From 39eb31819a56dc49f0070f042da0bafc652b4a41 Mon Sep 17 00:00:00 2001
From: Oleksiy Martynov <5933733+olliethedev@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:10:18 -0400
Subject: [PATCH] fix: bind release retries to the tag ref

---
 .github/workflows/release.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57004785..9190eb9a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Existing Git tag to publish
+        description: Existing Git tag to publish; select the same tag as the workflow ref
         required: true
         type: string
       prerelease:
@@ -73,6 +73,11 @@ jobs:
           CODEGEN_VERSION=$(node -p "require('./packages/cli/package.json').version")
           TAG_VERSION="${RELEASE_TAG#v}"
 
+          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] && [ "$GITHUB_REF" != "refs/tags/$RELEASE_TAG" ]; then
+            echo "Manual release retries must run from tag $RELEASE_TAG; current ref is $GITHUB_REF"
+            exit 1
+          fi
+
           if [ "$STACK_VERSION" != "$TAG_VERSION" ]; then
             echo "Tag version ($TAG_VERSION) does not match @btst/stack version ($STACK_VERSION)"
             exit 1