From 1828d48c5c527c7481ef86d9db875693f8be7b94 Mon Sep 17 00:00:00 2001 From: Benoit TRAVERS Date: Wed, 26 Aug 2026 01:38:30 +0200 Subject: [PATCH] ci: pin the release checkout to the commit CI validated MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit btravstack/tools#6 added a `ref` input to the shared release workflow, and `workflows-v1` now points at it. Passing `github.event.workflow_run.head_sha` checks out the exact commit the green run measured; without it a `workflow_run` checkout takes the default branch's CURRENT tip, which a push landing after CI went green can have moved — cutting a permanent npm tarball from a commit no CI run validated. The window is small and the newer commit gets its own CI run, but a tarball cannot be unpublished after 72 hours. btravstack/btravstack's `deploy-docs.yml` has guarded the identical hazard all along for a redeployable site. Nothing else changes here: the same tag move already brought `changesets/action@v2` to this repository, which is what stops a `.changeset/CLAUDE.md` from failing every release. --- .github/workflows/release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b8927d0..04ea403 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,5 +18,11 @@ jobs: pull-requests: write id-token: write uses: btravstack/tools/.github/workflows/release-reusable.yml@workflows-v1 + with: + # The exact commit the green CI run measured. Without it a `workflow_run` + # checkout takes the default branch's CURRENT tip, which a push landing + # after CI went green can have moved — publishing a permanent tarball + # from a commit no CI run validated. + ref: ${{ github.event.workflow_run.head_sha }} secrets: RELEASE_PAT: ${{ secrets.RELEASE_PAT }}