fix(ci): disambiguate orb beta release dispatch ref

[JSONbored]

Motivation

• The automated beta dispatch used an unqualified short tag name which can collide with a same-named branch and cause GitHub to select and run attacker-controlled workflow code.
• The release workflow grants contents: write/packages: write and selects the release-beta environment based only on event fields, so an ambiguous ref can expose high-privilege publishing semantics to the wrong ref.

Description

• Added a remote branch existence guard before creating the automated ORB beta tag by checking refs/heads/$TAG and failing if a branch with the same short name exists in .github/workflows/orb-beta-release.yml.
• Dispatch now uses the fully qualified tag ref refs/tags/$TAG when running gh workflow run to ensure the dispatched workflow file is the tag's immutable ref instead of any same-named branch in .github/workflows/orb-beta-release.yml.
• Tightened the release-beta environment gate to require the workflow to be running on a tag by adding github.ref_type == 'tag' to the environment selection expression in .github/workflows/release-selfhost.yml.

Testing

• Ran npm run actionlint which completed successfully (used WASM fallback for actionlint setup in this environment).
• Ran git diff --check which passed without issues.
• Ran npm run test:ci which exercised the CI gate but failed at cf-typegen:check because the generated worker-configuration.d.ts is stale in the working tree and needs regeneration via npm run cf-typegen.
• Ran npm audit --audit-level=moderate which failed due to the npm registry audit endpoint returning 403 Forbidden in this environment.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.14%. Comparing base (c3b10f2) to head (cadd6e9).
⚠️ Report is 17 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4731   +/-   ##
=======================================
  Coverage   94.14%   94.14%           
=======================================
  Files         437      437           
  Lines       38531    38531           
  Branches    14049    14049           
=======================================
  Hits        36274    36274           
  Misses       1599     1599           
  Partials      658      658           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-10 23:23:12 UTC}

2 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · unstable

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This PR closes a real ref-ambiguity/privilege-escalation gap in the ORB beta release automation: it adds a remote branch-existence guard before tagging, switches the release dispatch to the fully-qualified `refs/tags/$TAG` ref instead of a bare short name, and tightens the `release-beta` environment gate in release-selfhost.yml to additionally require `github.ref_type == 'tag'`. I traced the environment expression and confirmed the new condition only narrows the `workflow_dispatch` branch of the ternary and leaves the existing `push: tags:` trigger path (which already resolves to `release` via the same expression) unaffected. The `git ls-remote --heads` guard runs before `gh auth setup-git`/remote credential setup, but since this appears to be a public repo, anonymous HTTPS read access is sufficient, so the check is reachable and functional as written.

Nits — 3 non-blocking

• orb-beta-release.yml: the `git ls-remote --exit-code --heads origin "$TAG"` guard is wrapped in a bare `if`, so any non-zero exit (a transient network/auth failure, not just "branch doesn't exist") is treated identically to "no conflicting branch" and silently lets tagging proceed — consider distinguishing exit code 2 (no match) from other failures so the guard fails closed on unexpected errors.
• orb-beta-release.yml: there's a small TOCTOU window between the branch-existence check and the actual `git push origin "$TAG"` where a same-named branch could still be created; acceptable as best-effort but worth a one-line comment noting the residual race is accepted.
• Consider adding a short comment near the `ls-remote` guard clarifying the assumption that `origin` has anonymous public read access (given `persist-credentials: false` on checkout), so a future reader doesn't assume it silently requires auth.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 285 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 285 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 48 PR(s), 285 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review