From 64211d4475b7514f585394d84321fd363517b8b6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 13 Oct 2026 18:39:46 +0000
Subject: [PATCH] Use merge parent as base in release-readiness

github.event.pull_request.base.sha can lag behind the main commit
that refs/pull/N/merge was actually built on. When a PR merges main
across a release, the stale base still carries the old version, so
the job sees a phantom version bump, runs --tag-check and fails
because the new tag already exists (PR #1489, run 38444545888:
base 285a5e8 at 5.0.0, merge built on d4af25a at 5.0.1).

Read the base from the first parent of the checked-out merge commit
instead; that is exactly the base the tested tree was merged onto.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LgS1BwdcQfkDYXqbXL8uUA
---
 .github/workflows/ci.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f743c8f60..b576932a4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -297,7 +297,6 @@ jobs:
       - name: Lint release readiness
         env:
           EVENT_NAME: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_REF: ${{ github.head_ref }}
           BASE_REF: ${{ github.base_ref }}
           HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
@@ -310,8 +309,13 @@ jobs:
           fi
           if [ "$EVENT_NAME" = "pull_request" ]; then
             # Compare the workspace version against the PR base to detect a
-            # version bump. The shallow checkout doesn't have the base
-            # commit; fetch just that object.
+            # version bump. Take the base from the first parent of the
+            # checked-out refs/pull/N/merge commit, i.e. the main commit this
+            # merge was built on: github.event.pull_request.base.sha can lag
+            # behind it, so a PR that merged main across a release saw a
+            # phantom bump and failed --tag-check. The shallow checkout
+            # doesn't have the parent; fetch just that object.
+            BASE_SHA="$(git cat-file -p HEAD | sed -n 's/^parent //p' | head -1)"
             git fetch --quiet --depth 1 origin "$BASE_SHA"
             BASE_VERSION="$(git show "$BASE_SHA:Cargo.toml" | grep '^version = ' | head -1 | sed 's/version = "\(.*\)"/\1/')"
             HEAD_VERSION="$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')"