Pin release.yml checkout ref to refs/tags/<tag_name> on workflow_dispatch (#156)

When workflow_dispatch was invoked with a branch name (e.g. "main"),
actions/checkout would silently resolve it as a branch ref and later
steps that assume HEAD is a release tag (git describe --tags
--exact-match HEAD, gh release create --verify-tag, etc.) would fail
with confusing errors. Resolve inputs.tag_name via format('refs/tags/{0}',
inputs.tag_name) in both the release and nuget-publish jobs so a branch
name now fails the checkout step itself instead of reaching the
tag-assumed downstream logic.

https://claude.ai/code/session_01EynRk1KiNDypBTkzJgwfVT

Co-authored-by: Claude <noreply@anthropic.com>

Author: Widthdom

.github/workflows/release.yml

@@ -22,7 +22,13 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ inputs.tag_name || github.ref }}
+          # On workflow_dispatch, force refs/tags/<tag_name> so a branch name
+          # (e.g. "main") fails checkout instead of falling through to the
+          # tag-assumed downstream steps.
+          # workflow_dispatch では refs/tags/<tag_name> に固定し、"main" 等の
+          # ブランチ名が指定された場合にタグ前提の後続ステップへ進む前に
+          # checkout 段階で失敗させます。
+          ref: ${{ inputs.tag_name && format('refs/tags/{0}', inputs.tag_name) || github.ref }}
 
       - name: Set up .NET
         uses: actions/setup-dotnet@v4
@@ -149,7 +155,9 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ inputs.tag_name || github.ref }}
+          # See release job for rationale.
+          # release ジョブの注記を参照してください。
+          ref: ${{ inputs.tag_name && format('refs/tags/{0}', inputs.tag_name) || github.ref }}
 
       - name: Set up .NET
         uses: actions/setup-dotnet@v4

CHANGELOG.md

@@ -9,6 +9,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### [Unreleased]
 
+#### Fixed
+
+- **Release workflow `workflow_dispatch` now pins the checkout to `refs/tags/<tag_name>`** — Both the `release` and `nuget-publish` jobs in `.github/workflows/release.yml` now resolve the dispatch `tag_name` input via `format('refs/tags/{0}', inputs.tag_name)`. Supplying a branch name (for example `main`) now fails at the `actions/checkout` step instead of falling through into the tag-assumed downstream logic (`git describe --tags --exact-match HEAD`, `gh release create --verify-tag`, etc.) and producing confusing late-stage failures. Tag-push triggers still fall through to `github.ref` unchanged. Affected: `.github/workflows/release.yml`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`. Tests: `CiAutomationConfigurationTests.cs` (1 updated).
+
 ### [1.17.0] - 2026-04-17
 
 #### Changed
@@ -1440,6 +1444,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### [Unreleased]
 
+#### 修正
+
+- **リリースワークフローの `workflow_dispatch` は checkout を `refs/tags/<tag_name>` に固定** — `.github/workflows/release.yml` の `release` / `nuget-publish` ジョブは、dispatch 入力 `tag_name` を `format('refs/tags/{0}', inputs.tag_name)` で解決するようになりました。ブランチ名（例: `main`）が指定された場合は `actions/checkout` 段階で失敗するため、従来のようにタグ前提の後続処理（`git describe --tags --exact-match HEAD`、`gh release create --verify-tag` など）まで進んで混乱する失敗メッセージを出すことがなくなりました。タグ push 起点の実行はこれまで通り `github.ref` を利用します。対象: `.github/workflows/release.yml`、`FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`。テスト: `CiAutomationConfigurationTests.cs`（更新 1 件）。
+
 ### [1.17.0] - 2026-04-17
 
 #### 変更

FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs

@@ -91,6 +91,20 @@ public void ReleaseWorkflow_CreatesGitHubReleaseFromVersionTags()
                 workflow);
             Assert.Contains("CURRENT_TAG=$(git describe --tags --exact-match HEAD --match 'v*')", workflow, StringComparison.Ordinal);
             Assert.Contains("PREV_TAG=$(git describe --first-parent --tags --abbrev=0 HEAD^ --match 'v*' 2>/dev/null || true)", workflow, StringComparison.Ordinal);
+            // workflow_dispatch must resolve the tag input to refs/tags/<tag_name>
+            // so that branch names (e.g. "main") fail at checkout instead of
+            // falling through into tag-assumed downstream steps.
+            // workflow_dispatch では tag 入力を refs/tags/<tag_name> に解決し、
+            // "main" のようなブランチ名が指定された場合にタグ前提の後続ステップへ
+            // 進む前に checkout 段階で失敗させます。
+            Assert.Contains(
+                "ref: ${{ inputs.tag_name && format('refs/tags/{0}', inputs.tag_name) || github.ref }}",
+                workflow,
+                StringComparison.Ordinal);
+            Assert.DoesNotContain(
+                "ref: ${{ inputs.tag_name || github.ref }}",
+                workflow,
+                StringComparison.Ordinal);
             Assert.DoesNotContain("Check if Core exists on GitHub Packages", workflow, StringComparison.Ordinal);
             Assert.DoesNotContain("Check if Plugin.Abstractions exists on GitHub Packages", workflow, StringComparison.Ordinal);
             Assert.DoesNotContain("owner_path=\"users\"", workflow, StringComparison.Ordinal);