[ixuz]

What and why

The release workflow's docs job checked out the version's tag by its bare name. For a bare name, the checkout action takes a branch of the same name before the tag, so the job could render, attest as made on main, and upload docs from a commit that is not the release.

• The job now checks out main, reads the tag as refs/tags/<tag> only, checks with main's own release:commit script that it names that version's release commit on main, as the deploy does, and checks out that commit by its hash.
• The check runs on every run of the job, so a draft is never published for a tag that fails it.
• The deploy's lookup of the tag's commit is qualified the same way (refs/tags/$TAG^{commit}).
• The shared refusal in scripts/releaseCommit.ts now fits both callers.
• Tests cover the docs job's steps and a branch named like a tag beside the real one. docs/releasing.md and docs/deployment.md say how the tag is read.

The job has not run on GitHub with this change yet. A repository ruleset that refuses branch names matching v* would add a second layer, and is a setting for the maintainer.

Refs: GHSA-c67r-w75r-rjqx