ci: Don't allow releasing from non-master

Author: alt-romes

.github/workflows/release.yaml

@@ -49,12 +49,39 @@ jobs:
           name: Haskell Debugger Docs
           path: dist-newstyle/haskell-debugger*docs.tar.gz
 
+  validate-tag:
+    name: Validate tag is at master HEAD
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Ensure tag points to master HEAD
+        shell: bash
+        run: |
+          echo "Tag ref: $GITHUB_REF"
+          echo "Tag commit: $GITHUB_SHA"
+
+          # Fetch latest master explicitly
+          git fetch origin master
+
+          MASTER_SHA=$(git rev-parse origin/master)
+          echo "origin/master HEAD: $MASTER_SHA"
+
+          if [[ "$GITHUB_SHA" != "$MASTER_SHA" ]]; then
+            echo "Tag does not point to the tip of master."
+            echo "Tag SHA:     $GITHUB_SHA"
+            echo "Master SHA:  $MASTER_SHA"
+            exit 1
+          fi
+
+          echo "Tag is exactly at master HEAD."
+
   release:
-    # only release from a tag pointing to master!
-    if: github.ref == 'refs/heads/master'
     name: Release
     runs-on: ubuntu-latest
-    needs: [build-haskell-debugger, docs-haskell-debugger]
+    needs: [validate-tag, build-haskell-debugger, docs-haskell-debugger]
     steps:
       - uses: actions/checkout@v4
         with: