[github-actions]

Summary

release.yml used to require the release tag to sit on the merge commit of the version-bump PR. That breaks whenever a fix lands after the bump. On main today, the 3.0.1 bump (#190, ecd1d6e) fails npm test under TypeScript 6, and the fix for that is #191 (a6f57a2). Tagging ecd1d6e would fail the test step, and tagging a6f57a2 would fail the "merged bump PR" check. So v3.0.1 can't be released at all.

The verify step now resolves a bump commit instead of using the tag commit directly:

tag == v<package.json version>                    (unchanged)
lockfile version == package version               (unchanged)
tag commit is on main                             (unchanged)
bump_commit = newest first-parent ancestor of tag commit where package.json version != parent's
bump_commit's version == package version
bump_commit's merged PR changed package.json + package-lock.json and the version   (existing checks, now applied to bump_commit)

Build, test, pack, publish, notify and permissions are unchanged. Tests still run on the tagged commit. The 3.0.1 → 3.0.2 bump this PR originally contained has been dropped, so the package stays at 3.0.1.

Verification

The step's bash was run locally against the real history with local-only tags:

Tag	At	Result
v3.0.1	main (a6f57a2)	pass, v3.0.0 -> v3.0.1 from merged PR #190
v3.0.1	ecd1d6e	pass
v3.0.0	main	fail, tag/version mismatch
v3.0.1	commit not on main	fail, must be on main

@action-validator/cli reports no errors on release.yml.

Link to Devin session: https://app.devin.ai/sessions/f0c8f585b41d4cbaa0459bfc8d22e211
Open in Devin Desktop: https://app.devin.ai/desktop/session/f0c8f585b41d4cbaa0459bfc8d22e211?variant=devin
Requested by: @dhruva-vapi