[jbogard]

Before building, the release workflow now checks that the tagged commit is on the right branch: release/<major>.x if that branch exists, otherwise main. If it isn't, the release fails before anything is built, signed or pushed to NuGet.

Why

In #4620, v15.1.1 and v15.1.2 were created through the GitHub Releases UI. Entering the tag name before picking the branch creates the tag on the default branch, so both "15.x" packages were built from 16.x code (main at 1af71bfe). The UI makes this mistake easy to repeat, and nothing in the pipeline caught it.

How

• The step runs right after checkout in the first release job. The publishing job needs that job, so a failed check stops the release.
• The tag's major version picks the branch, so v15.* requires release/15.x. If a release/16.x branch is ever created, v16.* tags will then require it automatically.
• The step uses shell: bash, which also works on the Windows runner.
• On failure, the error says which branch the tag should be on.

Verification

I ran the same script locally against existing tags:

Tag	Result
v15.1.1	❌ not on release/15.x
v15.1.2	❌ not on release/15.x
v15.1.3	✅ on release/15.x
v16.2.0	✅ on main
v16.0.0-beta-1	✅ on main

Workflow YAML parses, and job dependencies are unchanged.

Companion PR for release/15.x: #4669

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T22:13:09.514477Z	0d2699e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

Branch lookup errors incorrectly trigger fallback to main, potentially allowing a wrong-branch tag to pass validation.

1 open issue

• Restrict fallback to missing release branch · New

What changed in this PR

Adds a release-workflow guard to prevent publishing packages from the wrong release branch, addressing the mistagged 15.x releases described in #4620.

Changes:

• Selects release/<major>.x when it exists, otherwise main.
• Checks tag ancestry immediately after checkout and stops the release with an error if validation fails.

File	Description
.github/​workflows/​release.yml	Adds branch selection and tag ancestry validation before building.

_{Review effort: Balanced}