bind releases to the triggering commit

Author: Fei-Away

.github/workflows/release.yml

@@ -35,7 +35,9 @@ jobs:
       - name: Check out source
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
-          ref: main
+          # Bind every release attempt to the commit that triggered it. A
+          # moving main checkout could otherwise package a later push.
+          ref: ${{ github.sha }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -53,7 +55,7 @@ jobs:
           BEFORE_SHA: ${{ github.event.before }}
         run: |
           set -euo pipefail
-          main_sha="$(git rev-parse origin/main)"
+          event_sha="$(git rev-parse HEAD)"
           version="$(tr -d '[:space:]' < macos/VERSION)"
           windows_version="$(tr -d '[:space:]' < windows/VERSION)"
           package_version="$(node -p "JSON.parse(require('fs').readFileSync('macos/package.json', 'utf8')).version")"
@@ -74,7 +76,7 @@ jobs:
           fi
 
           tag="v$version"
-          release_sha="$main_sha"
+          release_sha="$event_sha"
           should_release="true"
           version_unchanged="false"
           if [[ "$EVENT_NAME" == "push" ]]; then

TASK_PROGRESS.md

@@ -5,11 +5,12 @@
 - [base] Feature PR #324 was squash-merged to `main` at
   `a58e63c6909082706c02824622d0e902b3539065`; its exact-head CI run
   `30638018730` passed all four jobs.
-- [scope] Branch `codex/release-v1.5.10` changes only the six required version
-  sources, version-bound assertions, dual-platform changelogs, and this durable
-  release record. Public v1.5.9 is the predecessor; v1.5.10 does not yet exist.
+- [scope] Branch `codex/release-v1.5.10` changes the six required version
+  sources, version-bound assertions, dual-platform changelogs, the exact-event
+  Release binding and its regression, plus this durable release record. Public
+  v1.5.9 is the predecessor; v1.5.10 does not yet exist.
 - [verified locally] All six release version sources are exactly `1.5.10`.
-  Portable macOS/Windows Node regressions pass 81/81, and the complete
+  Portable macOS/Windows Node regressions pass 82/82, and the complete
   applicable macOS suite exits 0 with only its documented full-Xcode native
   XCTest and installed signed-Codex Doctor branches skipped. Runtime asset
   sync, all Node/Bash syntax, both payload checks, PowerShell 5.1 BOM and
@@ -20,6 +21,11 @@
 - [pushed/PR open] Branch `codex/release-v1.5.10` is on `origin`; release PR
   #332 targets `main` at
   `https://github.com/Fei-Away/Codex-Dream-Skin/pull/332`.
+- [fixed before merge] Independent release review found the guard checked out
+  moving `main`, so a later push could retarget v1.5.10 before packaging. The
+  guard now checks out `${{ github.sha }}`, derives the release candidate from
+  that exact `HEAD`, and has a portable regression rejecting moving-main
+  release binding.
 - [pending] Require all PR CI jobs on the final head, merge #332 to `main`,
   then verify the sole Release workflow creates tag v1.5.10 and publishes
   non-empty DMG, Setup.exe, and SHA256SUMS.txt from the exact merge.

macos/tests/release-workflow.test.mjs

@@ -0,0 +1,32 @@
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const workflowPath = path.resolve(here, "../../.github/workflows/release.yml");
+const workflow = await fs.readFile(workflowPath, "utf8");
+
+assert.match(
+  workflow,
+  /^\s+ref: \$\{\{ github\.sha \}\}\s*$/m,
+  "The release guard must check out the immutable event commit.",
+);
+assert.doesNotMatch(
+  workflow,
+  /^\s+ref: main\s*$/m,
+  "The release guard must not check out moving main.",
+);
+assert.match(
+  workflow,
+  /^\s+event_sha="\$\(git rev-parse HEAD\)"\s*$/m,
+  "The release candidate must derive from the checked-out event commit.",
+);
+assert.match(workflow, /^\s+release_sha="\$event_sha"\s*$/m);
+assert.doesNotMatch(
+  workflow,
+  /main_sha="\$\(git rev-parse origin\/main\)"/,
+  "The release candidate must not be rebound to a later origin/main tip.",
+);
+
+console.log("PASS: Release workflow binds assets and tag to the exact event commit.");