[codex] Bind release publishers to immutable tags (BUZZ-SEC-039) (#1914)

scripts/test-release-ref-contract.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+verify="${repo_root}/scripts/verify-release-ref.sh"
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+git -C "$tmp" init -q
+git -C "$tmp" config user.name test
+git -C "$tmp" config user.email test@example.com
+echo first >"$tmp/file"
+git -C "$tmp" add file
+git -C "$tmp" commit -qm first
+git -C "$tmp" tag v1.2.3
+
+(
+  cd "$tmp"
+  GITHUB_REF=refs/tags/v1.2.3 "$verify" v 1.2.3
+)
+
+if (
+  cd "$tmp"
+  GITHUB_REF=refs/heads/main "$verify" v 1.2.3
+); then
+  echo "branch-backed desktop release was accepted" >&2
+  exit 1
+fi
+
+echo second >>"$tmp/file"
+git -C "$tmp" commit -qam second
+if (
+  cd "$tmp"
+  GITHUB_REF=refs/tags/v1.2.3 "$verify" v 1.2.3
+); then
+  echo "release accepted HEAD after the tag commit" >&2
+  exit 1
+fi
+
+git -C "$tmp" tag relay-v2.0.0
+(
+  cd "$tmp"
+  GITHUB_REF=refs/tags/relay-v2.0.0 "$verify" relay-v 2.0.0
+)
+
+if grep -q 'inputs\.ref' \
+  "$repo_root/.github/workflows/release.yml" \
+  "$repo_root/.github/workflows/docker.yml"; then
+  echo "publisher workflow still accepts a caller-selected source ref" >&2
+  exit 1
+fi
+
+grep -q 'verify-release-ref\.sh' "$repo_root/.github/workflows/release.yml"
+grep -q 'verify-release-ref\.sh' "$repo_root/.github/workflows/docker.yml"
+grep -q 'test-release-ref-contract\.sh' "$repo_root/.github/workflows/ci.yml"
+grep -Fq -- "--ref \"\$TAG\"" \
+  "$repo_root/.github/workflows/auto-tag-on-release-pr-merge.yml"
+
+echo "release ref contract passed"

scripts/verify-release-ref.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: $0 <tag-prefix> <version>" >&2
+  exit 2
+fi
+
+tag_prefix=$1
+version=$2
+
+if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+  echo "::error::Invalid release version '$version'" >&2
+  exit 1
+fi
+
+tag="${tag_prefix}${version}"
+expected_ref="refs/tags/${tag}"
+if [ "${GITHUB_REF:-}" != "$expected_ref" ]; then
+  echo "::error::Release must run at ${expected_ref}; got ${GITHUB_REF:-<unset>}" >&2
+  exit 1
+fi
+
+head_sha=$(git rev-parse 'HEAD^{commit}')
+if ! tag_sha=$(git rev-parse "refs/tags/${tag}^{commit}" 2>/dev/null); then
+  echo "::error::Release tag '${tag}' is missing from the checkout" >&2
+  exit 1
+fi
+
+if [ "$head_sha" != "$tag_sha" ]; then
+  echo "::error::HEAD ${head_sha} does not match ${tag} commit ${tag_sha}" >&2
+  exit 1
+fi
+
+echo "Verified ${expected_ref} at ${head_sha}"