fix(ci): stabilize manual dispatch checkout

vincentkoc · vincentkoc · commit 53bd4dde6c00 · 2026-07-05T10:22:26.000+02:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -126,6 +126,7 @@ jobs:
         env:
           CHECKOUT_REPO: ${{ github.repository }}
           CHECKOUT_REF: ${{ inputs.target_ref || github.sha }}
+          CHECKOUT_EVENT_REF: ${{ github.ref }}
           CHECKOUT_FALLBACK_REF: ${{ github.sha }}
           GITHUB_EVENT_NAME: ${{ github.event_name }}
         run: |
@@ -152,12 +153,29 @@ jobs:
               sleep 5
             done
           }
-          if fetch_checkout_ref "$CHECKOUT_REF"; then
+
+          # Manual release-gate runs commonly validate the workflow ref's exact SHA.
+          # Fetch the branch/tag ref first so GitHub does not have to negotiate an
+          # arbitrary SHA fetch, then verify the resolved commit stayed pinned.
+          checkout_ref="$CHECKOUT_REF"
+          requested_sha=""
+          if [[ "$CHECKOUT_REF" =~ ^[0-9a-f]{40}$ ]]; then
+            requested_sha="$CHECKOUT_REF"
+            if [[
+              "$GITHUB_EVENT_NAME" == "workflow_dispatch" &&
+              "$CHECKOUT_REF" == "$CHECKOUT_FALLBACK_REF" &&
+              -n "$CHECKOUT_EVENT_REF"
+            ]]; then
+              checkout_ref="$CHECKOUT_EVENT_REF"
+            fi
+          fi
+
+          if fetch_checkout_ref "$checkout_ref"; then
             :
           else
             fetch_status="$?"
             if [ "$fetch_status" = "124" ] || [ "$fetch_status" = "137" ]; then
-              echo "::error::checkout fetch for '$CHECKOUT_REF' timed out"
+              echo "::error::checkout fetch for '$checkout_ref' timed out"
               exit "$fetch_status"
             fi
             if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ] || [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then
@@ -166,6 +184,15 @@ jobs:
             echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"
             fetch_checkout_ref "$CHECKOUT_FALLBACK_REF"
           fi
+
+          if [ -n "$requested_sha" ]; then
+            resolved_sha="$(git -C "$GITHUB_WORKSPACE" rev-parse refs/remotes/origin/checkout)"
+            if [ "$resolved_sha" != "$requested_sha" ]; then
+              echo "::error::checkout ref '$checkout_ref' resolved to '$resolved_sha'," \
+                "expected '$requested_sha'" >&2
+              exit 1
+            fi
+          fi
           git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
 
       - name: Resolve checkout SHA
diff --git a/docs/.generated/plugin-sdk-api-baseline.sha256 b/docs/.generated/plugin-sdk-api-baseline.sha256
@@ -1,2 +1,2 @@
-fcf5285d9e7be94565a3470a17aaa1291afb779538f95dd98203d4adb0350602  plugin-sdk-api-baseline.json
-c7ae91b7f7dd0f5ecb253a6a08484d81871a433b7cae96214e6ef8fe76fbe51c  plugin-sdk-api-baseline.jsonl
+8928bb6ffc8ab7149502410bea3634ad737a574a490e43accced6ce5fe586c0c  plugin-sdk-api-baseline.json
+5573bf9f5f3d6802a673c2406e2298de06f14128efb2dcdb779fa430b3abe602  plugin-sdk-api-baseline.jsonl
