[MISC] Reject no-op OSS releases when there are no new commits (#2117)

* [MISC] Reject no-op OSS releases when there are no new commits

create-release.yaml computed and published a new tag even when the branch had
no commits beyond the last release, producing empty releases (e.g. v0.177.1
points at the exact same commit as v0.177.0).

Add a guard after "Fetch base release version": use the compare API's ahead_by
(the workflow has no local checkout) to count commits on the branch beyond the
latest release tag. If zero, abort with a clear error (dry-run only warns).
Works for main and hotfix branches alike.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* [MISC] Harden no-op guard: validate ahead_by, fail loudly on unexpected value

PR review (Greptile + internal): `[[ "$AHEAD" -eq 0 ]]` mishandled a non-integer
ahead_by — an empty value evaluated true ([[ "" -eq 0 ]]) and would wrongly
reject a legitimate release, and a literal "null" aborted with a cryptic
"integer expression expected" / unbound-variable error.

Use `--jq '.ahead_by // empty'`, fail loudly if the compare API call fails, and
require ahead_by to match ^[0-9]+$ (error out otherwise) before a string compare
against "0". A transient/auth/shape error now fails the step with a clear
message instead of being mistaken for "no new commits".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: ritwik-g

.github/workflows/create-release.yaml

@@ -126,6 +126,38 @@ jobs:
           echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
           echo "Base release: $LATEST_TAG"
 
+      - name: Ensure there are new commits to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          LATEST_TAG: ${{ steps.get-latest.outputs.latest_tag }}
+          BRANCH: ${{ github.ref_name }}
+          DRY_RUN: ${{ github.event.inputs.dry_run }}
+        run: |
+          # Reject a no-op release: if the branch has no commits beyond the last release
+          # tag (e.g. main is already at v0.177.0), there is nothing to release. This
+          # prevents empty releases such as v0.177.1 pointing at the same commit as
+          # v0.177.0. The workflow has no local checkout, so use the compare API's
+          # `ahead_by` (commits on BRANCH not in LATEST_TAG). `// empty` stops a null/
+          # absent value from reaching the comparison as the literal "null"; we then
+          # require a non-negative integer and fail loudly on anything unexpected, so a
+          # transient API error is never mistaken for "no new commits".
+          AHEAD=$(gh api "repos/${{ github.repository }}/compare/${LATEST_TAG}...${BRANCH}" --jq '.ahead_by // empty') \
+            || { echo "::error::Could not query commits since $LATEST_TAG (compare API failed)."; exit 1; }
+          if ! [[ "$AHEAD" =~ ^[0-9]+$ ]]; then
+            echo "::error::Unexpected ahead_by='${AHEAD:-<empty>}' from compare ${LATEST_TAG}...${BRANCH}; refusing to guess."
+            exit 1
+          fi
+          if [[ "$AHEAD" == "0" ]]; then
+            if [[ "$DRY_RUN" == "true" ]]; then
+              echo "::warning::No new commits on '$BRANCH' since $LATEST_TAG — a real run would be rejected (nothing to release)."
+            else
+              echo "::error::No new commits on '$BRANCH' since $LATEST_TAG — nothing to release. Aborting to avoid an empty release."
+              exit 1
+            fi
+          else
+            echo "✅ $AHEAD new commit(s) on '$BRANCH' since $LATEST_TAG"
+          fi
+
       - name: Compute next version
         id: compute-version
         env: