ci(release): Refuse to publish a tag whose commit is not on main

The release workflow triggers on any pushed v* tag, but a tag carries no
branch association, so tagging any commit on any branch published to Maven
Central. Check out full history and fail the release job unless the tagged
commit is an ancestor of origin/main. The guard runs before jdk-setup, so no
GPG key or Central credentials are imported for a rejected tag, and because
github-release needs the release job, a rejected tag also creates no GitHub
Release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016phSDvM51hkfSYdjcGQrwz

Author: jeffjensen

.github/workflows/release.yml

@@ -25,8 +25,25 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
+          # Full history so the guard below can test whether the tagged commit is on main.
+          fetch-depth: 0
           persist-credentials: false
 
+      # A tag can be pushed from any branch, but only commits on main are released.
+      # Without this guard, tagging any commit on any branch publishes to Maven
+      # Central. Runs before jdk-setup so no GPG key or Central credentials are in
+      # scope if the check fails.
+      - name: Verify tag is on main
+        env:
+          SHA: ${{ github.sha }}
+        run: |
+          if git merge-base --is-ancestor "$SHA" origin/main; then
+            echo "Tagged commit $SHA is on main."
+          else
+            echo "::error::Tagged commit $SHA is not on main. Refusing to release."
+            exit 1
+          fi
+
       - uses: ./.github/actions/jdk-setup
         with:
           server-id: central-publish