fix(release): validate recovery refs before publish

Author: szTheory

.github/workflows/release.yml

@@ -58,28 +58,23 @@ jobs:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
-  publish:
-    name: Publish to Hex
+  recovery-validation:
+    name: Validate Recovery Ref
+    if: ${{ github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
-    needs: release-please
-    if: ${{ github.event_name == 'workflow_dispatch' || needs.release-please.outputs.release_created == 'true' }}
-    environment: hex-publish
     permissions:
       contents: read
+    outputs:
+      checkout_ref: ${{ steps.validate.outputs.checkout_ref }}
     steps:
-      - name: Check out repository for the merged release commit
-        if: ${{ github.event_name != 'workflow_dispatch' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
       - name: Check out repository for recovery validation
-        if: ${{ github.event_name == 'workflow_dispatch' }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Validate recovery-only inputs and lock to an immutable ref
-        if: ${{ github.event_name == 'workflow_dispatch' }}
+        id: validate
         shell: bash
         run: |
           set -euo pipefail
@@ -89,16 +84,47 @@ jobs:
 
           if [[ "$recovery_ref" =~ ^[0-9a-f]{40}$ ]]; then
             git cat-file -e "${recovery_ref}^{commit}"
-            git checkout --detach "$recovery_ref"
+            echo "checkout_ref=$recovery_ref" >> "$GITHUB_OUTPUT"
           elif git show-ref --verify --quiet "refs/tags/$recovery_ref"; then
-            git checkout --detach "refs/tags/$recovery_ref"
+            echo "checkout_ref=$recovery_ref" >> "$GITHUB_OUTPUT"
           else
             echo "workflow_dispatch is recovery-only and recovery_ref must be an exact 40-character commit SHA or an existing tag."
             exit 1
           fi
 
           echo "workflow_dispatch is recovery-only. Recovery publishes the exact immutable ref selected in recovery_ref, and normal publish intent starts from a merged Release Please PR and the protected hex-publish environment."
 
+  publish:
+    name: Publish to Hex
+    runs-on: ubuntu-latest
+    needs:
+      - release-please
+      - recovery-validation
+    if: ${{ always() && ((github.event_name == 'workflow_dispatch' && needs.recovery-validation.result == 'success') || (github.event_name != 'workflow_dispatch' && needs.release-please.outputs.release_created == 'true')) }}
+    environment: hex-publish
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository for the merged release commit
+        if: ${{ github.event_name != 'workflow_dispatch' }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Check out repository for recovery validation
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          ref: ${{ needs.recovery-validation.outputs.checkout_ref }}
+
+      - name: Confirm recovery checkout is detached to the validated immutable ref
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git checkout --detach HEAD
+          echo "Recovered immutable ref: ${{ needs.recovery-validation.outputs.checkout_ref }}"
+
       - name: Set up Elixir and Erlang
         uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
         with:

test/lockspire/release_readiness_contract_test.exs

@@ -59,16 +59,20 @@ defmodule Lockspire.ReleaseReadinessContractTest do
     assert release_workflow =~ "steps.manual_dispatch.outputs.release_created"
     assert release_workflow =~ "echo \"release_created=false\" >> \"$GITHUB_OUTPUT\""
     assert release_workflow =~ "workflow_dispatch bypasses Release Please"
+    assert release_workflow =~ "recovery-validation:"
+    assert release_workflow =~ "name: Validate Recovery Ref"
     assert release_workflow =~ "Check out repository for recovery validation"
     assert release_workflow =~ "fetch-depth: 0"
     assert release_workflow =~ "fetch-tags: true"
     assert release_workflow =~ "Validate recovery-only inputs and lock to an immutable ref"
     assert release_workflow =~ "[[ \"$recovery_ref\" =~ ^[0-9a-f]{40}$ ]]"
     assert release_workflow =~ "git show-ref --verify --quiet \"refs/tags/$recovery_ref\""
-    assert release_workflow =~ "git checkout --detach \"$recovery_ref\""
-    assert release_workflow =~ "git checkout --detach \"refs/tags/$recovery_ref\""
+    assert release_workflow =~ "echo \"checkout_ref=$recovery_ref\" >> \"$GITHUB_OUTPUT\""
     assert release_workflow =~ "exact 40-character commit SHA or an existing tag"
     assert release_workflow =~ "workflow_dispatch is recovery-only"
+    assert release_workflow =~ "ref: ${{ needs.recovery-validation.outputs.checkout_ref }}"
+    assert release_workflow =~ "Confirm recovery checkout is detached to the validated immutable ref"
+    assert release_workflow =~ "git checkout --detach HEAD"
     assert release_workflow =~ "Release Please generated PRs are review-only"
     assert release_workflow =~ "id: release"
     assert release_workflow =~ "github.event_name == 'workflow_dispatch'"
@@ -86,8 +90,9 @@ defmodule Lockspire.ReleaseReadinessContractTest do
     assert release_workflow =~ "run: mix release.preflight"
     assert release_workflow =~ "run: mix hex.publish --yes"
 
-    assert release_workflow =~
-             "if: ${{ github.event_name == 'workflow_dispatch' || needs.release-please.outputs.release_created == 'true' }}"
+    assert release_workflow =~ "needs.recovery-validation.result == 'success'"
+    assert release_workflow =~ "needs.release-please.outputs.release_created == 'true'"
+    assert release_workflow =~ "always()"
 
     refute release_workflow =~ "pull_request:"
     refute release_workflow =~ "package-name: lockspire"