working-directory: source

env:

RELEASE_REF: ${{ inputs.ref }}

GITHUB_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

SELECTED_SHA="$(git rev-parse HEAD)"

git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*'

git fetch --tags origin '+refs/tags/*:refs/tags/*'

auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"

git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*'

git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch --tags origin '+refs/tags/*:refs/tags/*'

if git tag --points-at "${SELECTED_SHA}" | grep -Eq '^v'; then

exit 0

env:

SELECTED_SHA: ${{ steps.ref.outputs.sha }}

WORKFLOW_REF: ${{ github.ref }}

GITHUB_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

if [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then

echo "Tideclaw alpha release checks must run from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2

exit 1

fi

alpha_branch="${WORKFLOW_REF#refs/heads/}"

git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"

auth_header="$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"

git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"

if ! git merge-base --is-ancestor "${SELECTED_SHA}" "refs/remotes/origin/${alpha_branch}"; then

echo "Alpha release target ${SELECTED_SHA} must be reachable from ${alpha_branch}." >&2

exit 1