fix(selfhost): protect manual beta Orb releases

[JSONbored]

Motivation

• Prevent unreviewed publication of GHCR beta image tags by ensuring only the automated orb-beta-release bot can route a run into the unreviewed release-beta environment.
• Add a server-side validation so an automated beta dispatch cannot be abused to rebuild or republish an arbitrary existing beta tag.

Description

• Tighten the environment: expression in .github/workflows/release-selfhost.yml so release-beta is selected only when the event is workflow_dispatch, the actor is github-actions[bot], inputs.create_github_release is truthy, and inputs.version contains -beta.; all other beta dispatches and tag pushes remain on the protected release environment.
• Expose CREATE_GITHUB_RELEASE, RELEASE_SHA, and RUN_ACTOR to the Resolve version step and add a pre-publish check that, for automated beta dispatches, fetches the expected tag and verifies the tag object resolves to the current workflow commit before allowing the job to continue.
• Update comments to document the tighter guard and the intent to keep manual dispatches on the reviewer-gated environment.

Testing

• Ran git diff --check to ensure no whitespace/conflict markers, which succeeded.
• Ran the workflow linter via npm run actionlint, which completed successfully (used the WASM fallback after GitHub download retries) and reported no blocking issues.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.73%. Comparing base (7d4117c) to head (ee8f594).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4183   +/-   ##
=======================================
  Coverage   93.73%   93.73%           
=======================================
  Files         387      387           
  Lines       36371    36371           
  Branches    13316    13316           
=======================================
+ Hits        34092    34093    +1     
  Misses       1621     1621           
+ Partials      658      657    -1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-08 10:38:20 UTC}

1 file · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This tightens the release-selfhost.yml environment gate so `release-beta` (no reviewer gate) is only selected for workflow_dispatch runs where actor=='github-actions[bot]', create_github_release is true, and version matches -beta.; all push-triggered beta tags and human dispatches now land on the reviewer-gated `release` environment. It also adds a pre-publish check in the 'Resolve version' step that force-fetches the expected orb-v<version> tag and rejects the run if that tag's commit doesn't match the current github.sha, closing the 'dispatch an arbitrary existing beta tag for rebuild/republish' gap described in the PR. The logic is consistent with orb-beta-release.yml's actual dispatch shape (`--ref main`, `create_github_release=true`, GITHUB_TOKEN giving actor=github-actions[bot]), and the annotated-tag rev-list/SHA comparison is correct.

Nits — 4 non-blocking

• The `github.actor == 'github-actions[bot]'` check is a coarse trust signal: any other in-repo workflow with `permissions: actions: write` that calls `gh workflow run release-selfhost.yml` using its own default GITHUB_TOKEN would also present as actor=github-actions[bot], not just orb-beta-release.yml specifically — worth a comment noting this is the best available heuristic (GitHub Actions has no first-class 'triggering workflow' claim for a plain workflow_dispatch call) rather than a hard guarantee scoped to that one workflow.
• The PR description doesn't link to an open issue per repo convention for contributor PRs — worth confirming this is tied to an authorized security-hardening issue before merge.
• Consider logging the fetched TAG_SHA and RELEASE_SHA on failure (not just a generic message) to make a rejected automated dispatch easier to debug from the Action log.
• The comment block above `environment:` is thorough and accurate — nice job keeping it in sync with the new expression.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 52 registered-repo PR(s), 43 merged, 486 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 52 PR(s), 486 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 52 PR(s), 486 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review