selected_sha: ${{ steps.validate.outputs.selected_sha }}

trusted_reason: ${{ steps.validate.outputs.trusted_reason }}

steps:

- name: Checkout selected ref

- name: Checkout workflow repository

uses: actions/checkout@v6

with:

ref: ${{ inputs.ref }}

fetch-depth: 0

- name: Validate selected ref

shell: bash

run: |

set -euo pipefail

selected_sha="$(git rev-parse HEAD)"

trusted_reason=""

git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*'

git fetch --tags origin '+refs/tags/*:refs/tags/*'

# Resolve here instead of in actions/checkout so short SHAs work too.

if ! selected_sha="$(git rev-parse --verify "${INPUT_REF}^{commit}")"; then

echo "Ref '${INPUT_REF}' could not be resolved to a commit." >&2

exit 1

fi

if git merge-base --is-ancestor "$selected_sha" refs/remotes/origin/main; then

trusted_reason="main-ancestor"

elif git tag --points-at "$selected_sha" | grep -Eq '^v'; then

const workflow = readFileSync(LIVE_E2E_WORKFLOW_PATH, "utf8");

expect(workflow).toContain("git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*'");

expect(workflow).toContain('git rev-parse --verify "${INPUT_REF}^{commit}"');

expect(workflow).toContain("repository-branch-history");

expect(workflow).toContain("git tag --points-at \"$selected_sha\" | grep -Eq '^v'");

expect(workflow).toContain("reachable from an OpenClaw branch or release tag");