diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index a3db430..487e9da 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -48,6 +48,11 @@ jobs:
           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
           owner: getsentry # create token with access to all getsentry repos
 
+      - name: Check out publish controller
+        uses: actions/checkout@v7
+        with:
+          path: .__publish__
+
       - name: Check CI status for ci-pending issues
         env:
           # Use the sentry-internal-app token for label changes on this
@@ -88,30 +93,23 @@ jobs:
 
           # Check each issue's CI status
           echo "$issues" | jq -c '.[]' | while read -r issue; do
+            (
             number=$(echo "$issue" | jq -r '.number')
             title=$(echo "$issue" | jq -r '.title')
-            body=$(echo "$issue" | jq -r '.body')
-
-            # Parse repo and version from title: "publish: owner/repo[/path]@version"
-            # Only take owner/repo (first two segments) — monorepos like
-            # "getsentry/relay/py@0.9.26" have a path suffix that isn't part
-            # of the GitHub repo name.
-            repo=$(echo "$title" | sed -n 's|^publish: \([^/]*/[^/@]*\).*@.*|\1|p')
-            version=$(echo "$title" | sed -n 's/^publish: .*@\(.*\)/\1/p')
-
-            if [[ -z "$repo" || -z "$version" ]]; then
-              echo "::warning::Could not parse repo/version from issue #${number}: ${title}"
-              continue
-            fi
-
-            # Extract the commit SHA from the "View check runs" link in the issue body.
-            # Link format: https://github.com/{owner}/{repo}/commit/{SHA}/checks/
-            issue_sha=$(echo "$body" | grep -oP '(?<=commit/)[0-9a-f]{40}(?=/checks)' || true)
-
-            if [[ -z "$issue_sha" ]]; then
-              echo "::warning::Could not extract commit SHA from issue #${number} body, skipping."
-              continue
+            body_file=$(mktemp)
+            resolver_output_file=""
+            updated_body_file=""
+            trap 'for file in "${body_file:-}" "${resolver_output_file:-}" "${updated_body_file:-}"; do [[ -z "$file" ]] || rm -f "$file"; done' EXIT
+            printf '%s' "$issue" | jq -jr '.body' > "$body_file"
+
+            if ! publish_input=$(PUBLISH_ISSUE_BODY_FILE="$body_file" PUBLISH_TITLE="$title" \
+              node .__publish__/src/publish/resolve-ci-poller-input.js); then
+              echo "::warning::Could not parse canonical publish input for issue #${number}, skipping."
+              exit 0
             fi
+            repo=$(echo "$publish_input" | jq -r '.repo')
+            version=$(echo "$publish_input" | jq -r '.version')
+            issue_sha=$(echo "$publish_input" | jq -r '.revision')
 
             # Resolve the release branch name from the original commit's check
             # suites (avoids hard-coding "release/{version}" since repos can
@@ -149,8 +147,19 @@ jobs:
             # for humans and for subsequent poller runs.
             if [[ "$sha" != "$issue_sha" ]]; then
               echo "  Branch ${branch} moved: ${issue_sha:0:8} → ${sha:0:8}. Updating issue."
-              updated_body="${body//${issue_sha}/${sha}}"
-              gh issue edit "$number" -R "$GITHUB_REPOSITORY" --body "$updated_body"
+              resolver_output_file=$(mktemp)
+              updated_body_file=$(mktemp)
+              if ! PUBLISH_ISSUE_BODY_FILE="$body_file" PUBLISH_REVISION="$sha" PUBLISH_TITLE="$title" \
+                node .__publish__/src/publish/resolve-ci-poller-input.js > "$resolver_output_file"; then
+                echo "::warning::Could not update canonical publish input for issue #${number}, skipping."
+                exit 0
+              fi
+              if ! jq -ejr 'if (.issueBody | type) == "string" and (.issueBody | length) > 0 then .issueBody else error("Expected nonempty issueBody string") end' \
+                "$resolver_output_file" > "$updated_body_file"; then
+                echo "::warning::Could not decode updated publish issue body for issue #${number}, skipping."
+                exit 0
+              fi
+              gh issue edit "$number" -R "$GITHUB_REPOSITORY" --body-file "$updated_body_file"
             fi
 
             echo "Checking CI for ${repo}@${version} commit ${sha:0:8} (issue #${number})..."
@@ -161,7 +170,7 @@ jobs:
             # installed on this repo) — don't try to derive state from partial data.
             if ! status_json=$(gh_api_release "repos/${repo}/commits/${sha}/status"); then
               echo "  Could not fetch commit status for ${repo}@${sha:0:8}, skipping."
-              continue
+              exit 0
             fi
             commit_status=$(echo "$status_json" | jq -r '.state')
             total_statuses=$(echo "$status_json" | jq -r '.total_count')
@@ -171,7 +180,7 @@ jobs:
             # '.check_runs[]' and count with a second jq pass.
             if ! all_checks=$(gh_api_release --paginate "repos/${repo}/commits/${sha}/check-runs" --jq '.check_runs[]'); then
               echo "  Could not fetch check runs for ${repo}@${sha:0:8}, skipping."
-              continue
+              exit 0
             fi
 
             total_checks=$(echo "$all_checks" | jq -s 'length')
@@ -187,7 +196,7 @@ jobs:
             # otherwise CI hasn't started yet and all counts would be 0.
             if [[ "$total_checks" == "0" && "$total_statuses" == "0" ]]; then
               echo "  No check runs or commit statuses found — CI may not have started yet."
-              continue
+              exit 0
             fi
 
             # CI is ready when:
@@ -243,6 +252,7 @@ jobs:
               comment_body="CI **commit status** checks failed for ${repo}@${version} (\`${sha:0:8}\`). Publishing is blocked."$'\n\n'"Failed status checks:"$'\n'"${failed_contexts}"$'\n\n'"[View check runs](https://github.com/${repo}/commit/${sha}/checks/)"$'\n\n'"Re-add the **accepted** label once CI is fixed to retry."
               gh issue comment "$number" -R "$GITHUB_REPOSITORY" --body "$comment_body"
             fi
+            )
           done
 
       # Cleanup: check if we should disable the poller. Runs even if the
diff --git a/.github/workflows/cocoapods-keepalive.yml b/.github/workflows/cocoapods-keepalive.yml
index 21c0696..9c11b0e 100644
--- a/.github/workflows/cocoapods-keepalive.yml
+++ b/.github/workflows/cocoapods-keepalive.yml
@@ -1,4 +1,4 @@
-name: "CocoaPods Token Keep-Alive"
+name: CocoaPods Token Keep-Alive
 
 on:
   schedule:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cff6bc3..2635ea6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -117,7 +117,7 @@ jobs:
       SENTRY_DSN: "https://303a687befb64dc2b40ce4c96de507c5@o1.ingest.sentry.io/6183838"
     steps:
       - name: Get repo contents
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: .__publish__
 
@@ -135,36 +135,19 @@ jobs:
         id: inputs
         run: node .__publish__/src/publish/inputs.js
 
+      - name: Resolve CI-approved release revision
+        id: release-revision
+        env:
+          PUBLISH_ARGS: ${{ steps.inputs.outputs.result }}
+          PUBLISH_ISSUE_BODY: ${{ github.event.issue.body }}
+        run: node .__publish__/src/publish/resolve-release-revision.js
+
       - name: Inform start
-        if: steps.inputs.outcome == 'success'
+        if: steps.inputs.outcome == 'success' && steps.release-revision.outcome == 'success'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: node .__publish__/src/publish/post-workflow-details.js
 
-      # Setting the target repo branch will cause the craft config (.craft.yml) to be taken from the checked out branch
-      # By default, we check out the default branch of the repo.
-      # If you need to maintain diverging craft configs on different branches, add your repo and the merge target branch
-      # (i.e. the branch craft will merge the release branch into) into the if condition below.
-      - name: Set target repo checkout branch
-        # Note: Branches registered here MUST BE protected in the target repo!
-        if: |
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-migr8' && fromJSON(steps.inputs.outputs.result).merge_target == 'tmp-merge-target' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'v10' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'v9' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'v8' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'v7' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-javascript' && fromJSON(steps.inputs.outputs.result).merge_target == 'master' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-python' && fromJSON(steps.inputs.outputs.result).merge_target == 'alpha' ||
-          fromJSON(steps.inputs.outputs.result).repo == 'sentry-wizard' && fromJSON(steps.inputs.outputs.result).merge_target == '1.x' ||
-          false
-        id: target-repo-branch
-        env:
-          MERGE_TARGET: ${{ fromJSON(steps.inputs.outputs.result).merge_target }}
-          REPO: ${{ fromJSON(steps.inputs.outputs.result).repo }}
-        run: |
-          echo "taking craft config from branch \"$MERGE_TARGET\" in \"$REPO\""
-          echo "target_repo_branch=$MERGE_TARGET" >> "$GITHUB_OUTPUT"
-
       - name: Get Release Bot auth token
         id: token
         uses: actions/create-github-app-token@v3
@@ -173,23 +156,32 @@ jobs:
           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
           owner: getsentry # create token that have access to all repos
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         name: Check out target repo
         if: ${{ steps.inputs.outputs.result }}
         with:
           path: __repo__
-          ref: ${{ steps.target-repo-branch.outputs.target_repo_branch || ''}}
+          ref: ${{ steps.release-revision.outputs.revision }}
           repository: getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }}
           token: ${{ steps.token.outputs.token }}
           fetch-depth: 0
 
+      - name: Resolve publish location
+        id: location
+        env:
+          PUBLISH_ARGS: ${{ steps.inputs.outputs.result }}
+          PUBLISH_REPOSITORY_DIRECTORY: __repo__
+        run: node .__publish__/src/publish/discover-location.js
+
       - name: Set targets
+        id: craft-state
         shell: bash
         if: fromJSON(steps.inputs.outputs.result).targets
         env:
           CRAFT_PUBLISH_REPO: ${{ fromJSON(steps.inputs.outputs.result).repo }}
-          CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.inputs.outputs.result).path }}
+          CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.location.outputs.result).path }}
           CRAFT_PUBLISH_VERSION: ${{ fromJSON(steps.inputs.outputs.result).version }}
+          CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}
           CRAFT_PUBLISH_TARGETS_JSON: ${{ toJSON(fromJSON(steps.inputs.outputs.result).targets) }}
         run: |
           # Render the "already published" JSON.
@@ -209,22 +201,31 @@ jobs:
           # __repo__/<path>` and Node's process.cwd() canonicalisation,
           # the cwd is `/github/workspace/__repo__` (root) or
           # `/github/workspace/__repo__/subdir/...` (monorepo).
-          case "$CRAFT_PUBLISH_PATH" in
-            .|./) container_cwd="/github/workspace/__repo__" ;;
-            ./*) container_cwd="/github/workspace/__repo__/${CRAFT_PUBLISH_PATH#./}" ;;
-            *)   container_cwd="/github/workspace/__repo__/${CRAFT_PUBLISH_PATH}" ;;
-          esac
-          # Strip any trailing slash to match Node's canonicalisation.
-          container_cwd="${container_cwd%/}"
+          container_cwd="$(realpath -m "/github/workspace/__repo__/$CRAFT_PUBLISH_PATH")"
+          if [[ "$container_cwd" != "/github/workspace/__repo__" && "$container_cwd" != /github/workspace/__repo__/* ]]; then
+            echo "::error::Publish path must remain inside the target checkout."
+            exit 1
+          fi
           cwd_hash="$(printf %s "$container_cwd" | sha1sum | cut -c1-12)"
           sanitise() { printf %s "$1" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9._-]\+/_/g; s/^_\+//; s/_\+$//'; }
           owner_sanitised="$(sanitise getsentry)"
           repo_sanitised="$(sanitise "$CRAFT_PUBLISH_REPO")"
           version_sanitised="$(sanitise "$CRAFT_PUBLISH_VERSION")"
+          version_component="$version_sanitised"
+          if [[ "$version_sanitised" != "$CRAFT_PUBLISH_VERSION" ]]; then
+            version_encoded="$(printf %s "$CRAFT_PUBLISH_VERSION" | base64 -w 0 | tr '+/' '-_' | tr -d '=')"
+            version_component="version-${version_encoded}"
+          fi
+          workspace_prefix=""
+          if [[ -n "$CRAFT_PUBLISH_WORKSPACE" ]]; then
+            workspace_encoded="$(printf %s "$CRAFT_PUBLISH_WORKSPACE" | base64 -w 0 | tr '+/' '-_' | tr -d '=')"
+            workspace_prefix="workspace-${workspace_encoded}-"
+          fi
           state_dir="$GITHUB_WORKSPACE/.craft-state/craft"
-          state_file="$state_dir/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${version_sanitised}.json"
+          state_file="$state_dir/publish-state-${owner_sanitised}-${repo_sanitised}-${cwd_hash}-${workspace_prefix}${version_component}.json"
           mkdir -p "$state_dir"
           printf %s "$payload" > "$state_file"
+          echo "state_file=$state_file" >> "$GITHUB_OUTPUT"
           echo "Wrote state file: $state_file"
 
       - uses: docker://getsentry/craft:latest
@@ -235,8 +236,8 @@ jobs:
             -e
             -c "
             export HOME=/root &&
-            cd __repo__/${{ fromJSON(steps.inputs.outputs.result).path }} &&
-            exec craft publish ${{ fromJSON(steps.inputs.outputs.result).version }}
+            cd __repo__/${{ fromJSON(steps.location.outputs.result).path }} &&
+            exec craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}
             "
         env:
           # Pin Craft's publish-state directory to a path outside
@@ -246,6 +247,10 @@ jobs:
           CRAFT_MERGE_TARGET: ${{ fromJSON(steps.inputs.outputs.result).merge_target }}
           CRAFT_LOG_LEVEL: ${{ vars.CRAFT_LOG_LEVEL || 'Info' }}
           CRAFT_DRY_RUN: ${{ fromJSON(steps.inputs.outputs.result).dry_run }}
+          CRAFT_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}
+          # State must follow the issue checkout identity, not a workspace's
+          # optional GitHub release-repository override.
+          CRAFT_PUBLISH_STATE_GITHUB_REPO: getsentry/${{ fromJSON(steps.inputs.outputs.result).repo }}
           GIT_COMMITTER_NAME: sentry-release-bot[bot]
           GIT_AUTHOR_NAME: sentry-release-bot[bot]
           EMAIL: 180476844+sentry-release-bot[bot]@users.noreply.github.com
@@ -287,6 +292,7 @@ jobs:
         if: ${{ cancelled() || failure() }}
         env:
           PUBLISH_ARGS: ${{ steps.inputs.outputs.result }}
+          CRAFT_STATE_FILE_PATH: ${{ steps.craft-state.outputs.state_file }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: node .__publish__/src/publish/update-issue.js
 
diff --git a/README.md b/README.md
index b8e07f0..4cbc9b9 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,11 @@ flowchart TD
 1. Observe the issue for information about the triggered run
 1. The issue will automatically be closed when publishing succeeds
 
+## Publish Issue Format
+
+The release workflow creates publish requests with a stable title and body contract. See
+[Publish Issue Format](docs/publish-issue-format.md) for the accepted syntax and fields.
+
 ## CalVer
 
 To enable calendar versioning, add the following to your `.craft.yml`:
diff --git a/docs/publish-issue-format.md b/docs/publish-issue-format.md
new file mode 100644
index 0000000..9f9624e
--- /dev/null
+++ b/docs/publish-issue-format.md
@@ -0,0 +1,107 @@
+# Publish Issue Format
+
+The Publish workflow treats a publish issue as a release request. The title identifies
+the release; the body supplies the merge target and selected targets. Do not edit the
+title by hand unless it remains valid under this format.
+
+## Title
+
+Every title starts with `publish: `. The following canonical Peggy grammar is
+generated from `src/modules/publish-issue-title.peggy`:
+
+<!-- BEGIN GENERATED TITLE GRAMMAR -->
+```peggy
+// Canonical grammar for publish issue titles. A path suffix is syntactic only:
+// the controller resolves the complete suffix as a workspace after checking
+// out the CI-approved revision.
+PublishIssueTitle
+  = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. {
+      return {
+        repo,
+        path: path || "",
+        version,
+      };
+    }
+
+Repository
+  = characters:RepositoryCharacter+ { return join(characters); }
+
+RepositoryCharacter
+  = [A-Za-z0-9_.-]
+
+Path
+  = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
+
+PathSegment
+  = characters:RepositoryCharacter+ { return join(characters); }
+
+Version
+  = characters:[A-Za-z0-9_.+-]+ { return join(characters); }
+```
+<!-- END GENERATED TITLE GRAMMAR -->
+
+New Craft requests always include the checkout repository identity. A workspace
+release uses its full concrete path as the title suffix:
+
+```text
+publish: getsentry/sentry@21.3.1
+publish: getsentry/toolkit/packages/cli@1.2.3
+```
+
+Workspace paths in titles use ASCII path segments matching `[A-Za-z0-9_.-]+`,
+except `.`, `..`, `__proto__`, and segments starting with `-`. Craft preserves
+their exact spelling.
+
+Repository identities use the same safe token rule and cannot be `.`, `..`,
+`__proto__`, or start with `-`. Versions must be valid Craft semantic versions;
+build metadata such as `4.2.6+sentry1` is valid.
+
+The controller resolves the complete suffix only after it checks out the exact
+CI-approved revision from the `View check runs` link. When that checkout has a root
+`.craft.yml`, `craft workspace list` supplies the exact concrete workspace paths. A
+suffix that exactly matches one of those paths is a workspace; every other suffix
+remains a checkout path. The controller never normalizes names. A missing root
+`.craft.yml` always means checkout-path behavior. Discovery errors with a root
+configuration fail the release.
+
+`getsentry/` remains optional when parsing existing issues. Paths must use only
+safe workspace segments.
+
+## Body
+
+The request must start with these body fields:
+
+```markdown
+Requested by: @<actor>
+
+Merge target: <branch-or-(default)>
+
+Quick links:
+
+- [View changes](compare-url)
+- [View check runs](checks-url)
+
+Assign the **accepted** label to this issue to approve the release.
+
+### Targets
+
+- [ ] <target-id>
+
+Checked targets will be skipped (either already published or user-requested skip). Uncheck to retry a target.
+```
+
+`Merge target` is required. `(default)` means the target repository's default branch.
+The branch may contain letters, digits, `_`, `.`, `/`, and `-`.
+
+The workflow reads checked entries (`- [x] <target-id>`) in the `### Targets` section.
+It preserves checked entries when Craft refreshes an existing request. During a failed
+release, the controller updates target checkboxes from the secure Craft publish-state
+file; targets marked checked are skipped on retry unless manually unchecked.
+
+The requester, approval guidance, and optional changelog section are informational. The
+`Quick links` must follow `Requested by` and `Merge target`, and contain exactly one `View
+changes` line followed by exactly one `View check runs` line for the checkout repository.
+The controller and CI poller use that check-runs revision as the release authority.
+The `accepted` label starts CI waiting. Publishing starts only when the CI poller
+adds a fresh `ci-ready` label to an open, accepted issue with neither `ci-pending`
+nor `ci-failed`. `dry-run` requests dry-run mode.
diff --git a/package.json b/package.json
index d59a8b6..0790379 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,9 @@
     "undici": "^6.23.0"
   },
   "scripts": {
-    "test": "vitest run",
+    "generate": "node scripts/generate-publish-issue-title-parser.js",
+    "check:generated": "node scripts/generate-publish-issue-title-parser.js --check",
+    "test": "yarn check:generated && vitest run",
     "test:watch": "vitest",
     "lint": "eslint src .github --ignore-pattern '!.github'",
     "prettier": "prettier --write src"
@@ -24,6 +26,7 @@
     "eslint": "^8.9.0",
     "eslint-config-prettier": "^8.3.0",
     "eslint-plugin-yml": "^0.13.0",
+    "peggy": "5.1.0",
     "prettier": "^2.2.1",
     "vitest": "^4.1.0"
   },
diff --git a/scripts/generate-publish-issue-title-parser.js b/scripts/generate-publish-issue-title-parser.js
new file mode 100644
index 0000000..2d0203a
--- /dev/null
+++ b/scripts/generate-publish-issue-title-parser.js
@@ -0,0 +1,104 @@
+const fs = require("fs");
+const path = require("path");
+const peggy = require("peggy");
+const prettier = require("prettier");
+
+const grammarPath = path.join(
+  __dirname,
+  "..",
+  "src",
+  "modules",
+  "publish-issue-title.peggy"
+);
+const outputPath = path.join(
+  __dirname,
+  "..",
+  "src",
+  "modules",
+  "publish-issue-title.js"
+);
+const documentationPath = path.join(
+  __dirname,
+  "..",
+  "docs",
+  "publish-issue-format.md"
+);
+function generateDocumentation({ documentation, titleGrammar }) {
+  const markers = documentation.match(
+    /<!--\s*(?:BEGIN|END)\s+GENERATED\s+TITLE\s+GRAMMAR\b/g
+  );
+
+  if (
+    markers?.filter(marker => marker.includes("BEGIN")).length !== 1 ||
+    markers?.filter(marker => marker.includes("END")).length !== 1
+  ) {
+    throw new Error("Could not find the generated title grammar in the documentation.");
+  }
+
+  const marker = /<!--\s*BEGIN\s+GENERATED\s+TITLE\s+GRAMMAR\s*-->\n[\s\S]*?<!--\s*END\s+GENERATED\s+TITLE\s+GRAMMAR\s*-->/.exec(
+    documentation
+  );
+
+  if (!marker) {
+    throw new Error("Could not find the generated title grammar in the documentation.");
+  }
+
+  return documentation.replace(
+    marker[0],
+    `<!-- BEGIN GENERATED TITLE GRAMMAR -->\n\`\`\`peggy\n${titleGrammar.trim()}\n\`\`\`\n<!-- END GENERATED TITLE GRAMMAR -->`
+  );
+}
+
+function main() {
+  const grammar = fs.readFileSync(grammarPath, "utf8");
+  const parser = peggy.generate(grammar, {
+    allowedStartRules: [
+      "PublishIssueTitle",
+      "ReleaseRevision",
+      "CheckRunsLinkCount",
+    ],
+    format: "commonjs",
+    grammarSource: "publish-issue-title.peggy",
+    output: "source",
+  });
+
+  const generatedParser = prettier.format(`/* eslint-disable */\n${parser}`, {
+    filepath: outputPath,
+  });
+  const titleGrammar = grammar.match(
+    /\/\/ BEGIN TITLE GRAMMAR\n(?<grammar>[\s\S]*?)\/\/ END TITLE GRAMMAR/
+  )?.groups?.grammar;
+
+  if (!titleGrammar) {
+    throw new Error("Could not find the publish issue title grammar.");
+  }
+
+  const documentation = fs.readFileSync(documentationPath, "utf8");
+  const generatedDocumentation = generateDocumentation({
+    documentation,
+    titleGrammar,
+  });
+
+  if (process.argv.includes("--check")) {
+    const currentParser = fs.readFileSync(outputPath, "utf8");
+    if (currentParser !== generatedParser) {
+      throw new Error(
+        "The generated publish issue title parser is stale. Run `yarn generate`."
+      );
+    }
+    if (documentation !== generatedDocumentation) {
+      throw new Error(
+        "The generated publish issue title documentation is stale. Run `yarn generate`."
+      );
+    }
+  } else {
+    fs.writeFileSync(outputPath, generatedParser);
+    fs.writeFileSync(documentationPath, generatedDocumentation);
+  }
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { generateDocumentation };
diff --git a/src/modules/__tests__/ci-poller-input.js b/src/modules/__tests__/ci-poller-input.js
new file mode 100644
index 0000000..140ccef
--- /dev/null
+++ b/src/modules/__tests__/ci-poller-input.js
@@ -0,0 +1,97 @@
+import { readFileSync } from "fs";
+import { join } from "path";
+
+import { expect, test } from "vitest";
+
+const { getCiPollerInput } = require("../ci-poller-input.js");
+
+const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
+const issueBody = `Requested by: @byk
+
+Merge target: (default)
+
+Quick links:
+- [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
+- [View check runs](https://github.com/getsentry/toolkit/commit/${REVISION}/checks/)`;
+
+test("parses root and full-path publish titles", () => {
+  expect(
+    getCiPollerInput({
+      issueBody,
+      title: "publish: getsentry/toolkit/cli@1.2.3",
+    })
+  ).toEqual({
+    repo: "getsentry/toolkit",
+    revision: REVISION,
+    version: "1.2.3",
+  });
+
+  expect(
+    getCiPollerInput({
+      issueBody,
+      title: "publish: toolkit/packages/cli/v2@1.2.3",
+    })
+  ).toEqual({
+    repo: "getsentry/toolkit",
+    revision: REVISION,
+    version: "1.2.3",
+  });
+});
+
+test("uses the shared resolver in the CI poller", () => {
+  const workflow = readFileSync(
+    join(__dirname, "../../../.github/workflows/ci-poller.yml"),
+    "utf8"
+  );
+
+  expect(workflow).toContain("name: Check out publish controller");
+  expect(workflow).toContain("path: .__publish__");
+  expect(workflow).toContain(
+    "node .__publish__/src/publish/resolve-ci-poller-input.js"
+  );
+  expect(workflow).not.toContain("grep -oP '(?<=commit/");
+});
+
+test.each(["-toolkit", ".", "..", "__proto__"])(
+  "rejects unsafe repository identity before CI API calls: %s",
+  repo => {
+    expect(() =>
+      getCiPollerInput({
+        issueBody,
+        title: `publish: getsentry/${repo}@1.2.3`,
+      })
+    ).toThrow("Invalid publish issue repository");
+  }
+);
+
+test.each(["--config", "1.2"])(
+  "rejects invalid release version before CI API calls: %s",
+  version => {
+    expect(() =>
+      getCiPollerInput({
+        issueBody,
+        title: `publish: getsentry/toolkit@${version}`,
+      })
+    ).toThrow("Invalid publish issue version");
+  }
+);
+
+test.each(["publish: getsentry/@1.2.3", "publish: getsentry/toolkit$@1.2.3"])(
+  "rejects malformed repository identity before CI API calls: %s",
+  title => {
+    expect(() => getCiPollerInput({ issueBody, title })).toThrow(
+      "Invalid publish issue title"
+    );
+  }
+);
+
+test.each([
+  "publish: getsentry/toolkit/../other@1.2.3",
+  "publish: getsentry/toolkit/./other@1.2.3",
+  "publish: getsentry/toolkit/__proto__/other@1.2.3",
+  "publish: getsentry/toolkit/--config@1.2.3",
+])("rejects unsafe publish path before CI API calls: %s", title => {
+  expect(() => getCiPollerInput({ issueBody, title })).toThrow(
+    "Invalid publish issue path"
+  );
+});
diff --git a/src/modules/__tests__/ci-poller-workflow.js b/src/modules/__tests__/ci-poller-workflow.js
new file mode 100644
index 0000000..c859f5a
--- /dev/null
+++ b/src/modules/__tests__/ci-poller-workflow.js
@@ -0,0 +1,197 @@
+import {
+  mkdtempSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { spawnSync } from "child_process";
+
+import { afterEach, expect, test } from "vitest";
+
+const temporaryDirectories = [];
+const INITIAL_REVISION = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+const UPDATED_REVISION = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+
+function getPollerScript() {
+  const workflow = readFileSync(
+    join(__dirname, "../../../.github/workflows/ci-poller.yml"),
+    "utf8"
+  );
+  const section = workflow.match(
+    / {6}- name: Check CI status for ci-pending issues[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- name: Check for remaining pending issues/
+  );
+
+  if (!section?.groups?.script) {
+    throw new Error("Missing CI poller workflow script");
+  }
+
+  return section.groups.script.replace(/^ {10}/gm, "");
+}
+
+function writeExecutable(path, content) {
+  writeFileSync(path, content, { mode: 0o755 });
+}
+
+function runPoller({ initialExit = 0, updateOutput = "", issueBody = "" } = {}) {
+  const directory = mkdtempSync(join(tmpdir(), "ci-poller-workflow-test-"));
+  temporaryDirectories.push(directory);
+  const binDirectory = join(directory, "bin");
+  const temporaryFiles = join(directory, "temporary-files");
+  const logFile = join(directory, "gh.log");
+  const capturedBody = join(directory, "captured-body");
+  mkdirSync(binDirectory);
+  mkdirSync(temporaryFiles);
+  writeFileSync(logFile, "");
+
+  writeExecutable(
+    join(binDirectory, "node"),
+    `#!/usr/bin/env bash
+set -eu
+if [[ -n "\${PUBLISH_REVISION:-}" ]]; then
+  printf '%s' "\${NODE_UPDATE_OUTPUT:-}"
+elif [[ "\${NODE_INITIAL_EXIT:-0}" != "0" ]]; then
+  exit "\${NODE_INITIAL_EXIT}"
+else
+  printf '%s' "\${NODE_INITIAL_OUTPUT}"
+fi
+`
+  );
+  writeExecutable(
+    join(binDirectory, "mktemp"),
+    `#!/usr/bin/env bash
+set -eu
+counter_file="$TEMPORARY_FILES/counter"
+counter=0
+[[ ! -f "$counter_file" ]] || counter=$(<"$counter_file")
+counter=$((counter + 1))
+printf '%s' "$counter" > "$counter_file"
+file="$TEMPORARY_FILES/$counter"
+: > "$file"
+printf '%s\n' "$file"
+`
+  );
+  writeExecutable(
+    join(binDirectory, "gh"),
+    `#!/usr/bin/env bash
+set -eu
+printf '%s\n' "$*" >> "$GH_LOG"
+case "$*" in
+  "issue list "*)
+    printf '%s' "$GH_ISSUES"
+    ;;
+  *"/check-suites"*)
+    printf '%s' "release/1.2.3"
+    ;;
+  *"/git/ref/heads/"*)
+    printf '%s' "${UPDATED_REVISION}"
+    ;;
+  *"/status"*)
+    printf '%s' '{"state":"success","total_count":0}'
+    ;;
+  *"/check-runs"*)
+    printf '%s' '{"status":"completed","conclusion":"success"}'
+    ;;
+  "issue edit "*)
+    for ((index = 1; index <= $#; index++)); do
+      if [[ "\${!index}" == "--body-file" ]]; then
+        body_index=$((index + 1))
+        cp "\${!body_index}" "$CAPTURED_BODY"
+      fi
+    done
+    ;;
+esac
+`
+  );
+
+  const issue = JSON.stringify([
+    {
+      body: issueBody,
+      number: 1,
+      title: "publish: getsentry/toolkit@1.2.3",
+    },
+  ]);
+  const initialOutput = JSON.stringify({
+    repo: "getsentry/toolkit",
+    revision: INITIAL_REVISION,
+    version: "1.2.3",
+  });
+  const result = spawnSync("bash", ["-e", "-o", "pipefail", "-c", getPollerScript()], {
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      CAPTURED_BODY: capturedBody,
+      GH_LOG: logFile,
+      GH_ISSUES: issue,
+      GITHUB_REPOSITORY: "getsentry/publish",
+      NODE_INITIAL_EXIT: String(initialExit),
+      NODE_INITIAL_OUTPUT: initialOutput,
+      NODE_UPDATE_OUTPUT: updateOutput,
+      PATH: `${binDirectory}:${process.env.PATH}`,
+      TEMPORARY_FILES: temporaryFiles,
+    },
+  });
+
+  return {
+    capturedBody,
+    log: readFileSync(logFile, "utf8"),
+    result,
+    temporaryFiles: readdirSync(temporaryFiles).filter(file => file !== "counter"),
+  };
+}
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { force: true, recursive: true });
+  }
+});
+
+test("skips an issue without editing it when the poller resolver fails", () => {
+  const poller = runPoller({ initialExit: 1 });
+
+  expect(poller.result.status, poller.result.stderr).toBe(0);
+  expect(poller.log).not.toContain("issue edit");
+  expect(poller.temporaryFiles).toEqual([]);
+});
+
+test("skips an issue without editing it when the rewrite response has no body", () => {
+  const poller = runPoller({ updateOutput: JSON.stringify({}) });
+
+  expect(poller.result.status, poller.result.stderr).toBe(0);
+  expect(poller.log).not.toContain("--body-file");
+  expect(poller.temporaryFiles).toEqual([]);
+});
+
+test("skips an issue without editing it when the rewrite response body is empty", () => {
+  const poller = runPoller({ updateOutput: JSON.stringify({ issueBody: "" }) });
+
+  expect(poller.result.status, poller.result.stderr).toBe(0);
+  expect(poller.log).not.toContain("--body-file");
+  expect(poller.temporaryFiles).toEqual([]);
+});
+
+test.each([
+  ["malformed JSON", "not JSON"],
+  ["a non-object JSON value", "[]"],
+])("skips an issue without editing it when the rewrite response is %s", (_name, updateOutput) => {
+  const poller = runPoller({ updateOutput });
+
+  expect(poller.result.status, poller.result.stderr).toBe(0);
+  expect(poller.log).not.toContain("--body-file");
+  expect(poller.temporaryFiles).toEqual([]);
+});
+
+test("preserves all rewrite body bytes outside the revision", () => {
+  const body = "canonical issue body\n\n";
+  const poller = runPoller({
+    issueBody: body,
+    updateOutput: JSON.stringify({ issueBody: body }),
+  });
+
+  expect(poller.result.status, poller.result.stderr).toBe(0);
+  expect(readFileSync(poller.capturedBody, "utf8")).toBe(body);
+  expect(poller.temporaryFiles).toEqual([]);
+});
diff --git a/src/modules/__tests__/details-from-context.js b/src/modules/__tests__/details-from-context.js
index e6411c5..aa1d199 100644
--- a/src/modules/__tests__/details-from-context.js
+++ b/src/modules/__tests__/details-from-context.js
@@ -9,8 +9,7 @@ const inputsArgs = {
       issue: {
         number: "223",
         title: "publish: getsentry/sentry@21.3.1",
-        body: `
-Requested by: @BYK
+        body: `Requested by: @BYK
 
 Merge target: custom-branch
 
@@ -36,7 +35,7 @@ Assign the **accepted** label to this issue to approve the release.
 
 test("parse inputs", async () => {
   const result = await detailsFromContext(inputsArgs);
-  expect(result).toEqual({
+  expect(result).toStrictEqual({
     dry_run: "",
     merge_target: "custom-branch",
     path: ".",
@@ -54,7 +53,13 @@ test("can parse version containing +", async () => {
         issue: {
           number: "123",
           title: "publish: getsentry/sentry-forked-django-stubs@4.2.6+sentry1",
-          body: "Requested by: @example",
+          body: `Requested by: @example
+
+Merge target: (default)
+
+Quick links:
+- [View changes](https://github.com/getsentry/sentry-forked-django-stubs/compare/4.2.5...refs/heads/releases/4.2.6)
+- [View check runs](https://github.com/getsentry/sentry-forked-django-stubs/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)`,
           labels: [],
         },
       },
@@ -70,8 +75,7 @@ const defaultTargetInputsArgs = {
       issue: {
         number: "223",
         title: "publish: getsentry/sentry@21.3.1",
-        body: `
-Requested by: @BYK
+        body: `Requested by: @BYK
 Merge target: (default)
 Quick links:
 - [View changes](https://github.com/getsentry/sentry/compare/21.3.0...refs/heads/releases/21.3.1)
@@ -91,7 +95,7 @@ Assign the **accepted** label to this issue to approve the release.
 
 test("Do not extract merge_target value if its a default value", async () => {
   const result = await detailsFromContext(defaultTargetInputsArgs);
-  expect(result).toEqual({
+  expect(result).toStrictEqual({
     dry_run: "",
     merge_target: "",
     path: ".",
@@ -101,6 +105,154 @@ test("Do not extract merge_target value if its a default value", async () => {
   });
 });
 
+test("uses the merge target from the canonical request header", async () => {
+  const result = await detailsFromContext({
+    context: {
+      payload: {
+        issue: {
+          ...inputsArgs.context.payload.issue,
+          body: `${inputsArgs.context.payload.issue.body}\nMerge target: decoy`,
+        },
+      },
+    },
+  });
+
+  expect(result.merge_target).toBe("custom-branch");
+});
+
+test("keeps a concrete workspace path in the title suffix", async () => {
+  const result = await detailsFromContext({
+    context: {
+      repo: { owner: "getsentry", repo: "publish" },
+      payload: {
+        issue: {
+          number: "123",
+          title: "publish: getsentry/toolkit/packages/cli@1.2.3",
+          body: `Requested by: @example
+
+Merge target: (default)
+
+Quick links:
+- [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...refs/heads/releases/1.2.3)
+- [View check runs](https://github.com/getsentry/toolkit/commit/7e5ca7ed5581552de066e2a8bc295b8306be38ac/checks/)`,
+          labels: [],
+        },
+      },
+    },
+  });
+
+  expect(result).toMatchObject({
+    repo: "toolkit",
+    version: "1.2.3",
+    path: "./packages/cli",
+  });
+});
+
+test("rejects a title with an unexpected space before its version", async () => {
+  const fn = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title: "publish: getsentry/toolkit @1.2.3",
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+
+  await expect(fn).rejects.toThrow("Invalid publish issue title");
+});
+
+test("rejects a path that escapes the target checkout", async () => {
+  const fn = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title: "publish: getsentry/toolkit/../other@1.2.3",
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+
+  await expect(fn).rejects.toThrow("Invalid publish issue path");
+});
+
+test("rejects a title path with a current-directory segment before checkout", async () => {
+  const fn = () =>
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title: "publish: getsentry/toolkit/./other@1.2.3",
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    });
+
+  await expect(fn).rejects.toThrow("Invalid publish issue path");
+});
+
+test.each(["-toolkit", ".", "..", "__proto__"])(
+  "rejects an unsafe checkout repository identity: %s",
+  async (repo) => {
+    await expect(
+      detailsFromContext({
+        context: {
+          payload: {
+            issue: {
+              title: `publish: getsentry/${repo}@1.2.3`,
+              body: "",
+              labels: [],
+            },
+          },
+        },
+      })
+    ).rejects.toThrow("Invalid publish issue repository");
+  }
+);
+
+test.each(["--config", "1.2"])(
+  "rejects an invalid release version: %s",
+  async (version) => {
+    await expect(
+      detailsFromContext({
+        context: {
+          payload: {
+            issue: {
+              title: `publish: getsentry/toolkit@${version}`,
+              body: "",
+              labels: [],
+            },
+          },
+        },
+      })
+    ).rejects.toThrow("Invalid publish issue version");
+  }
+);
+
+test("rejects a version with path syntax", async () => {
+  await expect(
+    detailsFromContext({
+      context: {
+        payload: {
+          issue: {
+            title: "publish: getsentry/toolkit@1.2.3/other",
+            body: "",
+            labels: [],
+          },
+        },
+      },
+    })
+  ).rejects.toThrow("Invalid publish issue title");
+});
+
 test("throw error when context is missing the issue payload", async () => {
   const fn = () => detailsFromContext({ context: {} });
   await expect(fn).rejects.toThrow("Issue context is not defined");
diff --git a/src/modules/__tests__/generate-publish-issue-title-parser.js b/src/modules/__tests__/generate-publish-issue-title-parser.js
new file mode 100644
index 0000000..9c05152
--- /dev/null
+++ b/src/modules/__tests__/generate-publish-issue-title-parser.js
@@ -0,0 +1,40 @@
+import { expect, test } from "vitest";
+
+const {
+  generateDocumentation,
+} = require("../../../scripts/generate-publish-issue-title-parser.js");
+
+test("requires generated title grammar markers in the documentation", () => {
+  expect(() =>
+    generateDocumentation({
+      documentation: "# Publish Issue Format\n",
+      titleGrammar: 'PublishIssueTitle = "publish: "',
+    })
+  ).toThrow("Could not find the generated title grammar in the documentation.");
+});
+
+test("rejects duplicate generated title grammar markers", () => {
+  expect(() =>
+    generateDocumentation({
+      documentation: `<!-- BEGIN GENERATED TITLE GRAMMAR -->
+old
+<!-- END GENERATED TITLE GRAMMAR -->
+<!-- BEGIN GENERATED TITLE GRAMMAR -->
+old
+<!-- END GENERATED TITLE GRAMMAR -->`,
+      titleGrammar: 'PublishIssueTitle = "publish: "',
+    })
+  ).toThrow("Could not find the generated title grammar in the documentation.");
+});
+
+test("rejects malformed generated title grammar markers", () => {
+  expect(() =>
+    generateDocumentation({
+      documentation: `<!-- BEGIN GENERATED TITLE GRAMMAR -->
+old
+<!-- END GENERATED TITLE GRAMMAR -->
+<!-- BEGIN GENERATED TITLE GRAMMAR -- >`,
+      titleGrammar: 'PublishIssueTitle = "publish: "',
+    })
+  ).toThrow("Could not find the generated title grammar in the documentation.");
+});
diff --git a/src/modules/__tests__/publish-location.js b/src/modules/__tests__/publish-location.js
new file mode 100644
index 0000000..331dcaa
--- /dev/null
+++ b/src/modules/__tests__/publish-location.js
@@ -0,0 +1,91 @@
+import { expect, test } from "vitest";
+
+const { resolvePublishLocation } = require("../publish-location.js");
+
+test("classifies an exact full workspace path without normalizing it", () => {
+  expect(
+    resolvePublishLocation({
+      path: "./packages/CLI",
+      workspaceNames: ["packages/cli", "packages/CLI"],
+    })
+  ).toStrictEqual({ path: ".", workspace: "packages/CLI" });
+});
+
+test("keeps a non-workspace suffix as a checkout path", () => {
+  expect(
+    resolvePublishLocation({
+      path: "./packages",
+      workspaceNames: ["cli"],
+    })
+  ).toStrictEqual({ path: "./packages" });
+});
+
+test("keeps a multi-segment suffix that is not an exact workspace path", () => {
+  expect(
+    resolvePublishLocation({
+      path: "./packages/cli",
+      workspaceNames: ["cli"],
+    })
+  ).toStrictEqual({ path: "./packages/cli" });
+});
+
+test("keeps root releases at the checkout root", () => {
+  expect(
+    resolvePublishLocation({
+      path: ".",
+      workspaceNames: ["cli"],
+    })
+  ).toStrictEqual({ path: "." });
+});
+
+test("rejects invalid discovery output for a root release", () => {
+  expect(() =>
+    resolvePublishLocation({
+      path: ".",
+      workspaceNames: ["packages/../cli"],
+    })
+  ).toThrow("Craft workspace discovery returned an invalid workspace list.");
+});
+
+test.each(["./.", "./..", "./packages/../other"])(
+  "rejects an unsafe publish path %s",
+  (path) => {
+    expect(() =>
+      resolvePublishLocation({
+        path,
+        workspaceNames: [],
+      })
+    ).toThrow("Invalid publish path.");
+  }
+);
+
+test("rejects an invalid workspace returned by discovery", () => {
+  expect(() =>
+    resolvePublishLocation({
+      path: "./packages/cli",
+      workspaceNames: ["cli-日本語"],
+    })
+  ).toThrow("Craft workspace discovery returned an invalid workspace list");
+});
+
+test.each([
+  ".",
+  "..",
+  "packages/./cli",
+  "packages/../cli",
+  "packages/__proto__/cli",
+  "packages/-cli",
+  "packages/foo]",
+  "packages/foo!",
+  "packages/foo^",
+])(
+  "rejects unsafe workspace name %s",
+  (workspace) => {
+    expect(() =>
+      resolvePublishLocation({
+        path: "./packages/cli",
+        workspaceNames: [workspace],
+      })
+    ).toThrow("Craft workspace discovery returned an invalid workspace list.");
+  }
+);
diff --git a/src/modules/__tests__/publish-workflow.js b/src/modules/__tests__/publish-workflow.js
new file mode 100644
index 0000000..76a8826
--- /dev/null
+++ b/src/modules/__tests__/publish-workflow.js
@@ -0,0 +1,156 @@
+import { spawnSync } from "child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+
+import { afterEach, expect, test } from "vitest";
+
+const { resolvePublishLocation } = require("../publish-location.js");
+
+const temporaryDirectories = [];
+
+function getWorkflow() {
+  return readFileSync(
+    join(__dirname, "../../../.github/workflows/publish.yml"),
+    "utf8"
+  );
+}
+
+function getSetTargetsScript() {
+  const workflow = getWorkflow();
+  const section = workflow.match(
+    / {6}- name: Set targets[\s\S]*? {8}run: \|\n(?<script>[\s\S]*?)\n {6}- uses: docker:\/\/getsentry\/craft:latest/
+  );
+  if (!section?.groups?.script) {
+    throw new Error("Missing Set targets workflow script");
+  }
+  return section.groups.script.replace(/^ {10}/gm, "");
+}
+
+function runSetTargets({ path, repo, version, workspace = "" }) {
+  const directory = mkdtempSync(join(tmpdir(), "publish-workflow-test-"));
+  temporaryDirectories.push(directory);
+  const output = join(directory, "github-output");
+  writeFileSync(output, "");
+
+  const result = spawnSync("bash", ["-e", "-c", getSetTargetsScript()], {
+    env: {
+      ...process.env,
+      CRAFT_PUBLISH_PATH: path,
+      CRAFT_PUBLISH_REPO: repo,
+      CRAFT_PUBLISH_TARGETS_JSON: '["github"]',
+      CRAFT_PUBLISH_VERSION: version,
+      CRAFT_PUBLISH_WORKSPACE: workspace,
+      GITHUB_OUTPUT: output,
+      GITHUB_WORKSPACE: directory,
+    },
+    encoding: "utf8",
+  });
+
+  expect(result.status, result.stderr).toBe(0);
+  const stateFile = readFileSync(output, "utf8")
+    .trim()
+    .replace("state_file=", "");
+  return { stateFile, state: readFileSync(stateFile, "utf8") };
+}
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test("uses the CI-approved revision for checkout, location resolution, and publishing", () => {
+  const workflow = getWorkflow();
+  const revision = workflow.indexOf(
+    "name: Resolve CI-approved release revision"
+  );
+  const informStart = workflow.indexOf("name: Inform start");
+  const checkout = workflow.indexOf("name: Check out target repo");
+  const location = workflow.indexOf("name: Resolve publish location");
+  const state = workflow.indexOf("name: Set targets");
+  const publish = workflow.indexOf("name: Publish using Craft");
+
+  expect(checkout).toBeGreaterThan(-1);
+  expect(informStart).toBeGreaterThan(revision);
+  expect(checkout).toBeGreaterThan(informStart);
+  expect(location).toBeGreaterThan(checkout);
+  expect(state).toBeGreaterThan(location);
+  expect(publish).toBeGreaterThan(state);
+  expect(workflow).toContain(
+    "ref: ${{ steps.release-revision.outputs.revision }}"
+  );
+  expect(workflow.match(/actions\/checkout@v7/g)).toHaveLength(2);
+  expect(workflow).toContain(
+    "node .__publish__/src/publish/discover-location.js"
+  );
+  expect(workflow).toContain("PUBLISH_REPOSITORY_DIRECTORY: __repo__");
+  expect(workflow).not.toContain("getsentry/craft:2.31.0");
+  expect(workflow).toContain(
+    "CRAFT_PUBLISH_PATH: ${{ fromJSON(steps.location.outputs.result).path }}"
+  );
+  expect(workflow).toContain(
+    "CRAFT_PUBLISH_WORKSPACE: ${{ fromJSON(steps.location.outputs.result).workspace || '' }}"
+  );
+  expect(workflow).toContain(
+    "craft publish ${{ fromJSON(steps.inputs.outputs.result).version }} --rev ${{ steps.release-revision.outputs.revision }}"
+  );
+});
+
+test("publishes only on a fresh CI-ready label event", () => {
+  const workflow = getWorkflow();
+
+  expect(workflow).toContain("github.event.label.name == 'ci-ready'");
+  expect(workflow).toContain("contains(github.event.issue.labels.*.name, 'accepted')");
+  expect(workflow).toContain("contains(github.event.issue.labels.*.name, 'ci-ready')");
+  expect(workflow).toContain("!contains(github.event.issue.labels.*.name, 'ci-pending')");
+  expect(workflow).toContain("!contains(github.event.issue.labels.*.name, 'ci-failed')");
+});
+
+test("uses Craft's legacy root state filename", () => {
+  const { stateFile, state } = runSetTargets({
+    path: ".",
+    repo: "sentry",
+    version: "21.3.1",
+  });
+
+  expect(stateFile).toMatch(
+    /\.craft-state\/craft\/publish-state-getsentry-sentry-c232c383e26f-21\.3\.1\.json$/
+  );
+  expect(JSON.parse(state)).toEqual({ published: { github: true } });
+});
+
+test("matches Craft's workspace state filename for a monorepo release", () => {
+  const location = resolvePublishLocation({
+    path: "./packages/cli",
+    workspaceNames: ["packages/cli"],
+  });
+  const { stateFile, state } = runSetTargets({
+    path: location.path,
+    repo: "toolkit",
+    version: "1.2.3",
+    workspace: location.workspace,
+  });
+
+  expect(stateFile).toMatch(
+    /\.craft-state\/craft\/publish-state-getsentry-toolkit-c232c383e26f-workspace-cGFja2FnZXMvY2xp-1\.2\.3\.json$/
+  );
+  expect(JSON.parse(state)).toEqual({ published: { github: true } });
+});
+
+test("does not collide state files for release versions that differ by case", () => {
+  const first = runSetTargets({
+    path: ".",
+    repo: "toolkit",
+    version: "4.2.6+sentry1",
+  });
+  const second = runSetTargets({
+    path: ".",
+    repo: "toolkit",
+    version: "4.2.6+Sentry1",
+  });
+
+  expect(first.stateFile).not.toBe(second.stateFile);
+  expect(first.stateFile).toMatch(/-version-NC4yLjYrc2VudHJ5MQ\.json$/);
+  expect(second.stateFile).toMatch(/-version-NC4yLjYrU2VudHJ5MQ\.json$/);
+});
diff --git a/src/modules/__tests__/release-revision.js b/src/modules/__tests__/release-revision.js
new file mode 100644
index 0000000..77c80f2
--- /dev/null
+++ b/src/modules/__tests__/release-revision.js
@@ -0,0 +1,150 @@
+import { expect, test } from "vitest";
+
+const {
+  getReleaseRevision,
+  updateReleaseRevision,
+} = require("../release-revision.js");
+
+const REVISION = "7e5ca7ed5581552de066e2a8bc295b8306be38ac";
+
+function requestBody(quickLinks) {
+  return `Requested by: @byk
+
+Merge target: (default)
+
+Quick links:
+${quickLinks}`;
+}
+
+function canonicalQuickLinks(revision = REVISION) {
+  return `- [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
+- [View check runs](https://github.com/getsentry/toolkit/commit/${revision}/checks/)`;
+}
+
+test("gets the CI-approved revision from the request header", () => {
+  expect(
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: requestBody(canonicalQuickLinks()),
+    })
+  ).toBe(REVISION);
+});
+
+test("accepts CRLF request bodies", () => {
+  expect(
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: requestBody(canonicalQuickLinks()).replace(/\n/g, "\r\n"),
+    })
+  ).toBe(REVISION);
+});
+
+test("accepts a check-runs URL without a trailing slash", () => {
+  expect(
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: requestBody(canonicalQuickLinks().replace("/checks/)", "/checks)")),
+    })
+  ).toBe(REVISION);
+});
+
+test("rejects a check-runs URL without the checks path", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: requestBody(canonicalQuickLinks().replace("/checks/)", ")")),
+    })
+  ).toThrow("Expected a View check runs link for getsentry/toolkit");
+});
+
+test("rejects a check-runs link for another repository", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: requestBody(
+        canonicalQuickLinks().replace(
+          "https://github.com/getsentry/toolkit/commit",
+          "https://github.com/getsentry/other/commit"
+        )
+      ),
+    })
+  ).toThrow("Expected a View check runs link for getsentry/toolkit");
+});
+
+test("rejects a decoy check-runs link outside the request header", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: `${requestBody(canonicalQuickLinks())}
+
+<details>
+Quick links:
+- [View changes](https://github.com/getsentry/toolkit/compare/1.2.2...release/1.2.3)
+- [View check runs](https://github.com/getsentry/toolkit/commit/${"a".repeat(
+        40
+      )}/checks/)
+</details>`,
+    })
+  ).toThrow("Expected exactly one View check runs link in Quick links");
+});
+
+test("rejects an embedded check-runs link outside the request header", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: `${requestBody(canonicalQuickLinks())}
+
+Ignored - [View check runs](https://github.com/getsentry/toolkit/commit/${"a".repeat(
+        40
+      )}/checks/)`,
+    })
+  ).toThrow("Expected exactly one View check runs link in Quick links");
+});
+
+test("rejects a complete Quick links block outside the request header", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: `### Changelog
+
+Quick links:
+${canonicalQuickLinks()}`,
+    })
+  ).toThrow("Expected a View check runs link for getsentry/toolkit");
+});
+
+test("rejects a complete request header outside the issue start", () => {
+  expect(() =>
+    getReleaseRevision({
+      repo: "toolkit",
+      issueBody: `### Changelog
+
+${requestBody(canonicalQuickLinks())}`,
+    })
+  ).toThrow("Expected a View check runs link for getsentry/toolkit");
+});
+
+test("updates only the canonical request-header revision", () => {
+  const replacement = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+  const issueBody = `${requestBody(canonicalQuickLinks()).replace(
+    /\n/g,
+    "\r\n"
+  )}\r\n\r\nTrailing content\r\n`;
+
+  expect(
+    updateReleaseRevision({ issueBody, repo: "toolkit", revision: replacement })
+  ).toBe(issueBody.replace(REVISION, replacement));
+});
+
+test.each(["A".repeat(40), "a".repeat(39), "a".repeat(41)])(
+  "rejects an invalid replacement revision: %s",
+  (revision) => {
+    expect(() =>
+      updateReleaseRevision({
+        issueBody: requestBody(canonicalQuickLinks()),
+        repo: "toolkit",
+        revision,
+      })
+    ).toThrow("Release revision must be a lowercase 40-character SHA.");
+  }
+);
diff --git a/src/modules/__tests__/update-issue.js b/src/modules/__tests__/update-issue.js
index 954ef51..bc17165 100644
--- a/src/modules/__tests__/update-issue.js
+++ b/src/modules/__tests__/update-issue.js
@@ -42,6 +42,8 @@ const updateTargetsArgs = {
 
 beforeAll(() => {
   process.env.GITHUB_WORKSPACE = ".";
+  process.env.CRAFT_STATE_FILE_PATH =
+    ".craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json";
   mockExistsSync = vi.spyOn(fs, "existsSync");
   vi.spyOn(fs.promises, "readFile").mockResolvedValue(
     JSON.stringify({ published: { lol: true, hey: false, github: true } })
@@ -75,9 +77,9 @@ describe.each([false, true])("state file exists: %s", (stateFileExists) => {
     mockExistsSync.mockReturnValue(stateFileExists);
     await updateIssue(updateTargetsArgs);
     expect(mockExistsSync).toHaveBeenCalledTimes(1);
-    // This is process.env.GITHUB_WORKSPACE + / filename
+    // This path comes from the workflow's secure state-file step output.
     expect(mockExistsSync).toHaveBeenCalledWith(
-      "./__repo__/.craft-publish-21.3.1.json"
+      ".craft-state/craft/publish-state-getsentry-sentry-c232c383e26f-21.3.1.json"
     );
   });
 
@@ -129,6 +131,15 @@ describe.each([false, true])("state file exists: %s", (stateFileExists) => {
   });
 });
 
+test("does not read a state file when target setup was skipped", async () => {
+  delete process.env.CRAFT_STATE_FILE_PATH;
+  mockExistsSync.mockClear();
+  await updateIssue(updateTargetsArgs);
+
+  expect(mockExistsSync).not.toHaveBeenCalled();
+  expect(updateTargetsArgs.octokit.rest.issues.update).not.toHaveBeenCalled();
+});
+
 describe("transformIssueBody", () => {
   it("should correctly transform an issue body", () => {
     const result = transformIssueBody(
diff --git a/src/modules/ci-poller-input.js b/src/modules/ci-poller-input.js
new file mode 100644
index 0000000..ca08a72
--- /dev/null
+++ b/src/modules/ci-poller-input.js
@@ -0,0 +1,42 @@
+const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
+const {
+  getReleaseRevision,
+  updateReleaseRevision,
+} = require("./release-revision");
+const {
+  isPublishRepository,
+  isReleaseVersion,
+} = require("./publish-issue-validation");
+const { isPublishPath } = require("./publish-location");
+
+function getCiPollerInput({ title, issueBody, revision }) {
+  let parsedTitle;
+  try {
+    parsedTitle = parsePublishIssueTitle(title);
+  } catch {
+    throw new Error(`Invalid publish issue title: '${title}'`);
+  }
+  const { repo, version } = parsedTitle;
+  if (!isPublishRepository(repo)) {
+    throw new Error(`Invalid publish issue repository: '${repo}'`);
+  }
+  if (!isReleaseVersion(version)) {
+    throw new Error(`Invalid publish issue version: '${version}'`);
+  }
+  const path = `.${parsedTitle.path}`;
+  if (!isPublishPath(path)) {
+    throw new Error(`Invalid publish issue path: '${path}'`);
+  }
+  const currentRevision = getReleaseRevision({ issueBody, repo });
+
+  return {
+    ...(revision
+      ? { issueBody: updateReleaseRevision({ issueBody, repo, revision }) }
+      : {}),
+    repo: `getsentry/${repo}`,
+    revision: currentRevision,
+    version,
+  };
+}
+
+module.exports = { getCiPollerInput };
diff --git a/src/modules/details-from-context.js b/src/modules/details-from-context.js
index e58b0be..9288b5f 100644
--- a/src/modules/details-from-context.js
+++ b/src/modules/details-from-context.js
@@ -1,3 +1,11 @@
+const { parse: parsePublishIssueTitle } = require("./publish-issue-title");
+const { getReleaseRevisionDetails } = require("./release-revision");
+const { isPublishPath } = require("./publish-location");
+const {
+  isPublishRepository,
+  isReleaseVersion,
+} = require("./publish-issue-validation");
+
 /**
  * Matches the entire "Targets" section of a github publish issue body.
  */
@@ -21,22 +29,33 @@ async function detailsFromContext({ context }) {
     throw new Error("Issue context is not defined");
   }
 
-  const titleParser =
-    /^publish: (?:getsentry\/)?(?<repo>[^/@]+)(?<path>\/[\w./-]+)?@(?<version>[\w.+-]+)$/;
-  const titleMatch = context.payload.issue.title.match(titleParser).groups;
+  let titleDetails;
+  try {
+    titleDetails = parsePublishIssueTitle(context.payload.issue.title);
+  } catch {
+    throw new Error(
+      `Invalid publish issue title: '${context.payload.issue.title}'`
+    );
+  }
+  if (!isPublishRepository(titleDetails.repo)) {
+    throw new Error(`Invalid publish issue repository: '${titleDetails.repo}'`);
+  }
+  if (!isReleaseVersion(titleDetails.version)) {
+    throw new Error(`Invalid publish issue version: '${titleDetails.version}'`);
+  }
   const dry_run = context.payload.issue.labels.some((l) => l.name === "dry-run")
     ? "1"
     : "";
-  const path = "." + (titleMatch.path || "");
-
-  // https://docs.github.com/en/get-started/using-git/dealing-with-special-characters-in-branch-and-tag-names#naming-branches-and-tags
-  const mergeTargetParser = /^Merge target: (?<merge_target>[\w.\-/]+)$/m;
-  const mergeTargetMatch = context.payload.issue.body.match(mergeTargetParser);
-  let merge_target = "";
-  if (mergeTargetMatch && mergeTargetMatch.groups) {
-    merge_target = mergeTargetMatch.groups.merge_target || "";
+  const path = "." + titleDetails.path;
+  if (!isPublishPath(path)) {
+    throw new Error(`Invalid publish issue path: '${path}'`);
   }
 
+  const { mergeTarget } = getReleaseRevisionDetails({
+    issueBody: context.payload.issue.body || "",
+    repo: titleDetails.repo,
+  });
+
   const targetsMatch = context.payload.issue.body.match(
     TARGETS_SECTION_PARSER_REGEX
   );
@@ -48,9 +67,9 @@ async function detailsFromContext({ context }) {
   }
 
   return {
-    ...titleMatch,
+    ...titleDetails,
     dry_run,
-    merge_target,
+    merge_target: mergeTarget === "(default)" ? "" : mergeTarget,
     path,
     targets,
   };
diff --git a/src/modules/publish-issue-title.js b/src/modules/publish-issue-title.js
new file mode 100644
index 0000000..7a22ddb
--- /dev/null
+++ b/src/modules/publish-issue-title.js
@@ -0,0 +1,1473 @@
+/* eslint-disable */
+// @generated by Peggy 5.1.0.
+//
+// https://peggyjs.org/
+
+"use strict";
+
+class peg$SyntaxError extends SyntaxError {
+  constructor(message, expected, found, location) {
+    super(message);
+    this.expected = expected;
+    this.found = found;
+    this.location = location;
+    this.name = "SyntaxError";
+  }
+
+  format(sources) {
+    let str = "Error: " + this.message;
+    if (this.location) {
+      let src = null;
+      const st = sources.find((s) => s.source === this.location.source);
+      if (st) {
+        src = st.text.split(/\r\n|\n|\r/g);
+      }
+      const s = this.location.start;
+      const offset_s =
+        this.location.source &&
+        typeof this.location.source.offset === "function"
+          ? this.location.source.offset(s)
+          : s;
+      const loc =
+        this.location.source + ":" + offset_s.line + ":" + offset_s.column;
+      if (src) {
+        const e = this.location.end;
+        const filler = "".padEnd(offset_s.line.toString().length, " ");
+        const line = src[s.line - 1];
+        const last = s.line === e.line ? e.column : line.length + 1;
+        const hatLen = last - s.column || 1;
+        str +=
+          "\n --> " +
+          loc +
+          "\n" +
+          filler +
+          " |\n" +
+          offset_s.line +
+          " | " +
+          line +
+          "\n" +
+          filler +
+          " | " +
+          "".padEnd(s.column - 1, " ") +
+          "".padEnd(hatLen, "^");
+      } else {
+        str += "\n at " + loc;
+      }
+    }
+    return str;
+  }
+
+  static buildMessage(expected, found) {
+    function hex(ch) {
+      return ch.codePointAt(0).toString(16).toUpperCase();
+    }
+
+    const nonPrintable = Object.prototype.hasOwnProperty.call(
+      RegExp.prototype,
+      "unicode"
+    )
+      ? new RegExp("[\\p{C}\\p{Mn}\\p{Mc}]", "gu")
+      : null;
+    function unicodeEscape(s) {
+      if (nonPrintable) {
+        return s.replace(nonPrintable, (ch) => "\\u{" + hex(ch) + "}");
+      }
+      return s;
+    }
+
+    function literalEscape(s) {
+      return unicodeEscape(
+        s
+          .replace(/\\/g, "\\\\")
+          .replace(/"/g, '\\"')
+          .replace(/\0/g, "\\0")
+          .replace(/\t/g, "\\t")
+          .replace(/\n/g, "\\n")
+          .replace(/\r/g, "\\r")
+          .replace(/[\x00-\x0F]/g, (ch) => "\\x0" + hex(ch))
+          .replace(/[\x10-\x1F\x7F-\x9F]/g, (ch) => "\\x" + hex(ch))
+      );
+    }
+
+    function classEscape(s) {
+      return unicodeEscape(
+        s
+          .replace(/\\/g, "\\\\")
+          .replace(/\]/g, "\\]")
+          .replace(/\^/g, "\\^")
+          .replace(/-/g, "\\-")
+          .replace(/\0/g, "\\0")
+          .replace(/\t/g, "\\t")
+          .replace(/\n/g, "\\n")
+          .replace(/\r/g, "\\r")
+          .replace(/[\x00-\x0F]/g, (ch) => "\\x0" + hex(ch))
+          .replace(/[\x10-\x1F\x7F-\x9F]/g, (ch) => "\\x" + hex(ch))
+      );
+    }
+
+    const DESCRIBE_EXPECTATION_FNS = {
+      literal(expectation) {
+        return '"' + literalEscape(expectation.text) + '"';
+      },
+
+      class(expectation) {
+        const escapedParts = expectation.parts.map((part) =>
+          Array.isArray(part)
+            ? classEscape(part[0]) + "-" + classEscape(part[1])
+            : classEscape(part)
+        );
+
+        return (
+          "[" +
+          (expectation.inverted ? "^" : "") +
+          escapedParts.join("") +
+          "]" +
+          (expectation.unicode ? "u" : "")
+        );
+      },
+
+      any() {
+        return "any character";
+      },
+
+      end() {
+        return "end of input";
+      },
+
+      other(expectation) {
+        return expectation.description;
+      },
+    };
+
+    function describeExpectation(expectation) {
+      return DESCRIBE_EXPECTATION_FNS[expectation.type](expectation);
+    }
+
+    function describeExpected(expected) {
+      const descriptions = expected.map(describeExpectation);
+      descriptions.sort();
+
+      if (descriptions.length > 0) {
+        let j = 1;
+        for (let i = 1; i < descriptions.length; i++) {
+          if (descriptions[i - 1] !== descriptions[i]) {
+            descriptions[j] = descriptions[i];
+            j++;
+          }
+        }
+        descriptions.length = j;
+      }
+
+      switch (descriptions.length) {
+        case 1:
+          return descriptions[0];
+
+        case 2:
+          return descriptions[0] + " or " + descriptions[1];
+
+        default:
+          return (
+            descriptions.slice(0, -1).join(", ") +
+            ", or " +
+            descriptions[descriptions.length - 1]
+          );
+      }
+    }
+
+    function describeFound(found) {
+      return found ? '"' + literalEscape(found) + '"' : "end of input";
+    }
+
+    return (
+      "Expected " +
+      describeExpected(expected) +
+      " but " +
+      describeFound(found) +
+      " found."
+    );
+  }
+}
+
+function peg$parse(input, options) {
+  options = options !== undefined ? options : {};
+
+  const peg$FAILED = {};
+  const peg$source = options.grammarSource;
+
+  const peg$startRuleFunctions = {
+    PublishIssueTitle: peg$parsePublishIssueTitle,
+    ReleaseRevision: peg$parseReleaseRevision,
+    CheckRunsLinkCount: peg$parseCheckRunsLinkCount,
+  };
+  let peg$startRuleFunction = peg$parsePublishIssueTitle;
+
+  const peg$c0 = "publish: ";
+  const peg$c1 = "getsentry/";
+  const peg$c2 = "@";
+  const peg$c3 = "/";
+  const peg$c4 = "Requested by: @";
+  const peg$c5 = "Merge target: ";
+  const peg$c6 = "Quick links:";
+  const peg$c7 = "- [View changes](";
+  const peg$c8 = ")";
+  const peg$c9 = "- [View check runs](https://github.com/getsentry/";
+  const peg$c10 = "/commit/";
+  const peg$c11 = "/checks";
+  const peg$c12 = "- [View check runs](";
+  const peg$c13 = "\r\n";
+  const peg$c14 = "\n";
+  const peg$c15 = "(default)";
+
+  const peg$r0 = /^[A-Za-z0-9_.\-]/;
+  const peg$r1 = /^[A-Za-z0-9_.+\-]/;
+  const peg$r2 = /^[0-9a-f]/;
+  const peg$r3 = /^[ \t]/;
+  const peg$r4 = /^[^\r\n]/;
+  const peg$r5 = /^[A-Za-z0-9_.\/\-]/;
+  const peg$r6 = /^[^\r\n)]/;
+
+  const peg$e0 = peg$literalExpectation("publish: ", false);
+  const peg$e1 = peg$literalExpectation("getsentry/", false);
+  const peg$e2 = peg$literalExpectation("@", false);
+  const peg$e3 = peg$anyExpectation();
+  const peg$e4 = peg$classExpectation(
+    [["A", "Z"], ["a", "z"], ["0", "9"], "_", ".", "-"],
+    false,
+    false,
+    false
+  );
+  const peg$e5 = peg$literalExpectation("/", false);
+  const peg$e6 = peg$classExpectation(
+    [["A", "Z"], ["a", "z"], ["0", "9"], "_", ".", "+", "-"],
+    false,
+    false,
+    false
+  );
+  const peg$e7 = peg$literalExpectation("Requested by: @", false);
+  const peg$e8 = peg$literalExpectation("Merge target: ", false);
+  const peg$e9 = peg$literalExpectation("Quick links:", false);
+  const peg$e10 = peg$literalExpectation("- [View changes](", false);
+  const peg$e11 = peg$literalExpectation(")", false);
+  const peg$e12 = peg$literalExpectation(
+    "- [View check runs](https://github.com/getsentry/",
+    false
+  );
+  const peg$e13 = peg$literalExpectation("/commit/", false);
+  const peg$e14 = peg$literalExpectation("/checks", false);
+  const peg$e15 = peg$classExpectation(
+    [
+      ["0", "9"],
+      ["a", "f"],
+    ],
+    false,
+    false,
+    false
+  );
+  const peg$e16 = peg$literalExpectation("- [View check runs](", false);
+  const peg$e17 = peg$classExpectation([" ", "\t"], false, false, false);
+  const peg$e18 = peg$literalExpectation("\r\n", false);
+  const peg$e19 = peg$literalExpectation("\n", false);
+  const peg$e20 = peg$classExpectation(["\r", "\n"], true, false, false);
+  const peg$e21 = peg$literalExpectation("(default)", false);
+  const peg$e22 = peg$classExpectation(
+    [["A", "Z"], ["a", "z"], ["0", "9"], "_", ".", "/", "-"],
+    false,
+    false,
+    false
+  );
+  const peg$e23 = peg$classExpectation(["\r", "\n", ")"], true, false, false);
+
+  function peg$f0(repo, path, version) {
+    return {
+      repo,
+      path: path || "",
+      version,
+    };
+  }
+  function peg$f1(characters) {
+    return join(characters);
+  }
+  function peg$f2(segment) {
+    return `/${segment}`;
+  }
+  function peg$f3(segments) {
+    return join(segments);
+  }
+  function peg$f4(characters) {
+    return join(characters);
+  }
+  function peg$f5(characters) {
+    return join(characters);
+  }
+  function peg$f6(header) {
+    return header;
+  }
+  function peg$f7(mergeTarget, repo, revision) {
+    return { repo, mergeTarget, revision };
+  }
+  function peg$f8(value) {
+    return value.length === 40;
+  }
+  function peg$f9(value) {
+    const range = location();
+    return { value, start: range.start.offset, end: range.end.offset };
+  }
+  function peg$f10() {
+    return false;
+  }
+  function peg$f11(entries) {
+    return entries.filter(Boolean).length;
+  }
+  function peg$f12() {
+    return true;
+  }
+  function peg$f13(characters) {
+    return join(characters);
+  }
+  let peg$currPos = options.peg$currPos | 0;
+  let peg$savedPos = peg$currPos;
+  const peg$posDetailsCache = [{ line: 1, column: 1 }];
+  let peg$maxFailPos = peg$currPos;
+  let peg$maxFailExpected = options.peg$maxFailExpected || [];
+  let peg$silentFails = options.peg$silentFails | 0;
+
+  let peg$result;
+
+  if (options.startRule) {
+    if (!(options.startRule in peg$startRuleFunctions)) {
+      throw new Error(
+        "Can't start parsing from rule \"" + options.startRule + '".'
+      );
+    }
+
+    peg$startRuleFunction = peg$startRuleFunctions[options.startRule];
+  }
+
+  function text() {
+    return input.substring(peg$savedPos, peg$currPos);
+  }
+
+  function offset() {
+    return peg$savedPos;
+  }
+
+  function range() {
+    return {
+      source: peg$source,
+      start: peg$savedPos,
+      end: peg$currPos,
+    };
+  }
+
+  function location() {
+    return peg$computeLocation(peg$savedPos, peg$currPos);
+  }
+
+  function expected(description, location) {
+    location =
+      location !== undefined
+        ? location
+        : peg$computeLocation(peg$savedPos, peg$currPos);
+
+    throw peg$buildStructuredError(
+      [peg$otherExpectation(description)],
+      input.substring(peg$savedPos, peg$currPos),
+      location
+    );
+  }
+
+  function error(message, location) {
+    location =
+      location !== undefined
+        ? location
+        : peg$computeLocation(peg$savedPos, peg$currPos);
+
+    throw peg$buildSimpleError(message, location);
+  }
+
+  function peg$getUnicode(pos = peg$currPos) {
+    const cp = input.codePointAt(pos);
+    if (cp === undefined) {
+      return "";
+    }
+    return String.fromCodePoint(cp);
+  }
+
+  function peg$literalExpectation(text, ignoreCase) {
+    return { type: "literal", text, ignoreCase };
+  }
+
+  function peg$classExpectation(parts, inverted, ignoreCase, unicode) {
+    return { type: "class", parts, inverted, ignoreCase, unicode };
+  }
+
+  function peg$anyExpectation() {
+    return { type: "any" };
+  }
+
+  function peg$endExpectation() {
+    return { type: "end" };
+  }
+
+  function peg$otherExpectation(description) {
+    return { type: "other", description };
+  }
+
+  function peg$computePosDetails(pos) {
+    let details = peg$posDetailsCache[pos];
+    let p;
+
+    if (details) {
+      return details;
+    } else {
+      if (pos >= peg$posDetailsCache.length) {
+        p = peg$posDetailsCache.length - 1;
+      } else {
+        p = pos;
+        while (!peg$posDetailsCache[--p]) {}
+      }
+
+      details = peg$posDetailsCache[p];
+      details = {
+        line: details.line,
+        column: details.column,
+      };
+
+      while (p < pos) {
+        if (input.charCodeAt(p) === 10) {
+          details.line++;
+          details.column = 1;
+        } else {
+          details.column++;
+        }
+
+        p++;
+      }
+
+      peg$posDetailsCache[pos] = details;
+
+      return details;
+    }
+  }
+
+  function peg$computeLocation(startPos, endPos, offset) {
+    const startPosDetails = peg$computePosDetails(startPos);
+    const endPosDetails = peg$computePosDetails(endPos);
+
+    const res = {
+      source: peg$source,
+      start: {
+        offset: startPos,
+        line: startPosDetails.line,
+        column: startPosDetails.column,
+      },
+      end: {
+        offset: endPos,
+        line: endPosDetails.line,
+        column: endPosDetails.column,
+      },
+    };
+    if (offset && peg$source && typeof peg$source.offset === "function") {
+      res.start = peg$source.offset(res.start);
+      res.end = peg$source.offset(res.end);
+    }
+    return res;
+  }
+
+  function peg$fail(expected) {
+    if (peg$currPos < peg$maxFailPos) {
+      return;
+    }
+
+    if (peg$currPos > peg$maxFailPos) {
+      peg$maxFailPos = peg$currPos;
+      peg$maxFailExpected = [];
+    }
+
+    peg$maxFailExpected.push(expected);
+  }
+
+  function peg$buildSimpleError(message, location) {
+    return new peg$SyntaxError(message, null, null, location);
+  }
+
+  function peg$buildStructuredError(expected, found, location) {
+    return new peg$SyntaxError(
+      peg$SyntaxError.buildMessage(expected, found),
+      expected,
+      found,
+      location
+    );
+  }
+
+  function peg$parsePublishIssueTitle() {
+    let s0, s1, s2, s3, s4, s5, s6, s7, s8;
+
+    s0 = peg$currPos;
+    if (input.substr(peg$currPos, 9) === peg$c0) {
+      s1 = peg$c0;
+      peg$currPos += 9;
+    } else {
+      s1 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e0);
+      }
+    }
+    if (s1 !== peg$FAILED) {
+      if (input.substr(peg$currPos, 10) === peg$c1) {
+        s2 = peg$c1;
+        peg$currPos += 10;
+      } else {
+        s2 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e1);
+        }
+      }
+      if (s2 === peg$FAILED) {
+        s2 = null;
+      }
+      s3 = peg$parseRepository();
+      if (s3 !== peg$FAILED) {
+        s4 = peg$parsePath();
+        if (s4 === peg$FAILED) {
+          s4 = null;
+        }
+        if (input.charCodeAt(peg$currPos) === 64) {
+          s5 = peg$c2;
+          peg$currPos++;
+        } else {
+          s5 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e2);
+          }
+        }
+        if (s5 !== peg$FAILED) {
+          s6 = peg$parseVersion();
+          if (s6 !== peg$FAILED) {
+            s7 = peg$currPos;
+            peg$silentFails++;
+            if (input.length > peg$currPos) {
+              s8 = input.charAt(peg$currPos);
+              peg$currPos++;
+            } else {
+              s8 = peg$FAILED;
+              if (peg$silentFails === 0) {
+                peg$fail(peg$e3);
+              }
+            }
+            peg$silentFails--;
+            if (s8 === peg$FAILED) {
+              s7 = undefined;
+            } else {
+              peg$currPos = s7;
+              s7 = peg$FAILED;
+            }
+            if (s7 !== peg$FAILED) {
+              peg$savedPos = s0;
+              s0 = peg$f0(s3, s4, s6);
+            } else {
+              peg$currPos = s0;
+              s0 = peg$FAILED;
+            }
+          } else {
+            peg$currPos = s0;
+            s0 = peg$FAILED;
+          }
+        } else {
+          peg$currPos = s0;
+          s0 = peg$FAILED;
+        }
+      } else {
+        peg$currPos = s0;
+        s0 = peg$FAILED;
+      }
+    } else {
+      peg$currPos = s0;
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function peg$parseRepository() {
+    let s0, s1, s2;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = peg$parseRepositoryCharacter();
+    if (s2 !== peg$FAILED) {
+      while (s2 !== peg$FAILED) {
+        s1.push(s2);
+        s2 = peg$parseRepositoryCharacter();
+      }
+    } else {
+      s1 = peg$FAILED;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f1(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parseRepositoryCharacter() {
+    let s0;
+
+    s0 = input.charAt(peg$currPos);
+    if (peg$r0.test(s0)) {
+      peg$currPos++;
+    } else {
+      s0 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e4);
+      }
+    }
+
+    return s0;
+  }
+
+  function peg$parsePath() {
+    let s0, s1, s2, s3, s4;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = peg$currPos;
+    if (input.charCodeAt(peg$currPos) === 47) {
+      s3 = peg$c3;
+      peg$currPos++;
+    } else {
+      s3 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e5);
+      }
+    }
+    if (s3 !== peg$FAILED) {
+      s4 = peg$parsePathSegment();
+      if (s4 !== peg$FAILED) {
+        peg$savedPos = s2;
+        s2 = peg$f2(s4);
+      } else {
+        peg$currPos = s2;
+        s2 = peg$FAILED;
+      }
+    } else {
+      peg$currPos = s2;
+      s2 = peg$FAILED;
+    }
+    if (s2 !== peg$FAILED) {
+      while (s2 !== peg$FAILED) {
+        s1.push(s2);
+        s2 = peg$currPos;
+        if (input.charCodeAt(peg$currPos) === 47) {
+          s3 = peg$c3;
+          peg$currPos++;
+        } else {
+          s3 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e5);
+          }
+        }
+        if (s3 !== peg$FAILED) {
+          s4 = peg$parsePathSegment();
+          if (s4 !== peg$FAILED) {
+            peg$savedPos = s2;
+            s2 = peg$f2(s4);
+          } else {
+            peg$currPos = s2;
+            s2 = peg$FAILED;
+          }
+        } else {
+          peg$currPos = s2;
+          s2 = peg$FAILED;
+        }
+      }
+    } else {
+      s1 = peg$FAILED;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f3(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parsePathSegment() {
+    let s0, s1, s2;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = peg$parseRepositoryCharacter();
+    if (s2 !== peg$FAILED) {
+      while (s2 !== peg$FAILED) {
+        s1.push(s2);
+        s2 = peg$parseRepositoryCharacter();
+      }
+    } else {
+      s1 = peg$FAILED;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f4(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parseVersion() {
+    let s0, s1, s2;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = input.charAt(peg$currPos);
+    if (peg$r1.test(s2)) {
+      peg$currPos++;
+    } else {
+      s2 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e6);
+      }
+    }
+    if (s2 !== peg$FAILED) {
+      while (s2 !== peg$FAILED) {
+        s1.push(s2);
+        s2 = input.charAt(peg$currPos);
+        if (peg$r1.test(s2)) {
+          peg$currPos++;
+        } else {
+          s2 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e6);
+          }
+        }
+      }
+    } else {
+      s1 = peg$FAILED;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f5(s1);
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parseReleaseRevision() {
+    let s0, s1, s2, s3;
+
+    s0 = peg$currPos;
+    s1 = peg$parseRequestHeader();
+    if (s1 !== peg$FAILED) {
+      s2 = [];
+      if (input.length > peg$currPos) {
+        s3 = input.charAt(peg$currPos);
+        peg$currPos++;
+      } else {
+        s3 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e3);
+        }
+      }
+      while (s3 !== peg$FAILED) {
+        s2.push(s3);
+        if (input.length > peg$currPos) {
+          s3 = input.charAt(peg$currPos);
+          peg$currPos++;
+        } else {
+          s3 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e3);
+          }
+        }
+      }
+      peg$savedPos = s0;
+      s0 = peg$f6(s1);
+    } else {
+      peg$currPos = s0;
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function peg$parseRequestHeader() {
+    let s0,
+      s1,
+      s2,
+      s3,
+      s4,
+      s5,
+      s6,
+      s7,
+      s8,
+      s9,
+      s10,
+      s11,
+      s12,
+      s13,
+      s14,
+      s15,
+      s16,
+      s17,
+      s18,
+      s19,
+      s20,
+      s21,
+      s22,
+      s23,
+      s24,
+      s25,
+      s26,
+      s27;
+
+    s0 = peg$currPos;
+    if (input.substr(peg$currPos, 15) === peg$c4) {
+      s1 = peg$c4;
+      peg$currPos += 15;
+    } else {
+      s1 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e7);
+      }
+    }
+    if (s1 !== peg$FAILED) {
+      s2 = peg$parseNonNewline();
+      if (s2 !== peg$FAILED) {
+        s3 = peg$parseNewline();
+        if (s3 !== peg$FAILED) {
+          s4 = peg$parseBlankLines();
+          s5 = peg$parseIndent();
+          if (input.substr(peg$currPos, 14) === peg$c5) {
+            s6 = peg$c5;
+            peg$currPos += 14;
+          } else {
+            s6 = peg$FAILED;
+            if (peg$silentFails === 0) {
+              peg$fail(peg$e8);
+            }
+          }
+          if (s6 !== peg$FAILED) {
+            s7 = peg$parseMergeTarget();
+            if (s7 !== peg$FAILED) {
+              s8 = peg$parseNewline();
+              if (s8 !== peg$FAILED) {
+                s9 = peg$parseBlankLines();
+                s10 = peg$parseIndent();
+                if (input.substr(peg$currPos, 12) === peg$c6) {
+                  s11 = peg$c6;
+                  peg$currPos += 12;
+                } else {
+                  s11 = peg$FAILED;
+                  if (peg$silentFails === 0) {
+                    peg$fail(peg$e9);
+                  }
+                }
+                if (s11 !== peg$FAILED) {
+                  s12 = peg$parseNewline();
+                  if (s12 !== peg$FAILED) {
+                    s13 = peg$parseBlankLines();
+                    s14 = peg$parseIndent();
+                    if (input.substr(peg$currPos, 17) === peg$c7) {
+                      s15 = peg$c7;
+                      peg$currPos += 17;
+                    } else {
+                      s15 = peg$FAILED;
+                      if (peg$silentFails === 0) {
+                        peg$fail(peg$e10);
+                      }
+                    }
+                    if (s15 !== peg$FAILED) {
+                      s16 = peg$parseLinkDestination();
+                      if (s16 !== peg$FAILED) {
+                        if (input.charCodeAt(peg$currPos) === 41) {
+                          s17 = peg$c8;
+                          peg$currPos++;
+                        } else {
+                          s17 = peg$FAILED;
+                          if (peg$silentFails === 0) {
+                            peg$fail(peg$e11);
+                          }
+                        }
+                        if (s17 !== peg$FAILED) {
+                          s18 = peg$parseNewline();
+                          if (s18 !== peg$FAILED) {
+                            s19 = peg$parseIndent();
+                            if (input.substr(peg$currPos, 49) === peg$c9) {
+                              s20 = peg$c9;
+                              peg$currPos += 49;
+                            } else {
+                              s20 = peg$FAILED;
+                              if (peg$silentFails === 0) {
+                                peg$fail(peg$e12);
+                              }
+                            }
+                            if (s20 !== peg$FAILED) {
+                              s21 = peg$parseRepository();
+                              if (s21 !== peg$FAILED) {
+                                if (input.substr(peg$currPos, 8) === peg$c10) {
+                                  s22 = peg$c10;
+                                  peg$currPos += 8;
+                                } else {
+                                  s22 = peg$FAILED;
+                                  if (peg$silentFails === 0) {
+                                    peg$fail(peg$e13);
+                                  }
+                                }
+                                if (s22 !== peg$FAILED) {
+                                  s23 = peg$parseCheckRunsRevision();
+                                  if (s23 !== peg$FAILED) {
+                                    if (
+                                      input.substr(peg$currPos, 7) === peg$c11
+                                    ) {
+                                      s24 = peg$c11;
+                                      peg$currPos += 7;
+                                    } else {
+                                      s24 = peg$FAILED;
+                                      if (peg$silentFails === 0) {
+                                        peg$fail(peg$e14);
+                                      }
+                                    }
+                                    if (s24 !== peg$FAILED) {
+                                      if (
+                                        input.charCodeAt(peg$currPos) === 47
+                                      ) {
+                                        s25 = peg$c3;
+                                        peg$currPos++;
+                                      } else {
+                                        s25 = peg$FAILED;
+                                        if (peg$silentFails === 0) {
+                                          peg$fail(peg$e5);
+                                        }
+                                      }
+                                      if (s25 === peg$FAILED) {
+                                        s25 = null;
+                                      }
+                                      if (
+                                        input.charCodeAt(peg$currPos) === 41
+                                      ) {
+                                        s26 = peg$c8;
+                                        peg$currPos++;
+                                      } else {
+                                        s26 = peg$FAILED;
+                                        if (peg$silentFails === 0) {
+                                          peg$fail(peg$e11);
+                                        }
+                                      }
+                                      if (s26 !== peg$FAILED) {
+                                        s27 = peg$parseLineBoundary();
+                                        if (s27 !== peg$FAILED) {
+                                          peg$savedPos = s0;
+                                          s0 = peg$f7(s7, s21, s23);
+                                        } else {
+                                          peg$currPos = s0;
+                                          s0 = peg$FAILED;
+                                        }
+                                      } else {
+                                        peg$currPos = s0;
+                                        s0 = peg$FAILED;
+                                      }
+                                    } else {
+                                      peg$currPos = s0;
+                                      s0 = peg$FAILED;
+                                    }
+                                  } else {
+                                    peg$currPos = s0;
+                                    s0 = peg$FAILED;
+                                  }
+                                } else {
+                                  peg$currPos = s0;
+                                  s0 = peg$FAILED;
+                                }
+                              } else {
+                                peg$currPos = s0;
+                                s0 = peg$FAILED;
+                              }
+                            } else {
+                              peg$currPos = s0;
+                              s0 = peg$FAILED;
+                            }
+                          } else {
+                            peg$currPos = s0;
+                            s0 = peg$FAILED;
+                          }
+                        } else {
+                          peg$currPos = s0;
+                          s0 = peg$FAILED;
+                        }
+                      } else {
+                        peg$currPos = s0;
+                        s0 = peg$FAILED;
+                      }
+                    } else {
+                      peg$currPos = s0;
+                      s0 = peg$FAILED;
+                    }
+                  } else {
+                    peg$currPos = s0;
+                    s0 = peg$FAILED;
+                  }
+                } else {
+                  peg$currPos = s0;
+                  s0 = peg$FAILED;
+                }
+              } else {
+                peg$currPos = s0;
+                s0 = peg$FAILED;
+              }
+            } else {
+              peg$currPos = s0;
+              s0 = peg$FAILED;
+            }
+          } else {
+            peg$currPos = s0;
+            s0 = peg$FAILED;
+          }
+        } else {
+          peg$currPos = s0;
+          s0 = peg$FAILED;
+        }
+      } else {
+        peg$currPos = s0;
+        s0 = peg$FAILED;
+      }
+    } else {
+      peg$currPos = s0;
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function peg$parseCheckRunsRevision() {
+    let s0, s1, s2, s3;
+
+    s0 = peg$currPos;
+    s1 = peg$currPos;
+    s2 = [];
+    s3 = input.charAt(peg$currPos);
+    if (peg$r2.test(s3)) {
+      peg$currPos++;
+    } else {
+      s3 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e15);
+      }
+    }
+    if (s3 !== peg$FAILED) {
+      while (s3 !== peg$FAILED) {
+        s2.push(s3);
+        s3 = input.charAt(peg$currPos);
+        if (peg$r2.test(s3)) {
+          peg$currPos++;
+        } else {
+          s3 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e15);
+          }
+        }
+      }
+    } else {
+      s2 = peg$FAILED;
+    }
+    if (s2 !== peg$FAILED) {
+      s1 = input.substring(s1, peg$currPos);
+    } else {
+      s1 = s2;
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = peg$currPos;
+      s2 = peg$f8(s1);
+      if (s2) {
+        s2 = undefined;
+      } else {
+        s2 = peg$FAILED;
+      }
+      if (s2 !== peg$FAILED) {
+        peg$savedPos = s0;
+        s0 = peg$f9(s1);
+      } else {
+        peg$currPos = s0;
+        s0 = peg$FAILED;
+      }
+    } else {
+      peg$currPos = s0;
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function peg$parseCheckRunsLinkCount() {
+    let s0, s1, s2, s3;
+
+    s0 = peg$currPos;
+    s1 = [];
+    s2 = peg$parseCheckRunsLink();
+    if (s2 === peg$FAILED) {
+      s2 = peg$currPos;
+      if (input.length > peg$currPos) {
+        s3 = input.charAt(peg$currPos);
+        peg$currPos++;
+      } else {
+        s3 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e3);
+        }
+      }
+      if (s3 !== peg$FAILED) {
+        peg$savedPos = s2;
+        s3 = peg$f10();
+      }
+      s2 = s3;
+    }
+    while (s2 !== peg$FAILED) {
+      s1.push(s2);
+      s2 = peg$parseCheckRunsLink();
+      if (s2 === peg$FAILED) {
+        s2 = peg$currPos;
+        if (input.length > peg$currPos) {
+          s3 = input.charAt(peg$currPos);
+          peg$currPos++;
+        } else {
+          s3 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e3);
+          }
+        }
+        if (s3 !== peg$FAILED) {
+          peg$savedPos = s2;
+          s3 = peg$f10();
+        }
+        s2 = s3;
+      }
+    }
+    s2 = peg$currPos;
+    peg$silentFails++;
+    if (input.length > peg$currPos) {
+      s3 = input.charAt(peg$currPos);
+      peg$currPos++;
+    } else {
+      s3 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e3);
+      }
+    }
+    peg$silentFails--;
+    if (s3 === peg$FAILED) {
+      s2 = undefined;
+    } else {
+      peg$currPos = s2;
+      s2 = peg$FAILED;
+    }
+    if (s2 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s0 = peg$f11(s1);
+    } else {
+      peg$currPos = s0;
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function peg$parseCheckRunsLink() {
+    let s0, s1;
+
+    s0 = peg$currPos;
+    if (input.substr(peg$currPos, 20) === peg$c12) {
+      s1 = peg$c12;
+      peg$currPos += 20;
+    } else {
+      s1 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e16);
+      }
+    }
+    if (s1 !== peg$FAILED) {
+      peg$savedPos = s0;
+      s1 = peg$f12();
+    }
+    s0 = s1;
+
+    return s0;
+  }
+
+  function peg$parseIndent() {
+    let s0, s1;
+
+    s0 = [];
+    s1 = input.charAt(peg$currPos);
+    if (peg$r3.test(s1)) {
+      peg$currPos++;
+    } else {
+      s1 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e17);
+      }
+    }
+    while (s1 !== peg$FAILED) {
+      s0.push(s1);
+      s1 = input.charAt(peg$currPos);
+      if (peg$r3.test(s1)) {
+        peg$currPos++;
+      } else {
+        s1 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e17);
+        }
+      }
+    }
+
+    return s0;
+  }
+
+  function peg$parseBlankLines() {
+    let s0, s1, s2, s3;
+
+    s0 = [];
+    s1 = peg$currPos;
+    s2 = peg$parseIndent();
+    s3 = peg$parseNewline();
+    if (s3 !== peg$FAILED) {
+      s2 = [s2, s3];
+      s1 = s2;
+    } else {
+      peg$currPos = s1;
+      s1 = peg$FAILED;
+    }
+    while (s1 !== peg$FAILED) {
+      s0.push(s1);
+      s1 = peg$currPos;
+      s2 = peg$parseIndent();
+      s3 = peg$parseNewline();
+      if (s3 !== peg$FAILED) {
+        s2 = [s2, s3];
+        s1 = s2;
+      } else {
+        peg$currPos = s1;
+        s1 = peg$FAILED;
+      }
+    }
+
+    return s0;
+  }
+
+  function peg$parseLineBoundary() {
+    let s0, s1;
+
+    s0 = peg$parseNewline();
+    if (s0 === peg$FAILED) {
+      s0 = peg$currPos;
+      peg$silentFails++;
+      if (input.length > peg$currPos) {
+        s1 = input.charAt(peg$currPos);
+        peg$currPos++;
+      } else {
+        s1 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e3);
+        }
+      }
+      peg$silentFails--;
+      if (s1 === peg$FAILED) {
+        s0 = undefined;
+      } else {
+        peg$currPos = s0;
+        s0 = peg$FAILED;
+      }
+    }
+
+    return s0;
+  }
+
+  function peg$parseNewline() {
+    let s0;
+
+    if (input.substr(peg$currPos, 2) === peg$c13) {
+      s0 = peg$c13;
+      peg$currPos += 2;
+    } else {
+      s0 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e18);
+      }
+    }
+    if (s0 === peg$FAILED) {
+      if (input.charCodeAt(peg$currPos) === 10) {
+        s0 = peg$c14;
+        peg$currPos++;
+      } else {
+        s0 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e19);
+        }
+      }
+    }
+
+    return s0;
+  }
+
+  function peg$parseNonNewline() {
+    let s0, s1;
+
+    s0 = [];
+    s1 = input.charAt(peg$currPos);
+    if (peg$r4.test(s1)) {
+      peg$currPos++;
+    } else {
+      s1 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e20);
+      }
+    }
+    if (s1 !== peg$FAILED) {
+      while (s1 !== peg$FAILED) {
+        s0.push(s1);
+        s1 = input.charAt(peg$currPos);
+        if (peg$r4.test(s1)) {
+          peg$currPos++;
+        } else {
+          s1 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e20);
+          }
+        }
+      }
+    } else {
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function peg$parseMergeTarget() {
+    let s0, s1, s2;
+
+    if (input.substr(peg$currPos, 9) === peg$c15) {
+      s0 = peg$c15;
+      peg$currPos += 9;
+    } else {
+      s0 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e21);
+      }
+    }
+    if (s0 === peg$FAILED) {
+      s0 = peg$currPos;
+      s1 = [];
+      s2 = input.charAt(peg$currPos);
+      if (peg$r5.test(s2)) {
+        peg$currPos++;
+      } else {
+        s2 = peg$FAILED;
+        if (peg$silentFails === 0) {
+          peg$fail(peg$e22);
+        }
+      }
+      if (s2 !== peg$FAILED) {
+        while (s2 !== peg$FAILED) {
+          s1.push(s2);
+          s2 = input.charAt(peg$currPos);
+          if (peg$r5.test(s2)) {
+            peg$currPos++;
+          } else {
+            s2 = peg$FAILED;
+            if (peg$silentFails === 0) {
+              peg$fail(peg$e22);
+            }
+          }
+        }
+      } else {
+        s1 = peg$FAILED;
+      }
+      if (s1 !== peg$FAILED) {
+        peg$savedPos = s0;
+        s1 = peg$f13(s1);
+      }
+      s0 = s1;
+    }
+
+    return s0;
+  }
+
+  function peg$parseLinkDestination() {
+    let s0, s1;
+
+    s0 = [];
+    s1 = input.charAt(peg$currPos);
+    if (peg$r6.test(s1)) {
+      peg$currPos++;
+    } else {
+      s1 = peg$FAILED;
+      if (peg$silentFails === 0) {
+        peg$fail(peg$e23);
+      }
+    }
+    if (s1 !== peg$FAILED) {
+      while (s1 !== peg$FAILED) {
+        s0.push(s1);
+        s1 = input.charAt(peg$currPos);
+        if (peg$r6.test(s1)) {
+          peg$currPos++;
+        } else {
+          s1 = peg$FAILED;
+          if (peg$silentFails === 0) {
+            peg$fail(peg$e23);
+          }
+        }
+      }
+    } else {
+      s0 = peg$FAILED;
+    }
+
+    return s0;
+  }
+
+  function join(characters) {
+    return characters.join("");
+  }
+
+  peg$result = peg$startRuleFunction();
+
+  const peg$success = peg$result !== peg$FAILED && peg$currPos === input.length;
+  function peg$throw() {
+    if (peg$result !== peg$FAILED && peg$currPos < input.length) {
+      peg$fail(peg$endExpectation());
+    }
+
+    throw peg$buildStructuredError(
+      peg$maxFailExpected,
+      peg$maxFailPos < input.length ? peg$getUnicode(peg$maxFailPos) : null,
+      peg$maxFailPos < input.length
+        ? peg$computeLocation(peg$maxFailPos, peg$maxFailPos + 1)
+        : peg$computeLocation(peg$maxFailPos, peg$maxFailPos)
+    );
+  }
+  if (options.peg$library) {
+    return /** @type {any} */ ({
+      peg$result,
+      peg$currPos,
+      peg$FAILED,
+      peg$maxFailExpected,
+      peg$maxFailPos,
+      peg$success,
+      peg$throw: peg$success ? undefined : peg$throw,
+    });
+  }
+  if (peg$success) {
+    return peg$result;
+  } else {
+    peg$throw();
+  }
+}
+
+module.exports = {
+  StartRules: ["PublishIssueTitle", "ReleaseRevision", "CheckRunsLinkCount"],
+  SyntaxError: peg$SyntaxError,
+  parse: peg$parse,
+};
diff --git a/src/modules/publish-issue-title.peggy b/src/modules/publish-issue-title.peggy
new file mode 100644
index 0000000..3e2aac2
--- /dev/null
+++ b/src/modules/publish-issue-title.peggy
@@ -0,0 +1,86 @@
+{
+  function join(characters) {
+    return characters.join("");
+  }
+}
+
+// BEGIN TITLE GRAMMAR
+// Canonical grammar for publish issue titles. A path suffix is syntactic only:
+// the controller resolves the complete suffix as a workspace after checking
+// out the CI-approved revision.
+PublishIssueTitle
+  = "publish: " "getsentry/"? repo:Repository path:Path? "@" version:Version !. {
+      return {
+        repo,
+        path: path || "",
+        version,
+      };
+    }
+
+Repository
+  = characters:RepositoryCharacter+ { return join(characters); }
+
+RepositoryCharacter
+  = [A-Za-z0-9_.-]
+
+Path
+  = segments:("/" segment:PathSegment { return `/${segment}`; })+ { return join(segments); }
+
+PathSegment
+  = characters:RepositoryCharacter+ { return join(characters); }
+
+Version
+  = characters:[A-Za-z0-9_.+-]+ { return join(characters); }
+// END TITLE GRAMMAR
+
+// The release revision must be read from the request header at the start of
+// the issue body. CheckRunsLinkCount protects it from appended decoy links.
+ReleaseRevision
+  = header:RequestHeader .* { return header; }
+
+RequestHeader
+  = "Requested by: @" NonNewline Newline BlankLines
+    Indent "Merge target: " mergeTarget:MergeTarget Newline BlankLines
+    Indent "Quick links:" Newline BlankLines
+    Indent "- [View changes](" LinkDestination ")" Newline
+    Indent "- [View check runs](https://github.com/getsentry/" repo:Repository "/commit/" revision:CheckRunsRevision "/checks" "/"? ")" LineBoundary {
+      return { repo, mergeTarget, revision };
+    }
+
+CheckRunsRevision
+  = value:$[0-9a-f]+ &{
+      return value.length === 40;
+    } {
+      const range = location();
+      return { value, start: range.start.offset, end: range.end.offset };
+    }
+
+CheckRunsLinkCount
+  = entries:(CheckRunsLink / . { return false; })* !. { return entries.filter(Boolean).length; }
+
+CheckRunsLink
+  = "- [View check runs](" { return true; }
+
+Indent
+  = [ \t]*
+
+BlankLines
+  = (Indent Newline)*
+
+LineBoundary
+  = Newline
+  / !.
+
+Newline
+  = "\r\n"
+  / "\n"
+
+NonNewline
+  = [^\r\n]+
+
+MergeTarget
+  = "(default)"
+  / characters:[A-Za-z0-9_./-]+ { return join(characters); }
+
+LinkDestination
+  = [^\r\n)]+
diff --git a/src/modules/publish-issue-validation.js b/src/modules/publish-issue-validation.js
new file mode 100644
index 0000000..e3813d6
--- /dev/null
+++ b/src/modules/publish-issue-validation.js
@@ -0,0 +1,17 @@
+function isPublishRepository(name) {
+  return (
+    /^[A-Za-z0-9_.-]+$/.test(name) &&
+    name !== "." &&
+    name !== ".." &&
+    name !== "__proto__" &&
+    !name.startsWith("-")
+  );
+}
+
+function isReleaseVersion(version) {
+  return /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-?([0-9a-z-]+(?:\.[0-9a-z-]+)*))?(?:\+([0-9a-z-]+(?:\.[0-9a-z-]+)*))?$/i.test(
+    version
+  );
+}
+
+module.exports = { isPublishRepository, isReleaseVersion };
diff --git a/src/modules/publish-location.js b/src/modules/publish-location.js
new file mode 100644
index 0000000..0d2dba3
--- /dev/null
+++ b/src/modules/publish-location.js
@@ -0,0 +1,53 @@
+function resolvePublishLocation({ path, workspaceNames }) {
+  if (!isPublishPath(path)) {
+    throw new Error("Invalid publish path.");
+  }
+
+  if (!workspaceNames.every(isWorkspaceName)) {
+    throw new Error(
+      "Craft workspace discovery returned an invalid workspace list."
+    );
+  }
+
+  if (path === ".") {
+    return { path };
+  }
+
+  const workspace = path.slice(2);
+  if (workspaceNames.includes(workspace)) {
+    return { path: ".", workspace };
+  }
+
+  return { path };
+}
+
+function isPublishPath(path) {
+  return (
+    typeof path === "string" &&
+    (path === "." ||
+      (path.startsWith("./") &&
+        path
+          .slice(2)
+          .split("/")
+          .every(isSafeWorkspaceSegment)))
+  );
+}
+
+function isWorkspaceName(name) {
+  return (
+    typeof name === "string" &&
+    name.split("/").every(isSafeWorkspaceSegment)
+  );
+}
+
+function isSafeWorkspaceSegment(segment) {
+  return (
+    /^[A-Za-z0-9_.-]+$/.test(segment) &&
+    segment !== "." &&
+    segment !== ".." &&
+    segment !== "__proto__" &&
+    !segment.startsWith("-")
+  );
+}
+
+module.exports = { resolvePublishLocation, isPublishPath };
diff --git a/src/modules/release-revision.js b/src/modules/release-revision.js
new file mode 100644
index 0000000..ca538e6
--- /dev/null
+++ b/src/modules/release-revision.js
@@ -0,0 +1,51 @@
+const { parse } = require("./publish-issue-title");
+
+function isRevision(revision) {
+  return /^[0-9a-f]{40}$/.test(revision);
+}
+
+function getReleaseRevisionDetails({ issueBody, repo }) {
+  if (
+    parse(issueBody, { startRule: "CheckRunsLinkCount" }) !== 1
+  ) {
+    throw new Error(
+      `Expected exactly one View check runs link in Quick links for getsentry/${repo}.`
+    );
+  }
+
+  let details;
+  try {
+    details = parse(issueBody, { startRule: "ReleaseRevision" });
+  } catch {
+    throw new Error(
+      `Expected a View check runs link for getsentry/${repo} in the publish issue body.`
+    );
+  }
+
+  if (details.repo !== repo) {
+    throw new Error(
+      `Expected a View check runs link for getsentry/${repo} in the publish issue body.`
+    );
+  }
+
+  return details;
+}
+
+function getReleaseRevision({ issueBody, repo }) {
+  return getReleaseRevisionDetails({ issueBody, repo }).revision.value;
+}
+
+function updateReleaseRevision({ issueBody, repo, revision }) {
+  if (!isRevision(revision)) {
+    throw new Error("Release revision must be a lowercase 40-character SHA.");
+  }
+
+  const { revision: currentRevision } = getReleaseRevisionDetails({ issueBody, repo });
+  return `${issueBody.slice(0, currentRevision.start)}${revision}${issueBody.slice(currentRevision.end)}`;
+}
+
+module.exports = {
+  getReleaseRevision,
+  getReleaseRevisionDetails,
+  updateReleaseRevision,
+};
diff --git a/src/modules/update-issue.js b/src/modules/update-issue.js
index 9b600cc..0dc5c30 100644
--- a/src/modules/update-issue.js
+++ b/src/modules/update-issue.js
@@ -4,10 +4,13 @@ const {
   TARGETS_PARSER_REGEX,
 } = require("./details-from-context");
 
-async function updateTargets({octokit, version, publishRepo, issue_number}) {
-  const CRAFT_STATE_FILE_PATH = `${process.env.GITHUB_WORKSPACE}/__repo__/.craft-publish-${version}.json`;
-
-  if (!fs.existsSync(CRAFT_STATE_FILE_PATH)) {
+async function updateTargets({
+  octokit,
+  stateFilePath,
+  publishRepo,
+  issue_number,
+}) {
+  if (!stateFilePath || !fs.existsSync(stateFilePath)) {
     return;
   }
 
@@ -17,7 +20,7 @@ async function updateTargets({octokit, version, publishRepo, issue_number}) {
   });
 
   const craftStateRequest = fs.promises
-    .readFile(CRAFT_STATE_FILE_PATH, { encoding: "utf-8" })
+    .readFile(stateFilePath, { encoding: "utf-8" })
     .then((data) => JSON.parse(data));
 
   const [{ data: issue }, craftState] = await Promise.all([
@@ -36,37 +39,40 @@ async function updateTargets({octokit, version, publishRepo, issue_number}) {
 
 function transformIssueBody(craftState, issueBody) {
   const declaredTargets = new Set();
-  return issueBody.replace(
-    TARGETS_SECTION_PARSER_REGEX,
-    (targetsSection) => {
-      let targetsText = targetsSection.trimEnd();
-      targetsText = targetsText.replace(
-        TARGETS_PARSER_REGEX,
-        (_match, targetId) => {
-          declaredTargets.add(targetId);
-          const x = craftState.published[targetId] ? "x" : " ";
-          return `- [${x}] ${targetId}`;
-        }
-      );
-      const unlistedTargets = Object.keys(craftState.published)
+  return issueBody.replace(TARGETS_SECTION_PARSER_REGEX, (targetsSection) => {
+    let targetsText = targetsSection.trimEnd();
+    targetsText = targetsText.replace(
+      TARGETS_PARSER_REGEX,
+      (_match, targetId) => {
+        declaredTargets.add(targetId);
+        const x = craftState.published[targetId] ? "x" : " ";
+        return `- [${x}] ${targetId}`;
+      }
+    );
+    const unlistedTargets =
+      Object.keys(craftState.published)
         .filter((target) => !declaredTargets.has(target))
         .map(
           (target) =>
             `- [${craftState.published[target] ? "x" : " "}] ${target}`
         )
-        .join("\n") + '\n';
-      targetsText += `\n${unlistedTargets}\n`;
-      return targetsText;
+        .join("\n") + "\n";
+    targetsText += `\n${unlistedTargets}\n`;
+    return targetsText;
   });
 }
 
-async function updateIssue({ context, octokit, inputs }) {
-  const { version } = inputs;
+async function updateIssue({ context, octokit }) {
   const { repo: publishRepo } = context;
   const { number: issue_number } = context.payload.issue;
 
   await Promise.all([
-    updateTargets({octokit, version, publishRepo, issue_number}),
+    updateTargets({
+      octokit,
+      stateFilePath: process.env.CRAFT_STATE_FILE_PATH,
+      publishRepo,
+      issue_number,
+    }),
     octokit.rest.issues.removeLabel({
       ...publishRepo,
       issue_number,
diff --git a/src/publish/__tests__/discover-location.js b/src/publish/__tests__/discover-location.js
new file mode 100644
index 0000000..7b522a6
--- /dev/null
+++ b/src/publish/__tests__/discover-location.js
@@ -0,0 +1,59 @@
+import { afterEach, expect, test, vi } from "vitest";
+
+const { discoverLocation, getWorkspaceNames } = require("../discover-location.js");
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+test("retains checkout-path behavior when the root config is absent", () => {
+  expect(
+    discoverLocation({
+      input: { path: "./packages/cli" },
+      repositoryDirectory: "__repo__",
+      exists: () => false,
+    })
+  ).toEqual({ path: "./packages/cli" });
+});
+
+test("discovers exact workspace paths using the released Craft image", () => {
+  const execFile = vi.fn(() => '["packages/CLI"]');
+
+  expect(
+    discoverLocation({
+      input: { path: "./packages/CLI" },
+      repositoryDirectory: "__repo__",
+      exists: () => true,
+      execFile,
+    })
+  ).toEqual({ path: ".", workspace: "packages/CLI" });
+  expect(execFile).toHaveBeenCalledWith(
+    "docker",
+    expect.arrayContaining(["getsentry/craft:latest", "workspace", "list"]),
+    { encoding: "utf8" }
+  );
+});
+
+test("fails closed when Craft returns an invalid workspace list", () => {
+  const execFile = vi.fn(() => "{}");
+
+  expect(() =>
+    getWorkspaceNames({
+      repositoryDirectory: "__repo__",
+      exists: () => true,
+      execFile,
+    })
+  ).toThrow("Craft workspace discovery returned an invalid workspace list.");
+});
+
+test("fails closed when Craft returns no workspace output", () => {
+  const execFile = vi.fn(() => "\n");
+
+  expect(() =>
+    getWorkspaceNames({
+      repositoryDirectory: "__repo__",
+      exists: () => true,
+      execFile,
+    })
+  ).toThrow("Craft workspace discovery returned an invalid workspace list.");
+});
diff --git a/src/publish/__tests__/resolve-location.js b/src/publish/__tests__/resolve-location.js
new file mode 100644
index 0000000..b9063c3
--- /dev/null
+++ b/src/publish/__tests__/resolve-location.js
@@ -0,0 +1,19 @@
+import { spawnSync } from "child_process";
+import { expect, test } from "vitest";
+
+const script = new URL("../resolve-location.js", import.meta.url).pathname;
+
+test("rejects missing workflow input through location validation", () => {
+  const result = spawnSync(process.execPath, [script], {
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      PUBLISH_ARGS: "",
+      CRAFT_WORKSPACE_NAMES: "[]",
+    },
+  });
+
+  expect(result.status).not.toBe(0);
+  expect(result.stderr).toContain("Invalid publish path.");
+  expect(result.stderr).not.toContain("Unexpected end of JSON input");
+});
diff --git a/src/publish/__tests__/resolve-release-revision.js b/src/publish/__tests__/resolve-release-revision.js
new file mode 100644
index 0000000..a155fc0
--- /dev/null
+++ b/src/publish/__tests__/resolve-release-revision.js
@@ -0,0 +1,19 @@
+import { spawnSync } from "child_process";
+import { expect, test } from "vitest";
+
+const script = new URL("../resolve-release-revision.js", import.meta.url).pathname;
+
+test("rejects missing workflow input through release revision validation", () => {
+  const result = spawnSync(process.execPath, [script], {
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      PUBLISH_ARGS: "",
+      PUBLISH_ISSUE_BODY: "",
+    },
+  });
+
+  expect(result.status).not.toBe(0);
+  expect(result.stderr).toContain("Publish input must define a repository.");
+  expect(result.stderr).not.toContain("Unexpected end of JSON input");
+});
diff --git a/src/publish/discover-location.js b/src/publish/discover-location.js
new file mode 100644
index 0000000..5885443
--- /dev/null
+++ b/src/publish/discover-location.js
@@ -0,0 +1,78 @@
+const { execFileSync } = require("child_process");
+const { existsSync } = require("fs");
+const path = require("path");
+
+const core = require("@actions/core");
+
+const { resolvePublishLocation } = require("../modules/publish-location");
+
+function getWorkspaceNames({
+  repositoryDirectory,
+  exists = existsSync,
+  execFile = execFileSync,
+}) {
+  if (!exists(path.join(repositoryDirectory, ".craft.yml"))) {
+    return [];
+  }
+
+  const output = execFile(
+    "docker",
+    [
+      "run",
+      "--rm",
+      "--volume",
+      `${path.resolve(repositoryDirectory)}:/github/workspace/__repo__`,
+      "--workdir",
+      "/github/workspace/__repo__",
+      "getsentry/craft:latest",
+      "workspace",
+      "list",
+    ],
+    { encoding: "utf8" }
+  );
+  let workspaceNames;
+  try {
+    workspaceNames = JSON.parse(output);
+  } catch {
+    throw new Error("Craft workspace discovery returned an invalid workspace list.");
+  }
+  if (!Array.isArray(workspaceNames)) {
+    throw new Error("Craft workspace discovery returned an invalid workspace list.");
+  }
+  return workspaceNames;
+}
+
+function discoverLocation({
+  input,
+  repositoryDirectory,
+  exists,
+  execFile,
+}) {
+  return resolvePublishLocation({
+    path: input.path,
+    workspaceNames: getWorkspaceNames({ repositoryDirectory, exists, execFile }),
+  });
+}
+
+function main() {
+  const input = JSON.parse(process.env.PUBLISH_ARGS || "{}");
+  if (!input.path) {
+    throw new Error("Publish input must define a path.");
+  }
+
+  core.setOutput(
+    "result",
+    JSON.stringify(
+      discoverLocation({
+        input,
+        repositoryDirectory: process.env.PUBLISH_REPOSITORY_DIRECTORY || "__repo__",
+      })
+    )
+  );
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { discoverLocation, getWorkspaceNames };
diff --git a/src/publish/inputs.js b/src/publish/inputs.js
index 0640d9e..c9efbea 100644
--- a/src/publish/inputs.js
+++ b/src/publish/inputs.js
@@ -6,8 +6,8 @@ async function inputs() {
     const result = await detailsFromContext({
       context: github.context,
     });
-    core.setOutput('result', result);
+    core.setOutput('result', JSON.stringify(result));
 }
 
 
-inputs();
\ No newline at end of file
+inputs();
diff --git a/src/publish/resolve-ci-poller-input.js b/src/publish/resolve-ci-poller-input.js
new file mode 100644
index 0000000..71783af
--- /dev/null
+++ b/src/publish/resolve-ci-poller-input.js
@@ -0,0 +1,16 @@
+const { getCiPollerInput } = require("../modules/ci-poller-input");
+const { readFileSync } = require("fs");
+
+const issueBody = process.env.PUBLISH_ISSUE_BODY_FILE
+  ? readFileSync(process.env.PUBLISH_ISSUE_BODY_FILE, "utf8")
+  : process.env.PUBLISH_ISSUE_BODY || "";
+
+process.stdout.write(
+  JSON.stringify(
+    getCiPollerInput({
+      issueBody,
+      title: process.env.PUBLISH_TITLE || "",
+      revision: process.env.PUBLISH_REVISION || "",
+    })
+  )
+);
diff --git a/src/publish/resolve-location.js b/src/publish/resolve-location.js
new file mode 100644
index 0000000..d551322
--- /dev/null
+++ b/src/publish/resolve-location.js
@@ -0,0 +1,25 @@
+const core = require("@actions/core");
+const { resolvePublishLocation } = require("../modules/publish-location");
+
+function resolveLocation() {
+  const input = JSON.parse(process.env.PUBLISH_ARGS || "{}");
+  const workspaceNames = JSON.parse(process.env.CRAFT_WORKSPACE_NAMES || "[]");
+
+  if (!Array.isArray(workspaceNames)) {
+    throw new Error(
+      "Craft workspace discovery returned an invalid workspace list."
+    );
+  }
+
+  core.setOutput(
+    "result",
+    JSON.stringify(
+      resolvePublishLocation({
+        path: input.path,
+        workspaceNames,
+      })
+    )
+  );
+}
+
+resolveLocation();
diff --git a/src/publish/resolve-release-revision.js b/src/publish/resolve-release-revision.js
new file mode 100644
index 0000000..36e16db
--- /dev/null
+++ b/src/publish/resolve-release-revision.js
@@ -0,0 +1,19 @@
+const core = require("@actions/core");
+const { getReleaseRevision } = require("../modules/release-revision");
+
+function resolveReleaseRevision() {
+  const { repo } = JSON.parse(process.env.PUBLISH_ARGS || "{}");
+  if (!repo) {
+    throw new Error("Publish input must define a repository.");
+  }
+
+  core.setOutput(
+    "revision",
+    getReleaseRevision({
+      issueBody: process.env.PUBLISH_ISSUE_BODY || "",
+      repo,
+    })
+  );
+}
+
+resolveReleaseRevision();
diff --git a/yarn.lock b/yarn.lock
index 571d807..1fcddf4 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -535,6 +535,13 @@
   resolved "https://registry.yarnpkg.com/@oxc-project/types/-/types-0.133.0.tgz#2e282ef9e1d26e06b68ccd14b73f310a3b2cf7f8"
   integrity sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==
 
+"@peggyjs/from-mem@3.1.3":
+  version "3.1.3"
+  resolved "https://registry.yarnpkg.com/@peggyjs/from-mem/-/from-mem-3.1.3.tgz#2956c3c68ec2e08e55178049a327009ee61541b8"
+  integrity sha512-LLlgtfXIaeYXoOYovOI0spLM8ZXaqkAlmcRRrLzHJzLMqkU6Sw0R4KMoCoHx1PjaP815pSCBlS+BN6aD8t1Jgg==
+  dependencies:
+    semver "7.7.4"
+
 "@prisma/instrumentation@6.19.0":
   version "6.19.0"
   resolved "https://registry.yarnpkg.com/@prisma/instrumentation/-/instrumentation-6.19.0.tgz#46d15adc8bc4a5a3167032eea6d0a7aa64fb7d93"
@@ -944,6 +951,11 @@ color-name@~1.1.4:
   resolved "https://registry.yarnpkg.com/color-name/-/color-name-1.1.4.tgz#c2a09a87acbde69543de6f63fa3995c826c536a2"
   integrity sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==
 
+commander@^14.0.3:
+  version "14.0.3"
+  resolved "https://registry.yarnpkg.com/commander/-/commander-14.0.3.tgz#425d79b48f9af82fcd9e4fc1ea8af6c5ec07bbc2"
+  integrity sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==
+
 concat-map@0.0.1:
   version "0.0.1"
   resolved "https://registry.yarnpkg.com/concat-map/-/concat-map-0.0.1.tgz#d8a96bd77fd68df7793a73036a3ba0d5405d477b"
@@ -1523,6 +1535,15 @@ pathe@^2.0.3:
   resolved "https://registry.yarnpkg.com/pathe/-/pathe-2.0.3.tgz#3ecbec55421685b70a9da872b2cff3e1cbed1716"
   integrity sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==
 
+peggy@5.1.0:
+  version "5.1.0"
+  resolved "https://registry.yarnpkg.com/peggy/-/peggy-5.1.0.tgz#8e2a681128cf776648417f60394a40b4a712f503"
+  integrity sha512-IEo5aYRZ2kXH4Qby06cjtL114PZnwLoTiA41vUmg2vPZgANn+c87m5BUurhuDr5/cu758ZlpgsAfBVx+hhO5+w==
+  dependencies:
+    "@peggyjs/from-mem" "3.1.3"
+    commander "^14.0.3"
+    source-map-generator "2.0.6"
+
 pg-int8@1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/pg-int8/-/pg-int8-1.0.1.tgz#943bd463bf5b71b4170115f80f8efc9a0c0eb78c"
@@ -1661,6 +1682,11 @@ run-parallel@^1.1.9:
   dependencies:
     queue-microtask "^1.2.2"
 
+semver@7.7.4:
+  version "7.7.4"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.4.tgz#28464e36060e991fa7a11d0279d2d3f3b57a7e8a"
+  integrity sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==
+
 shebang-command@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/shebang-command/-/shebang-command-2.0.0.tgz#ccd0af4f8835fbdc265b82461aaf0c36663f34ea"
@@ -1678,6 +1704,11 @@ siginfo@^2.0.0:
   resolved "https://registry.yarnpkg.com/siginfo/-/siginfo-2.0.0.tgz#32e76c70b79724e3bb567cb9d543eb858ccfaf30"
   integrity sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==
 
+source-map-generator@2.0.6:
+  version "2.0.6"
+  resolved "https://registry.yarnpkg.com/source-map-generator/-/source-map-generator-2.0.6.tgz#284776dff4bd5efdefead67aaed0c0f85f5a42ca"
+  integrity sha512-IlassDs1Ve8nV6uyQZXF9kdkJpVKnMte2JZQXu13M0A5zwc+vu6+LNHfmxsHBMDtoZE21RHiKI0/xvpecZRCNg==
+
 source-map-js@^1.2.1:
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46"