From 0d80b1bdabc271fc5688df33e6611250dc1194a9 Mon Sep 17 00:00:00 2001
From: Dallin Romney <dallinromney@gmail.com>
Date: Thu, 9 Jul 2026 21:02:21 -0700
Subject: [PATCH] fix(release): pin rehearsal preflight to branch head

---
 .github/workflows/openclaw-npm-release.yml                 | 5 +++++
 test/scripts/openclaw-npm-extended-stable-workflow.test.ts | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/openclaw-npm-release.yml b/.github/workflows/openclaw-npm-release.yml
index fdc7ec4b5733..a2630b6b64f9 100644
--- a/.github/workflows/openclaw-npm-release.yml
+++ b/.github/workflows/openclaw-npm-release.yml
@@ -63,6 +63,7 @@ jobs:
           PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
           RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
           WORKFLOW_REF: ${{ github.ref }}
+          WORKFLOW_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
           if [[ "${PREFLIGHT_ONLY}" != "true" ]]; then
@@ -85,6 +86,10 @@ jobs:
             echo "This throwaway workflow must run from dev/throwaway-2026.0.33-v6.8."
             exit 1
           fi
+          if [[ "${RELEASE_REF,,}" != "${WORKFLOW_SHA,,}" ]]; then
+            echo "This throwaway workflow requires tag to equal the selected branch head SHA."
+            exit 1
+          fi
 
       - name: Checkout
         uses: actions/checkout@v6
diff --git a/test/scripts/openclaw-npm-extended-stable-workflow.test.ts b/test/scripts/openclaw-npm-extended-stable-workflow.test.ts
index 295d163f0264..302f8b3c7f7f 100644
--- a/test/scripts/openclaw-npm-extended-stable-workflow.test.ts
+++ b/test/scripts/openclaw-npm-extended-stable-workflow.test.ts
@@ -80,6 +80,9 @@ describe("minimal npm extended-stable workflow", () => {
     expect(refGuard.run).toContain("requires a full 40-character commit SHA");
     expect(refGuard.run).toContain("dev/throwaway-2026.0.33-v6.8");
     expect(refGuard.run).toContain("requires preflight_only=true");
+    expect(refGuard.env?.WORKFLOW_SHA).toBe("${{ github.sha }}");
+    expect(refGuard.run).toContain('"${RELEASE_REF,,}" != "${WORKFLOW_SHA,,}"');
+    expect(refGuard.run).toContain("requires tag to equal the selected branch head SHA");
     expect(parsed.jobs?.reject_non_preflight?.if).toBe("${{ !inputs.preflight_only }}");
     expect(step(parsed.jobs?.reject_non_preflight, "Reject publish-mode dispatch").run).toContain(
       "publish jobs are absent",