fix: pin release publishing to merge commit

Author: jrusso1020

.github/workflows/publish.yml

@@ -35,12 +35,26 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
-          # On manual dispatch, check out the existing tag so we publish the
-          # exact commit that was tagged — not whatever is currently on main.
+          # Pin every release to an immutable ref. In particular, a merged
+          # release PR event exposes main as github.ref, which may advance
+          # before this job starts; use the event's exact merge commit instead.
           ref: >-
-            ${{ github.event_name == 'workflow_dispatch'
+            ${{ github.event_name == 'pull_request'
+                && github.event.pull_request.merge_commit_sha
+                || github.event_name == 'workflow_dispatch'
                 && format('refs/tags/v{0}', inputs.version)
-                || github.ref }}
+                || github.sha }}
+
+      - name: Verify merged release checkout
+        if: github.event_name == 'pull_request'
+        env:
+          EXPECTED_MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
+        run: |
+          ACTUAL_SHA="$(git rev-parse HEAD)"
+          if [ "$ACTUAL_SHA" != "$EXPECTED_MERGE_SHA" ]; then
+            echo "::error::Expected merged release commit $EXPECTED_MERGE_SHA, checked out $ACTUAL_SHA"
+            exit 1
+          fi
 
       - name: Resolve version
         id: version

package.json

@@ -47,7 +47,7 @@
     "player:perf": "bun run --filter @hyperframes/player perf",
     "format:check": "oxfmt --check .",
     "knip": "knip",
-    "test:scripts": "node --import tsx --test scripts/check-tracked-artifacts.test.mjs scripts/check-workspace-contracts.test.mjs scripts/check-package-cycles.test.mjs scripts/check-cli-process-ownership.test.mjs scripts/package-subpaths.test.mjs scripts/validate-release-channel.test.mjs scripts/draft-changelog.test.ts scripts/set-version.test.ts scripts/release-prepare.test.ts scripts/cli-options.test.ts scripts/changelog-weekly.test.ts scripts/claude-plugin-compression.test.ts scripts/studio-runtime-smoke.test.mjs scripts/verify-packed-manifests.test.mjs scripts/lint-skills.test.mjs packages/gcp-cloud-run/check-dockerfile-workspaces.test.mjs",
+    "test:scripts": "node --import tsx --test scripts/check-tracked-artifacts.test.mjs scripts/check-workspace-contracts.test.mjs scripts/check-package-cycles.test.mjs scripts/check-cli-process-ownership.test.mjs scripts/package-subpaths.test.mjs scripts/validate-release-channel.test.mjs scripts/publish-workflow.test.mjs scripts/draft-changelog.test.ts scripts/set-version.test.ts scripts/release-prepare.test.ts scripts/cli-options.test.ts scripts/changelog-weekly.test.ts scripts/claude-plugin-compression.test.ts scripts/studio-runtime-smoke.test.mjs scripts/verify-packed-manifests.test.mjs scripts/lint-skills.test.mjs packages/gcp-cloud-run/check-dockerfile-workspaces.test.mjs",
     "test:skills": "node --test 'skills/**/*.test.mjs'",
     "generate:previews": "tsx scripts/generate-template-previews.ts",
     "generate:catalog-previews": "tsx scripts/generate-catalog-previews.ts",

scripts/publish-workflow.test.mjs

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+
+const workflow = readFileSync(new URL("../.github/workflows/publish.yml", import.meta.url), "utf8");
+
+test("merged release PRs publish the immutable merge commit", () => {
+  assert.match(
+    workflow,
+    /github\.event_name == 'pull_request'\s+&& github\.event\.pull_request\.merge_commit_sha/,
+  );
+  assert.match(workflow, /Verify merged release checkout/);
+  assert.match(
+    workflow,
+    /EXPECTED_MERGE_SHA: \$\{\{ github\.event\.pull_request\.merge_commit_sha \}\}/,
+  );
+  assert.match(workflow, /ACTUAL_SHA="\$\(git rev-parse HEAD\)"/);
+  assert.match(workflow, /\[ "\$ACTUAL_SHA" != "\$EXPECTED_MERGE_SHA" \]/);
+});
+
+test("tag pushes use the immutable event SHA", () => {
+  assert.match(
+    workflow,
+    /github\.event_name == 'workflow_dispatch'[\s\S]*format\('refs\/tags\/v\{0\}', inputs\.version\)[\s\S]*\|\| github\.sha/,
+  );
+  assert.doesNotMatch(workflow, /\|\| github\.ref/);
+});