From 17b22066ef5bf9b29116cff87ace4f033b0376bb Mon Sep 17 00:00:00 2001
From: Jakob Heuser <jakob@codedrift.com>
Date: Fri, 21 Aug 2026 10:08:12 -0700
Subject: [PATCH] fix(ci): pin the breadcrumb job's checkout to the validated
 commit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#133 and #132 crossed. The nightly moved to `workflow_run` in #132, where
every checkout must carry `ref: github.event.workflow_run.head_sha`; the
`breadcrumb` job added by #133 was written against the `push` trigger and
merged without it.

Under `workflow_run` that is not an error. `github.sha` is the default branch
tip at event time, so the job checks out whatever `main` had moved to and
succeeds — running a copy of nightly-breadcrumb.cjs that Validate never saw,
while announcing a nightly built from a different commit. An empty `ref:`
fails the same way, silently, which is why the other two jobs assert HEAD
rather than trusting the checkout.

Cosmetic output does not lower the bar: it is the same fail-open shape, and
it reads as a normal green run. The job now pins the ref and asserts HEAD
against it, matching gate and publish line for line.

Nothing else moves. `breadcrumb` still reaches gate 0 transitively — a skipped
`gate` skips `publish`, which skips this — so it restates none of those four
conditions, and it consumes the publish job's stamped version rather than
re-deriving a short sha.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jwc9FFroR3mTZ4hLiSkkX3
---
 .github/workflows/release-cli-nightly.yml | 26 +++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/.github/workflows/release-cli-nightly.yml b/.github/workflows/release-cli-nightly.yml
index 3968fe5..f1c3a46 100644
--- a/.github/workflows/release-cli-nightly.yml
+++ b/.github/workflows/release-cli-nightly.yml
@@ -624,9 +624,35 @@ jobs:
       contents: read # checkout only — the script lives in this repo
       pull-requests: write # the one capability this job exists to use
     steps:
+      # `ref:` is MANDATORY under workflow_run here too, for the same reason it
+      # is on the other two jobs: without it checkout takes `github.sha`, the
+      # default branch tip at event time, and this job would run a COPY OF THE
+      # SCRIPT that is not the one Validate passed on — while announcing a
+      # nightly built from a different commit. Cosmetic output does not lower
+      # the bar; it is the same fail-open, and it reads as a normal run.
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
+          ref: ${{ github.event.workflow_run.head_sha }}
           persist-credentials: false # gh authenticates with GITHUB_TOKEN below
+      - name: Confirm the checkout is the commit Validate passed on
+        env:
+          VALIDATED_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          set -euo pipefail
+
+          # An empty `ref:` is not an error to actions/checkout — it falls back
+          # to the default branch and succeeds. Absent must not read as fine.
+          if [ -z "$VALIDATED_SHA" ]; then
+            echo "::error::The workflow_run payload carried no head_sha; refusing to annotate from an unidentified commit."
+            exit 1
+          fi
+
+          actual=$(git rev-parse HEAD)
+          if [ "$actual" != "$VALIDATED_SHA" ]; then
+            echo "::error::Checked out ${actual} but Validate passed on ${VALIDATED_SHA}; refusing to annotate with a script from an unvalidated commit."
+            exit 1
+          fi
+          echo "Annotating from ${actual}, which Validate passed on."
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24