chore: release stable versions only from commits merged into main

[felipefreitag]

A stable release of the package can now ship only from a commit that was merged into main. A stable v* tag on any other commit fails the ci job before the package is built.

Before, the workflow trusted the tag alone. Anyone with write access could tag a commit on a side branch, and as long as the version file in that commit matched the tag, the package was published with a valid attestation.

Now a stable tag must sit on main, which only accepts reviewed pull requests. Prerelease tags such as v2.48.0rc1 are not checked, so a candidate can still be cut from a branch.

How to reach it. Nothing changes for a normal release. Merge the bump, tag the merge commit, push the tag. To see the guard fail, tag a commit on a branch that is not merged and push that tag. The run stops with an error that names the tag and the branch.

Not covered. The guard runs after the tag is pushed, so the tag still lands. A tag ruleset that limits who can create v* tags is the layer that stops the push itself. Same change as resend-ruby #246.

DEV-2133

---

Summary by cubic

Stable v* tags now publish only when the tag sits on a commit merged into main. A stable tag on any other commit fails the ci job before the package is built, closing the gap where write-access users could tag a side branch and publish.

• The check compares against the fully qualified remote branch ref, so a tag named like the branch can't pass for it.
• Prerelease tags like v2.48.0rc1 aren't checked, so candidates can still be cut from branches.
• Nothing changes for a normal release; note the guard runs after push, so the tag still lands.

DEV-2133.

^{Written for commit 606b5b5. Summary will update on new commits.}

[cubic-dev-ai]

Running ultrareview automatically — This PR changes the release CI/CD pipeline to guard stable tag publication with a git merge-base check; a subtle failure could allow an invalid package release or block all stable releases, so it warrants deep review.. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 3m 23s

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Requires human review: Adds a CI guard that fails stable tags not on the default branch, preventing stable releases from unmerged branches. This changes release authorization/deployment policy, so a human should confirm the intended release workflow.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Requires human review: Adds a CI guard that fails stable v* tags not on the default branch, preventing stable releases from unmerged branches. This changes release authorization/deployment policy, so a human should confirm the intended stable-release workflow and failure mode.

Re-trigger cubic</sub>