From c737b2516924989968dea833d60955429cf3e954 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Fri, 10 Jul 2026 04:34:21 -0700
Subject: [PATCH] fix(ci): dispatch orb-beta-release against the tag, not the
 floating main ref

The "Dispatch the ORB release build" step fired release-selfhost.yml via
--ref main -- the floating branch -- rather than the beta tag it had just
created and pushed one step earlier in the same job. Any commit landing on
main in the gap between the tag-push step and the dispatch actually being
processed by GitHub resolves github.sha inside the dispatched run to that
newer commit, while the tag (already pushed, immutable) still points at
the older one it was cut for -- tripping release-selfhost.yml's own
TAG_SHA-must-equal-RELEASE_SHA fail-safe and aborting the release.

Observed live: orb-v0.4.0-beta.21 was tagged at 347ada8ec, but by dispatch
time main had moved to e984eef7c from a concurrent merge, aborting that
day's scheduled beta release (safely -- no bad image was built).

Dispatch against the tag instead: immutable once pushed, so github.sha
resolves to exactly the commit the tag points to by construction, closing
the race regardless of how many commits land on main afterward.

Fixes #4679
---
 .github/workflows/orb-beta-release.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/orb-beta-release.yml b/.github/workflows/orb-beta-release.yml
index c13c9431cc..454bbed291 100644
--- a/.github/workflows/orb-beta-release.yml
+++ b/.github/workflows/orb-beta-release.yml
@@ -88,12 +88,22 @@ jobs:
       # `--verify-tag` GitHub Release step can run safely (see that workflow's own comments). Gated on
       # steps.tag.outputs.created (not just due) so a no-op tag step -- for any reason -- never triggers a
       # rebuild/republish of an existing GHCR image tag with different content.
+      #
+      # Dispatch against the TAG, not `main`: `main` is a floating ref, and this repo merges fast enough
+      # that a commit can land in the gap between the "Tag the new beta" step above pushing $TAG and this
+      # step's dispatch actually being processed by GitHub. `--ref main` would then resolve `github.sha`
+      # inside release-selfhost.yml to that NEWER commit, while $TAG (pushed moments ago, immutable) still
+      # points at the older one it was actually cut for -- tripping that workflow's own
+      # TAG_SHA-must-equal-RELEASE_SHA fail-safe and aborting the release. Dispatching against $TAG instead
+      # makes `github.sha` resolve to exactly the commit the tag points to, by construction, so the two can
+      # never disagree regardless of how many commits land on main afterward.
       - name: Dispatch the ORB release build
         if: steps.report.outputs.due == 'true' && steps.tag.outputs.created == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.report.outputs.tag }}
           VERSION: ${{ steps.report.outputs.version }}
-        run: gh workflow run release-selfhost.yml --ref main -f "version=${VERSION}" -f create_github_release=true
+        run: gh workflow run release-selfhost.yml --ref "$TAG" -f "version=${VERSION}" -f create_github_release=true
 
       - name: Summarize
         if: always()