From 0c46f055604263b5575ed8e9eccaca804ff51705 Mon Sep 17 00:00:00 2001
From: bcherrington <993834+bcherrington@users.noreply.github.com>
Date: Thu, 13 Aug 2026 08:42:00 +0100
Subject: [PATCH] fix(release): provide repository context to publisher

The publish job intentionally has no checkout, so give GitHub CLI an explicit repository instead of relying on local Git metadata. Extend the workflow validator to prevent regression.\n\nRefs #24
---
 .github/workflows/release.yml         | 1 +
 scripts/validate_release_workflows.py | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72ffa93..e091242 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,7 @@ jobs:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
         run: |
           gh release create "$GITHUB_REF_NAME" dist/* \
             --verify-tag \
diff --git a/scripts/validate_release_workflows.py b/scripts/validate_release_workflows.py
index 06a5909..c48b99a 100644
--- a/scripts/validate_release_workflows.py
+++ b/scripts/validate_release_workflows.py
@@ -42,6 +42,9 @@ def validate(rehearsal_path: Path, release_path: Path) -> None:
     ), "only the publication job may request contents: write"
     assert release.count("contents: write") == 1
     assert release.count("gh release create") == 1
+    assert "GH_REPO: ${{ github.repository }}" in release, (
+        "checkout-free publication must provide explicit GitHub repository context"
+    )
 
 
 def main() -> None: