Fix checkout-free publish repository context (#1796)

Author: hatayama

.github/workflows/dispatcher-publish.yml

@@ -134,6 +134,8 @@ jobs:
       id-token: write
       attestations: write
       artifact-metadata: write
+    env:
+      GH_REPO: ${{ github.repository }}
     steps:
       - name: Download packaged dispatcher assets
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093

.github/workflows/native-cli-publish.yml

@@ -144,6 +144,8 @@ jobs:
       id-token: write
       attestations: write
       artifact-metadata: write
+    env:
+      GH_REPO: ${{ github.repository }}
     steps:
       - name: Download packaged release assets
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093

scripts/test-dispatcher-publish-workflow.sh

@@ -122,6 +122,13 @@ test_publish_validates_metadata_without_checking_out_source() {
   fi
 }
 
+test_checkout_free_publish_has_explicit_repository_context() {
+  if ! publish_section | grep -F '    GH_REPO: ${{ github.repository }}' >/dev/null 2>&1; then
+    echo "Checkout-free publish job must define GH_REPO for gh release commands." >&2
+    exit 1
+  fi
+}
+
 test_dispatcher_assets_are_attested_after_the_manifest_is_verified() {
   assert_contains "      - name: Verify release asset manifest"
   assert_contains "      - name: Attest dispatcher release assets"
@@ -203,6 +210,7 @@ test_dispatcher_release_target_and_prerelease_state_remain_verified() {
 test_build_and_publish_jobs_have_separate_trust_boundaries
 test_unprivileged_build_uses_only_the_approved_event_commit
 test_publish_validates_metadata_without_checking_out_source
+test_checkout_free_publish_has_explicit_repository_context
 test_dispatcher_assets_are_attested_after_the_manifest_is_verified
 test_dispatcher_verifies_tagged_installers_after_draft_creation
 test_publish_rejects_manifest_and_existing_tag_mismatches

scripts/test-native-cli-publish-workflow.sh

@@ -122,6 +122,13 @@ test_publish_validates_metadata_without_checking_out_source() {
   fi
 }
 
+test_checkout_free_publish_has_explicit_repository_context() {
+  if ! publish_section | grep -F '    GH_REPO: ${{ github.repository }}' >/dev/null 2>&1; then
+    echo "Checkout-free publish job must define GH_REPO for gh release commands." >&2
+    exit 1
+  fi
+}
+
 test_assets_are_attested_after_the_manifest_is_verified() {
   assert_contains "      - name: Verify release asset manifest"
   assert_contains "      - name: Attest native CLI release assets"
@@ -192,6 +199,7 @@ test_post_publish_automation_remains_outside_the_privileged_job() {
 test_build_and_publish_jobs_have_separate_trust_boundaries
 test_unprivileged_build_uses_only_the_approved_event_commit
 test_publish_validates_metadata_without_checking_out_source
+test_checkout_free_publish_has_explicit_repository_context
 test_assets_are_attested_after_the_manifest_is_verified
 test_publish_rejects_manifest_and_existing_tag_mismatches
 test_draft_creation_accepts_only_the_known_missing_tag_responses