ci: fix release-commit threading and remove dead changelog workflow

Address PR review (MarketDataDev03):

1. Chained publish built github.sha (the launch commit), not the
   released ref. In workflow_call, github.sha is inherited from the
   caller's launch ref, and publish.yml checked out with no ref:. If
   tag-and-release was launched from a branch other than inputs.ref, the
   tag/Release pointed at inputs.ref but the immutable Maven Central jar
   was built from the launch commit.
   Fix: add a `ref` input to publish.yml used in both the guard
   (head_sha) and checkout; tag-and-release resolves inputs.ref to a
   concrete SHA, tags at that SHA, and passes it to publish-central.

2. update-changelog.yml (on: release) never fired: the release is cut
   with GITHUB_TOKEN, and GITHUB_TOKEN-created events don't trigger
   workflows — the same rule that motivated workflow_call for publish.
   It was also redundant: our process finalizes the CHANGELOG (dated
   section) before the tag, which the notes-extraction step requires.
   Fix: remove the workflow.

Author: MarketDataApp

.github/workflows/publish.yml

@@ -8,6 +8,11 @@ on:
         description: "Version to publish (e.g. 1.0.0, without the 'v')"
         required: true
         type: string
+      ref:
+        description: "Commit SHA to build & publish from (defaults to the launch commit)"
+        required: false
+        default: ''
+        type: string
       release:
         description: "Publish and release. Off = upload to the Portal and stop at VALIDATED for manual review."
         required: true
@@ -20,6 +25,11 @@ on:
         description: "Version to publish (e.g. 1.0.0, without the 'v')"
         required: true
         type: string
+      ref:
+        description: "Commit SHA to build & publish from (defaults to the launch commit)"
+        required: false
+        default: ''
+        type: string
       release:
         description: "Publish and release. Off = upload to the Portal and stop at VALIDATED."
         required: false
@@ -36,13 +46,17 @@ jobs:
       - name: Check latest main.yml conclusion
         env:
           GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          # Build/guard against the explicit commit when given (chained path);
+          # otherwise the commit the workflow was launched from.
+          SHA: ${{ inputs.ref || github.sha }}
         run: |
           conclusion=$(gh api \
-            "repos/${{ github.repository }}/actions/workflows/main.yml/runs?head_sha=${{ github.sha }}&status=completed" \
+            "repos/${REPO}/actions/workflows/main.yml/runs?head_sha=${SHA}&status=completed" \
             --jq '.workflow_runs[0].conclusion // "missing"')
-          echo "main.yml conclusion for ${{ github.sha }}: $conclusion"
+          echo "main.yml conclusion for ${SHA}: $conclusion"
           if [ "$conclusion" != "success" ]; then
-            echo "::error::main.yml is not green for ${{ github.sha }} (got: $conclusion). Run publish from a commit on main whose CI passed."
+            echo "::error::main.yml is not green for ${SHA} (got: $conclusion). Run publish from a commit on main whose CI passed."
             exit 1
           fi
 
@@ -62,6 +76,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Build from the explicit commit when chained; else the launch commit.
+          ref: ${{ inputs.ref || github.sha }}
 
       - name: Set up JDK 17
         uses: actions/setup-java@v4

.github/workflows/tag-and-release.yml

@@ -108,13 +108,22 @@ jobs:
     name: Tag and GitHub Release
     runs-on: ubuntu-latest
     needs: gate
+    outputs:
+      sha: ${{ steps.resolve.outputs.sha }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref }}
 
+      # Resolve inputs.ref to a concrete commit SHA so the tag, the GitHub
+      # Release, and the chained Maven Central build all point at the SAME
+      # commit — even if the workflow was launched from a different branch.
+      - name: Resolve commit SHA
+        id: resolve
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - name: Verify tag does not already exist
         shell: bash
         env:
@@ -154,7 +163,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ inputs.version }}
-          TARGET_REF: ${{ inputs.ref }}
+          TARGET_REF: ${{ steps.resolve.outputs.sha }}
           IS_PRERELEASE: ${{ inputs.prerelease }}
         shell: bash
         run: |
@@ -186,5 +195,8 @@ jobs:
     uses: ./.github/workflows/publish.yml
     with:
       version: ${{ inputs.version }}
+      # Build & publish the exact commit that was tagged/released, not the
+      # workflow's launch commit (github.sha) — Maven Central is immutable.
+      ref: ${{ needs.release.outputs.sha }}
       release: true
     secrets: inherit