From 2d5439dce108b5307c854d068ef34be950bfa772 Mon Sep 17 00:00:00 2001
From: Krishnam Murarka <83580811+KRISHNAMMurarka@users.noreply.github.com>
Date: Mon, 24 Aug 2026 17:55:12 +0530
Subject: [PATCH] fix(release): prefer the requested tag over the dispatch ref

---
 .github/workflows/release.yml  |  2 ++
 scripts/verify-release.mjs     |  2 +-
 test/package-contract.test.mjs | 16 ++++++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9925593..63a350a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,6 +34,8 @@ jobs:
         with:
           node-version: 24.x
       - name: Validate tag, package version, and changelog
+        env:
+          GITHUB_REF_NAME: ${{ inputs.tag }}
         shell: bash
         run: |
           set -euo pipefail
diff --git a/scripts/verify-release.mjs b/scripts/verify-release.mjs
index bc632ee..42541f1 100644
--- a/scripts/verify-release.mjs
+++ b/scripts/verify-release.mjs
@@ -6,7 +6,7 @@ const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const packageJson = JSON.parse(await readFile(resolve(root, 'package.json'), 'utf8'))
 const changelog = await readFile(resolve(root, 'CHANGELOG.md'), 'utf8')
 const expectedTag = `v${packageJson.version}`
-const actualTag = process.env.GITHUB_REF_NAME ?? process.argv[2]
+const actualTag = process.argv[2] ?? process.env.GITHUB_REF_NAME
 
 if (!actualTag) {
   throw new Error('Provide a release tag as GITHUB_REF_NAME or the first argument.')
diff --git a/test/package-contract.test.mjs b/test/package-contract.test.mjs
index 75b3390..cc399bb 100644
--- a/test/package-contract.test.mjs
+++ b/test/package-contract.test.mjs
@@ -1,7 +1,12 @@
 import assert from 'node:assert/strict'
+import { execFile } from 'node:child_process'
 import { readFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { promisify } from 'node:util'
 import test from 'node:test'
 
+const execFileAsync = promisify(execFile)
+
 const packageJson = JSON.parse(
   await readFile(new URL('../package.json', import.meta.url), 'utf8'),
 )
@@ -20,3 +25,14 @@ test('keeps the runtime dependency-free and declares the tested Node floor', ()
   assert.equal(packageJson.optionalDependencies, undefined)
   assert.equal(packageJson.peerDependencies, undefined)
 })
+
+test('uses an explicit release tag instead of the workflow branch name', async () => {
+  const verifyScript = fileURLToPath(
+    new URL('../scripts/verify-release.mjs', import.meta.url),
+  )
+  const { stdout } = await execFileAsync(process.execPath, [verifyScript, 'v0.1.1'], {
+    env: { ...process.env, GITHUB_REF_NAME: 'main' },
+  })
+
+  assert.equal(stdout, 'Verified release metadata for v0.1.1.\n')
+})