ci: require stable releases from main

Author: Fermionic-Lyu

.github/workflows/publish.yml

@@ -20,6 +20,8 @@ jobs:
       stable: ${{ steps.version.outputs.stable }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
 
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
@@ -38,6 +40,11 @@ jobs:
 
           if [[ "$package_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "stable=true" >> "$GITHUB_OUTPUT"
+            release_commit="$(git rev-parse "${RELEASE_TAG}^{commit}")"
+            if ! git merge-base --is-ancestor "$release_commit" origin/main; then
+              echo "Stable release $RELEASE_TAG must point to a commit contained in main." >&2
+              exit 1
+            fi
           else
             echo "stable=false" >> "$GITHUB_OUTPUT"
           fi