ref: ${{ inputs.tag }}

fetch-depth: 0

- name: Validate Tideclaw alpha preflight target

if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')

env:

RELEASE_REF: ${{ inputs.tag }}

WORKFLOW_REF: ${{ github.ref }}

run: |

set -euo pipefail

if [[ ! "${RELEASE_REF}" == *"-alpha."* && ! "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then

echo "Tideclaw alpha preflight runs must target an alpha prerelease tag or SHA." >&2

exit 1

fi

if [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then

echo "Tideclaw alpha preflight runs must run from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2

exit 1

fi

alpha_branch="${WORKFLOW_REF#refs/heads/}"

git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"

if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/${alpha_branch}"; then

echo "Alpha preflight target must be reachable from ${alpha_branch}." >&2

exit 1

fi

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with:

permissions:

contents: read

steps:

- name: Require main or release workflow ref for publish

- name: Require trusted workflow ref for publish

env:

RELEASE_TAG: ${{ inputs.tag }}

RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}

WORKFLOW_REF: ${{ github.ref }}

run: |

set -euo pipefail

if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]]; then

echo "Real publish runs must be dispatched from main or release/YYYY.M.D. Use preflight_only=true for other branch validation."

tideclaw_alpha_publish=false

if [[ "${RELEASE_TAG}" == *"-alpha."* && "${RELEASE_NPM_DIST_TAG}" == "alpha" && "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then

tideclaw_alpha_publish=true

fi

if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]] && [[ "${tideclaw_alpha_publish}" != "true" ]]; then

echo "Real publish runs must be dispatched from main, release/YYYY.M.D, or a Tideclaw alpha branch for alpha prereleases. Use preflight_only=true for other branch validation."

exit 1

fi

ref: refs/tags/${{ inputs.tag }}

fetch-depth: 0

- name: Validate Tideclaw alpha publish target

if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')

env:

RELEASE_TAG: ${{ inputs.tag }}

WORKFLOW_REF: ${{ github.ref }}

run: |

set -euo pipefail

if [[ ! "${RELEASE_TAG}" == *"-alpha."* ]]; then

echo "Tideclaw alpha publish runs must target an alpha prerelease tag." >&2

exit 1

fi

if [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then

echo "Tideclaw alpha publish runs must run from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2

exit 1

fi

alpha_branch="${WORKFLOW_REF#refs/heads/}"

git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"

if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/${alpha_branch}"; then

echo "Alpha publish tag must be reachable from ${alpha_branch}." >&2

exit 1

fi

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with: