolved "https://registry.yarnpkg.com/siginfo/-/siginfo-2.0.0.tgz#32e76c70b79724e3bb567cb9d543eb858ccfaf30"
   integrity sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==
 
+source-map-generator@2.0.6:
+  version "2.0.6"
+  resolved "https://registry.yarnpkg.com/source-map-generator/-/source-map-generator-2.0.6.tgz#284776dff4bd5efdefead67aaed0c0f85f5a42ca"
+  integrity sha512-IlassDs1Ve8nV6uyQZXF9kdkJpVKnMte2JZQXu13M0A5zwc+vu6+LNHfmxsHBMDtoZE21RHiKI0/xvpecZRCNg==
+
 source-map-js@^1.2.1:
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46"