ci(release): allow releasing from a historical ref

Add an optional 'sourceRef' workflow_dispatch input (default empty =
this branch, normally main). When set to a tag/branch/SHA it is passed
to the reusable release workflow's 'ref' so historical source is built
and signed with the current pipeline, and the new release tag is pinned
to that commit via 'target'.

Author: glennawatson

.github/workflows/release.yml

@@ -12,6 +12,12 @@ on:
           - minor
           - major
 
+      sourceRef:
+        description: 'Optional git ref (tag/branch/SHA) to release from. Leave blank to release from this branch (normally main).'
+        required: false
+        type: string
+        default: ''
+
 permissions:
   contents: write
   id-token: write
@@ -25,6 +31,7 @@ jobs:
       installWorkloads: true
       minverMinimumMajorMinor: '2.7'
       bump: ${{ inputs.bump }}
+      ref: ${{ inputs.sourceRef }}
     secrets:
       CERTUM_USER_ID: ${{ secrets.CERTUM_USER_ID }}
       CERTUM_OTP_URI: ${{ secrets.CERTUM_OTP_URI }}
@@ -65,3 +72,4 @@ jobs:
     with:
       version: ${{ needs.release.outputs.semver2 }}
       tag: ${{ needs.release.outputs.tag }}
+      target: ${{ needs.release.outputs.sourceSha }}