fix(release): dispatch validation by full SHA (#126669)

scripts/full-release-validation-at-sha.mts

@@ -75,7 +75,7 @@ function usage() {
   console.error(`Usage: node scripts/full-release-validation-at-sha.mjs [--sha <target-sha>] [--target-ref <canonical-release-branch-or-tag>] [--workflow-sha <trusted-main-ref>] [--keep-branch] [--dry-run] [-- -f key=value ...]
 
 Creates temporary remote branches pinned to the exact Tooling SHA and Validation SHA,
-dispatches Full Release Validation with the Validation SHA branch as its ref input
+dispatches Full Release Validation with the full Validation SHA as its ref input
 and expected_sha as its immutable identity,
 watches the parent run, verifies all child workflow head SHAs match the trusted
 workflow lineage through the release evidence manifest, then deletes both
@@ -674,7 +674,7 @@ function main() {
   const targetBranch = `validation/target-${targetSha.slice(0, 12)}-${Date.now()}`;
   const remoteTargetBranchRef = `refs/heads/${targetBranch}`;
   const dispatchInputs = {
-    ref: targetBranch,
+    ref: targetSha,
     expected_sha: targetSha,
     ...(targetContextRef !== targetSha ? { target_context_ref: targetContextRef } : {}),
     ...args.inputs,

test/scripts/full-release-validation-at-sha.test.ts

@@ -515,7 +515,7 @@ describe("full-release-validation-at-sha", () => {
     ).toBe(false);
   });
 
-  it("pushes an exact target ref, dispatches it, prints the run URL, and cleans both refs", () => {
+  it("pushes the target transport ref, dispatches the candidate SHA, and cleans both refs", () => {
     const fixture = createDispatchFixture();
     try {
       const result = fixture.run(["--workflow-sha", fixture.workflowSha]);
@@ -563,7 +563,7 @@ describe("full-release-validation-at-sha", () => {
         dispatchInputs[assignment.slice(0, separatorIndex)] = assignment.slice(separatorIndex + 1);
       }
       expect(dispatchInputs).toMatchObject({
-        ref: targetBranch,
+        ref: fixture.targetSha,
         expected_sha: fixture.targetSha,
         target_context_ref: fixture.releaseRef,
         allow_unreleased_changelog: "false",