[codex] Bind release publishers to immutable tags (BUZZ-SEC-039) (#1914)

.github/workflows/docker.yml

@@ -18,22 +18,19 @@ name: Docker image
 #   - push tags relay-v*.*.* → :{version} + :{major}.{minor} + :{major}
 #                              (+ :latest for stable, NOT for prereleases)
 #   - pull_request           → build only (no push), cache stays warm
-#   - workflow_dispatch      → manual canary (no inputs), or relay-tag rescue
-#                              dispatch with version+ref inputs (see below)
+#   - workflow_dispatch      → relay-tag rescue, dispatched at the tag itself
 #
-# Why workflow_dispatch carries version/ref inputs:
+# Why workflow_dispatch carries a version input:
 #   auto-tag-on-release-pr-merge.yml pushes relay-v* with the default
 #   GITHUB_TOKEN, which GitHub deliberately does NOT let fire on:push triggers
 #   (recursion guard). So the push:tags trigger above never runs for releases.
-#   auto-tag instead dispatches this workflow with the bare version + tag ref,
-#   the same rescue release.yml already uses for the desktop lane. On dispatch
-#   github.ref is `main`, so the tag ref is plumbed through explicitly: checkout
-#   pins to inputs.ref, and the semver tags take inputs.version via `value=`.
+#   auto-tag instead dispatches this workflow at the immutable tag and supplies
+#   the bare version for metadata-action. The workflow rejects a dispatch whose
+#   github.ref, checked-out HEAD, and relay-v tag do not resolve to one commit.
 #   On the rescue path inputs.version is already bare (e.g. 0.3.0), so the
 #   match=^relay-v(.*)$ regex simply no-ops (it warns, leaving the value
 #   intact) and the bare version flows straight to the semver parser. On a
 #   real push event value= is empty and the match strips relay-v from the ref.
-#   Inputless canary dispatch (version="", ref=main) renders no semver tag.
 #
 # The :latest tag tracks the latest STABLE relay release: metadata-action's
 # `flavor.latest=auto` (its default) emits :latest only for non-prerelease
@@ -63,11 +60,7 @@ on:
     inputs:
       version:
         description: "Semver version e.g. 0.3.0 (no relay-v prefix) — for relay-tag rescue dispatch"
-        required: false
-      ref:
-        description: "Tag/branch/SHA to build, e.g. relay-v0.3.0"
-        required: false
-        default: main
+        required: true
 
 # One image build per ref; cancel superseded PR builds, but never cancel
 # tag/main builds (publishing must not be aborted mid-flight).
@@ -112,11 +105,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
-          # On workflow_dispatch (relay-tag rescue) build the tagged commit,
-          # not main. Empty string = default ref for push/PR events.
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+          fetch-depth: 0
           persist-credentials: false
 
+      - name: Verify tag-bound release source
+        if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          VERSION="${INPUT_VERSION:-${GITHUB_REF_NAME#relay-v}}"
+          scripts/verify-release-ref.sh relay-v "$VERSION"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
         with:
@@ -327,8 +326,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+          fetch-depth: 0
           persist-credentials: false
+      - name: Verify tag-bound release source
+        if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          VERSION="${INPUT_VERSION:-${GITHUB_REF_NAME#relay-v}}"
+          scripts/verify-release-ref.sh relay-v "$VERSION"
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
         with: