From 5b10fe95764650e6f4ac51ee348076d6f70ecae4 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 26 Sep 2026 20:23:18 -0700
Subject: [PATCH] fix(ci): build releases from the release tag

The release workflow checked out the ref it was dispatched on, usually
main, instead of the release tag. The published binaries and their
provenance attestation could come from a different commit than the tag
they were attached to. Check out the tag instead.
---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52fa63c..99f4322 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,6 +32,8 @@ jobs:
     - name: checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        # Build the tagged commit, not whichever ref the workflow was dispatched on.
+        ref: "refs/tags/${{ github.event.inputs.release-tag }}"
         persist-credentials: false
 
     - name: 'install rust toolchain'