From b354e40d37df66b921437c12ea9541318afd4927 Mon Sep 17 00:00:00 2001
From: PerishCode <perishcode@gmail.com>
Date: Tue, 18 Aug 2026 16:31:03 +0800
Subject: [PATCH] fix(release): bind hot stage to reserved commit

---
 .github/actions/release/exact/stage/action.yml | 4 ++++
 .github/workflows/release-beta.yml             | 2 ++
 e2e/tests/packaged-smoke-workflow.test.ts      | 2 ++
 3 files changed, 8 insertions(+)

diff --git a/.github/actions/release/exact/stage/action.yml b/.github/actions/release/exact/stage/action.yml
index bbc5e7321f..db51974d03 100644
--- a/.github/actions/release/exact/stage/action.yml
+++ b/.github/actions/release/exact/stage/action.yml
@@ -2,6 +2,8 @@ name: Stage exact release metadata
 description: Merge one Closure graph, publish immutable metadata, and stage its run-scoped acceptance feed
 
 inputs:
+  commit:
+    required: true
   exact-name:
     required: true
   release-version:
@@ -43,6 +45,8 @@ runs:
     - name: Distribute staged exact metadata
       id: distribute
       uses: ./.github/actions/release/publish-metadata
+      env:
+        RELEASE_COMMIT: ${{ inputs.commit }}
       with:
         enable_mac_arm64: true
         enable_mac_x64: true
diff --git a/.github/workflows/release-beta.yml b/.github/workflows/release-beta.yml
index a1a0aeb3a9..cd6cb0e975 100644
--- a/.github/workflows/release-beta.yml
+++ b/.github/workflows/release-beta.yml
@@ -574,6 +574,7 @@ jobs:
           RELEASE_VERSION_LOCK_REQUIRED: "true"
           STATE_SOURCE: ${{ steps.reservation.outputs.state_source || steps.exact.outputs.state_source }}
         with:
+          commit: ${{ env.BUILT_SHA }}
           exact-name: ${{ inputs.exact_name }}
           release-version: ${{ steps.reservation.outputs.release_version || steps.exact.outputs.release_version }}
 
@@ -946,6 +947,7 @@ jobs:
         id: staged
         uses: ./.github/actions/release/exact/stage
         with:
+          commit: ${{ needs.metadata.outputs.commit }}
           exact-name: ${{ inputs.exact_name }}
           release-version: ${{ needs.metadata.outputs.release_version }}
         env:
diff --git a/e2e/tests/packaged-smoke-workflow.test.ts b/e2e/tests/packaged-smoke-workflow.test.ts
index 4bc8a4fc8e..b6c4dd0b0b 100644
--- a/e2e/tests/packaged-smoke-workflow.test.ts
+++ b/e2e/tests/packaged-smoke-workflow.test.ts
@@ -3000,6 +3000,8 @@ process.stdin.on("end", () => {
     expect(workflow).toContain("needs.metadata.outputs.hot_staged != 'true'");
     expect(workflow).toContain("needs.metadata.outputs.hot_activated != 'true'");
     expect(workflow.match(/uses: \.\/\.github\/actions\/release\/exact\/stage/gu)).toHaveLength(2);
+    expect(workflow).toContain("commit: ${{ env.BUILT_SHA }}\n          exact-name: ${{ inputs.exact_name }}");
+    expect(workflow).toContain("commit: ${{ needs.metadata.outputs.commit }}\n          exact-name: ${{ inputs.exact_name }}");
     expect(workflow).toContain("uses: ./.github/actions/release/public-acceptance/plan");
     expect(workflow).toContain("uses: ./.github/actions/release/public-acceptance/activate");
     expect(acceptanceWorkflow).toContain("uses: ./.github/actions/release/public-acceptance/plan");