Problem: the tag gate fetches the default branch shallow-(--depth=1) and runs git merge-base --is-ancestor against the local copy. A force-pushed tag whose commit history overlaps the fetched range can render a local prefix that satisfies --is-ancestor, so a tag that was never merged to the default branch can reach the publish gate.
Suggested fix (advisory, defer): fetch with full history for the reachability check (git fetch origin $DEFAULT_BRANCH without depth, or use the GitHub API compare/containment), and/or verify the tag itself resolves to a commit that is an ancestor of the default branch tip via the API.
Evidence: .github/workflows/release.yml — git fetch origin \"$DEFAULT_BRANCH\" --depth=1 then git merge-base --is-ancestor \"$GITHUB_SHA\" \"origin/$DEFAULT_BRANCH\".
Source: branch comment-checker-npm @ 23dedfd5abbbdfd35c8e883252b4055235b55654 (PR link backfilled after ship).
Metadata: Severity: P2 / Confidence: 50 / Reviewer(s): adversarial / Finding ID: release.yml-194-force-pushed-tag-reachability
Problem: the tag gate fetches the default branch shallow-(
--depth=1) and runsgit merge-base --is-ancestoragainst the local copy. A force-pushed tag whose commit history overlaps the fetched range can render a local prefix that satisfies--is-ancestor, so a tag that was never merged to the default branch can reach the publish gate.Suggested fix (advisory, defer): fetch with full history for the reachability check (
git fetch origin $DEFAULT_BRANCHwithout depth, or use the GitHub API compare/containment), and/or verify the tag itself resolves to a commit that is an ancestor of the default branch tip via the API.Evidence:
.github/workflows/release.yml—git fetch origin \"$DEFAULT_BRANCH\" --depth=1thengit merge-base --is-ancestor \"$GITHUB_SHA\" \"origin/$DEFAULT_BRANCH\".Source: branch
comment-checker-npm@23dedfd5abbbdfd35c8e883252b4055235b55654(PR link backfilled after ship).Metadata: Severity: P2 / Confidence: 50 / Reviewer(s): adversarial / Finding ID: release.yml-194-force-pushed-tag-reachability