fix: require refreshed release candidate

Author: tensornull

.github/workflows/release-please.yml

@@ -658,6 +658,11 @@ jobs:
             "+refs/heads/${RELEASE_BRANCH}:refs/remotes/origin/${RELEASE_BRANCH}"
           release_ref="refs/remotes/origin/${RELEASE_BRANCH}"
           branch_sha="$(git rev-parse "$release_ref")"
+          branch_parent="$(git rev-parse "${release_ref}^")"
+          if [[ "$branch_parent" != "$GITHUB_SHA" ]]; then
+            echo "The prepared Release Please branch is not based directly on current main." >&2
+            exit 1
+          fi
           gh api --paginate --slurp \
             "repos/${GITHUB_REPOSITORY}/pulls?state=open&base=main&per_page=100" \
             | jq 'add' > "$pull_requests_file"

README.md

@@ -58,9 +58,9 @@ For source-checkout testing, retain and verify one exact tarball:
 ```bash
 mkdir -p .artifacts
 npm pack --pack-destination .artifacts
-npm run test:package -- --tarball .artifacts/cometapi-0.1.1.tgz
-npm run test:examples -- --tarball .artifacts/cometapi-0.1.1.tgz
-npm run test:fixtures -- --tarball .artifacts/cometapi-0.1.1.tgz
+npm run test:package -- --tarball .artifacts/cometapi-$(node -p 'require("./package.json").version').tgz
+npm run test:examples -- --tarball .artifacts/cometapi-$(node -p 'require("./package.json").version').tgz
+npm run test:fixtures -- --tarball .artifacts/cometapi-$(node -p 'require("./package.json").version').tgz
 ```
 
 Install that path in a separate consumer when needed. Do not treat a locally

RELEASING.md

@@ -526,13 +526,12 @@ mutate the release branch during that window. The workflow repeats those checks
 after the action and stops publication on any drift, but it cannot delete or
 replace an immutable Release created during an external race.
 
-The stale branch
-`release-please--branches--main--components--cometapi` at
-`3f0949e5c0ccd0923d10595437f7a315f013af7c` is the failed run's evidence, not a
-release candidate. Immediately before replacing or deleting it, confirm that
-it still contains the documented generated 0.2.0 state, has no associated open
-PR, and contains no independent work. Do not delete or rewrite any other
-branch.
+The stale branch at `3f0949e5c0ccd0923d10595437f7a315f013af7c` was revalidated
+as the failed run's generated 0.2.0 evidence, with no associated open PR or
+independent work, then deleted. Release Please recreated the canonical
+`release-please--branches--main--components--cometapi` branch for the
+action-owned 0.1.1 PR. Do not use that branch as a 0.2 starting point or delete
+or rewrite any other branch.
 
 For 0.1.1, `always-bump-patch` keeps every releasable Conventional Commit on the
 0.1.x maintenance line; changing that strategy requires a separately authorized
@@ -651,11 +650,9 @@ layers:
   `3f0949e5c0ccd0923d10595437f7a315f013af7c`, a generated `0.2.0` draft, but
   before creating a pull request. It did not modify `main`, create a tag, or
   publish a package. `RELEASE_PLEASE_ENABLED` was set to `false` before the
-  closeout push; the branch is retained as failure evidence and must not be
-  merged or treated as the start of 0.2. Release Please remains disabled until
-  the authorized 0.1.1 repair is merged, the stale branch is revalidated and
-  removed, and the normal action-created PR path is ready for one first-attempt
-  preparation run.
+  closeout push. During the authorized 0.1.1 repair, the branch was revalidated
+  as failure-only evidence with no associated PR or independent work, deleted,
+  and then recreated by Release Please for the normal action-owned 0.1.1 PR.
 
 ## Verification record
 

ROADMAP.md

@@ -128,10 +128,11 @@ attempt, and exact Release state; manual preparation remains attempt-1-only.
 The Release notes must equal the reviewed `CHANGELOG` entry. The post-merge run
 also requires an administrator's approval on the release PR's final head.
 
-The exact stale branch remains failure evidence until its contents, lack of an
-open PR, and lack of independent work are reconfirmed immediately before
-cleanup. It must never be merged or treated as the start of 0.2. Repository
-foundation may become Complete only after the real 0.1.1 release flow, public
+The exact stale 0.2 branch was revalidated as failure-only evidence with no
+associated PR or independent work, then deleted. Release Please recreated the
+canonical branch for the action-owned 0.1.1 PR; it must never be treated as the
+start of 0.2. Repository foundation may become Complete only after the real
+0.1.1 release flow, public
 registry installation, and a separate post-release documentation PR recording
 ROADMAP and RELEASING evidence succeed. Until then,
 `RELEASE_PLEASE_ENABLED` remains a temporary release-operation control,

tests/workflow-contract.test.mjs

@@ -243,6 +243,12 @@ describe("GitHub Actions workflow contract", () => {
       "release-please-result-${{ github.run_id }}-${{ github.run_attempt }}",
     );
     expect(releasePlease).toContain("validateReleasePleaseActionResult");
+    expect(releasePlease).toContain(
+      'branch_parent="$(git rev-parse "${release_ref}^")"',
+    );
+    expect(releasePlease).toContain(
+      'if [[ "$branch_parent" != "$GITHUB_SHA" ]]',
+    );
     expect(releasePlease).toContain("schemaVersion: 2");
     expect(releasePlease).toContain("actionOutcome");
     expect(releasePlease).toContain("recovered");