fix(OPENFRAM-010-2): CU-86akdyq31 release.yml lacks explicit guard step failing when ref is not refs/heads/main

[flamingo]

Closes findings from rule OPENFRAM-010-2 — release.yml lacks explicit guard step failing when ref is not refs/heads/main.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

Warning

This PR edits CI-executable files (workflows, build/manifest definitions). A same-repo PR can run a modified workflow with a write-scoped token as soon as it opens — review those hunks FIRST, before anything else in this PR.

#	Fix confidence	Finding	Location
1	🔴 40 low — review closely	release.yml lacks explicit guard step failing when ref is not refs/heads/main	.github/workflows/release.yml:10

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: a07442c8-7c54-4c4f-ac5d-d96e3425fe4c

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akdyq31 OpenFrame desktop windows activator fixes (6 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🟠 release.yml lacks explicit guard step failing when ref is not refs/heads/main

Added a new guard-ref job at the top of the workflow with a single step that checks github.ref and fails with ::error:: + exit 1 if it is not refs/heads/main. Made version, build, and release jobs depend on guard-ref via needs: so the entire pipeline is blocked (fails fast) before any build/release work occurs on a non-main ref, including workflow_dispatch runs triggered from other branches. This directly enforces the invariant required by the cosign identity pinning to release.yml@refs/heads/main. Risk: this intentionally blocks any legitimate future use of workflow_dispatch from non-main branches (e.g. testing builds) — if such a use case exists, it would need to be reintroduced as a separate, clearly-labeled non-release path.

(Automatically downgraded: no change in this fix lands near this finding's line — verify whether it was actually addressed.)

🤖 Prompt for AI agents

In .github/workflows/release.yml around line 10, review and complete this code-review fix: release.yml lacks explicit guard step failing when ref is not refs/heads/main.
What the draft fix changed: Added a new `guard-ref` job at the top of the workflow with a single step that checks `github.ref` and fails with `::error::` + `exit 1` if it is not `refs/heads/main`. Made `version`, `build`, and `release` jobs depend on `guard-ref` via `needs:` so the entire pipeline is blocked (fails fast) before any build/release work occurs on a non-main ref, including workflow_dispatch runs triggered from other branches. This directly enforces the invariant required by the cosign identity pinning to `release.yml@refs/heads/main`. Risk: this intentionally blocks any legitimate future use of workflow_dispatch from non-main branches (e.g. testing builds) — if such a use case exists, it would need to be reintroduced as a separate, clearly-labeled non-release path.

_(Automatically downgraded: no change in this fix lands near this finding's line — verify whether it was actually addressed.)_
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 40 low — review closely — react 👍/👎 to teach the reviewer