Fix workflow-dispatch release tag verification

.github/workflows/release.yml

@@ -34,6 +34,8 @@ jobs:
         with:
           node-version: 24.x
       - name: Validate tag, package version, and changelog
+        env:
+          GITHUB_REF_NAME: ${{ inputs.tag }}
         shell: bash
         run: |
           set -euo pipefail

scripts/verify-release.mjs

@@ -6,7 +6,7 @@ const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const packageJson = JSON.parse(await readFile(resolve(root, 'package.json'), 'utf8'))
 const changelog = await readFile(resolve(root, 'CHANGELOG.md'), 'utf8')
 const expectedTag = `v${packageJson.version}`
-const actualTag = process.env.GITHUB_REF_NAME ?? process.argv[2]
+const actualTag = process.argv[2] ?? process.env.GITHUB_REF_NAME
 
 if (!actualTag) {
   throw new Error('Provide a release tag as GITHUB_REF_NAME or the first argument.')

test/package-contract.test.mjs

@@ -1,7 +1,12 @@
 import assert from 'node:assert/strict'
+import { execFile } from 'node:child_process'
 import { readFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { promisify } from 'node:util'
 import test from 'node:test'
 
+const execFileAsync = promisify(execFile)
+
 const packageJson = JSON.parse(
   await readFile(new URL('../package.json', import.meta.url), 'utf8'),
 )
@@ -20,3 +25,14 @@ test('keeps the runtime dependency-free and declares the tested Node floor', ()
   assert.equal(packageJson.optionalDependencies, undefined)
   assert.equal(packageJson.peerDependencies, undefined)
 })
+
+test('uses an explicit release tag instead of the workflow branch name', async () => {
+  const verifyScript = fileURLToPath(
+    new URL('../scripts/verify-release.mjs', import.meta.url),
+  )
+  const { stdout } = await execFileAsync(process.execPath, [verifyScript, 'v0.1.1'], {
+    env: { ...process.env, GITHUB_REF_NAME: 'main' },
+  })
+
+  assert.equal(stdout, 'Verified release metadata for v0.1.1.\n')
+})