fix: bind publication to one current-main attempt

Author: tensornull

.github/workflows/publish.yml

@@ -145,8 +145,8 @@ jobs:
             exit 1
           fi
           git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
-          if ! git merge-base --is-ancestor "$WORKFLOW_SHA" refs/remotes/origin/main; then
-            echo "The release commit is no longer an ancestor of origin/main." >&2
+          if [[ "$(git rev-parse refs/remotes/origin/main)" != "$WORKFLOW_SHA" ]]; then
+            echo "The release commit is no longer the exact origin/main tip." >&2
             exit 1
           fi
 
@@ -244,7 +244,7 @@ jobs:
         run: |
           set -euo pipefail
           git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
-          if ! git merge-base --is-ancestor "$RELEASE_COMMIT" refs/remotes/origin/main; then
+          if [[ "$(git rev-parse refs/remotes/origin/main)" != "$RELEASE_COMMIT" ]]; then
             echo "origin/main moved away from the release commit before handoff." >&2
             exit 1
           fi
@@ -389,8 +389,8 @@ jobs:
               git diff --name-only "$CONTROL_FIRST_PARENT" "$CONTROL_COMMIT" > "$CHANGED_FILES"
               ;;
             release)
-              if ! git merge-base --is-ancestor "$RELEASE_COMMIT" refs/remotes/origin/main; then
-                echo "The tag release commit is not an ancestor of origin/main." >&2
+              if [[ "$MAIN_COMMIT" != "$RELEASE_COMMIT" ]]; then
+                echo "The tag release commit is no longer the exact origin/main tip." >&2
                 exit 1
               fi
               CONTROL_FIRST_PARENT=""
@@ -576,8 +576,8 @@ jobs:
               fi
               ;;
             release)
-              if ! git merge-base --is-ancestor "$WORKFLOW_SHA" refs/remotes/origin/main; then
-                echo "The release commit is not an ancestor of origin/main." >&2
+              if [[ "$(git rev-parse refs/remotes/origin/main)" != "$WORKFLOW_SHA" ]]; then
+                echo "The release commit is no longer the exact origin/main tip." >&2
                 exit 1
               fi
               ;;
@@ -925,8 +925,8 @@ jobs:
                 echo "The tag publication identity changed while awaiting approval." >&2
                 exit 1
               fi
-              if ! git merge-base --is-ancestor "$RELEASE_COMMIT" refs/remotes/origin/main; then
-                echo "The release commit is no longer an ancestor of origin/main." >&2
+              if [[ "$main_commit" != "$RELEASE_COMMIT" ]]; then
+                echo "The release commit is no longer the exact origin/main tip." >&2
                 exit 1
               fi
               ;;

RELEASING.md

@@ -280,16 +280,18 @@ The repository maintains four independently auditable workflows:
   job. That job has no Environment and no OIDC permission. It validates the
   exact source job and treats a preparation run whose result-upload step was
   skipped as release-inert. For a release run, it requires the unique
-  attempt-qualified result, immutable bot-authored Release, tag commit, `main`
-  ancestry, and the dispatch contract stored in the tag, then uses its sole
+  attempt-qualified result, immutable bot-authored Release, tag commit, exact
+  current `main` identity, and the dispatch contract stored in the tag, then
+  uses its sole
   `actions: write` permission to dispatch the same workflow with `ref=v<version>`.
   The `verify`, `live-smoke`, and `publish` jobs accept only
   that tag-bound `workflow_dispatch`; they are unreachable from the original
   main-context `workflow_run`. A successful manual Release Please preparation
   run is release-inert and cannot enter the handoff.
 
   The tag run independently revalidates the source run and result artifact,
-  exact tag and immutable Release, package metadata, and `main` ancestry. The
+  exact tag and immutable Release, package metadata, and exact current `main`
+  identity. The
   normal operation packs and tests one attempt-qualified artifact, runs a fresh
   bounded live smoke, and sends that same file to npm OIDC; the one-time
   recovery operation downloads and retests the already live-verified tarball
@@ -573,6 +575,8 @@ The repository maintains four independently auditable workflows:
   immediately before registry mutation and fails if a run was created, rerun, or
   remains active while the recovery was waiting. This makes the operator freeze
   observable rather than relying only on timing.
+  The one-time recovery accepts only the first workflow attempt; a rerun or a
+  second dispatch is forbidden even when all other inputs match.
 
   If the npm publish request may have reached the registry but its response or
   the remaining workflow result was lost, do not infer success or a safe retry

scripts/release-workflow-validation.mjs

@@ -1158,7 +1158,7 @@ export function validatePublishWorkflowDispatchRecoveryTrigger({
     PUBLISH_RECOVERY.dispatchTask,
     "publish recovery operation",
   );
-  requirePositiveInteger(workflowRunAttempt, "publish recovery run attempt");
+  requireEqual(workflowRunAttempt, 1, "publish recovery run attempt");
   requirePositiveInteger(recoveryPolicyId, "publish recovery policy ID");
   if (!Array.isArray(changedFiles)) {
     fail("Release workflow publish recovery changed files must be an array.");

tests/release-workflow-validation.test.mjs

@@ -371,6 +371,7 @@ describe("Publish workflow dispatch recovery trigger", () => {
     ["source commit", { sourceReleaseCommit: RELEASE_SHA }],
     ["source run ID", { sourceRunId: 30469181725 }],
     ["source attempt", { sourceRunAttempt: 2 }],
+    ["workflow rerun", { workflowRunAttempt: 2 }],
     ["missing file", { changedFiles: recoveryFiles.slice(1) }],
     ["extra file", { changedFiles: [...recoveryFiles, "package.json"] }],
   ])("rejects recovery trigger drift in %s", (_name, overrides) => {
@@ -380,14 +381,6 @@ describe("Publish workflow dispatch recovery trigger", () => {
       ),
     ).toThrow(/release workflow/i);
   });
-
-  it("accepts a rerun of the same immutable recovery event", () => {
-    expect(
-      validatePublishWorkflowDispatchRecoveryTrigger(
-        recoveryTrigger({ workflowRunAttempt: 2 }),
-      ),
-    ).toMatchObject({ releaseRunId: 30469181724 });
-  });
 });
 
 describe("Publish tag dispatch trigger", () => {

tests/workflow-contract.test.mjs

@@ -455,6 +455,12 @@ describe("GitHub Actions workflow contract", () => {
     expect(handoff).toContain('-f ref="$RELEASE_TAG"');
     expect(handoff).toContain('-f "inputs[publish_operation]=release"');
     expect(handoff).toContain('-f "inputs[control_commit]=$RELEASE_COMMIT"');
+    expect(handoff).toContain(
+      '$(git rev-parse refs/remotes/origin/main)" != "$RELEASE_COMMIT',
+    );
+    expect(handoff).not.toContain(
+      'git merge-base --is-ancestor "$RELEASE_COMMIT" refs/remotes/origin/main',
+    );
 
     const verify = job(publish, "verify");
     expect(verify).toContain("github.event_name == 'workflow_dispatch'");
@@ -494,6 +500,10 @@ describe("GitHub Actions workflow contract", () => {
     );
     expect(verify).toContain("if: inputs.publish_operation == 'release'");
     expect(verify).toContain("Select the exact release artifact");
+    expect(verify).toContain('if [[ "$MAIN_COMMIT" != "$RELEASE_COMMIT" ]]');
+    expect(verify).toContain(
+      'if [[ "$(git rev-parse refs/remotes/origin/main)" != "$WORKFLOW_SHA" ]]',
+    );
     expect(verify).toContain("github.triggering_actor");
     expect(releaseWorkflowValidation).toContain("30471665743");
     expect(releaseWorkflowValidation).toContain("8731956162");
@@ -593,6 +603,9 @@ describe("GitHub Actions workflow contract", () => {
     expect(publishJob).toContain(
       "RECOVERY_POLICY_ID: ${{ inputs.recovery_policy_id }}",
     );
+    expect(publishJob).toContain(
+      'if [[ "$main_commit" != "$RELEASE_COMMIT" ]]',
+    );
     expect(publishJob).toContain("GH_TOKEN: ${{ github.token }}");
     expect(publishJob).toContain("status=${state}");
     expect(publishJob).toContain("client.chat.completions.create");