fix(release-ceremony): order trust checks before repository-code execution in release workflow #13

Summary

base's .github/workflows/release.yml runs ./scripts/release-check release "$GITHUB_REF_NAME" (the Validate release tag step) BEFORE the git-only trust checks (Require annotated tag and Require tag target on main). Surfaced during agentd#129 cycle 2 (PR tesserine/agentd#130) and verified to exist in base@8dceb451.

A user with tag-push permissions creates a v-prefixed tag pointing at a commit with a modified scripts/release-check. The workflow checks out that commit and executes the modified script with the job's contents: write token before the main-ancestry check rejects the tag. Arbitrary code execution before trust validation.

The other four repos (runa, groundwork, commons, ops) were audited and already order trust checks before any repository-code execution; only base has the defect.

Constraints

• Reorder .github/workflows/release.yml so trust-establishing primitives (annotated tag check, main-ancestry check) run BEFORE any step that executes repository code (release-check, container build, image build, GitHub Release publication).
• Corrected order: Checkout → Require annotated tag → Require tag target on main → Validate release tag (release-check) → install/build/verify/publish.
• Surface restriction propagation: extend scripts/release-check's metadata validation to reject workflows where validation steps appear before trust checks (same metadata enforcement agentd#129 added).
• Pre-trust primitives are git-only commands: git cat-file, git rev-parse, git fetch, git merge-base. These operate on git objects and don't execute repository files. Repository-code execution starts when the workflow invokes scripts, binaries, or build tools from the checked-out tree.

Acceptance criteria

• .github/workflows/release.yml step ordering places trust checks before any repository-code execution.
• scripts/release-check metadata enforces the security ordering invariant — rejects a workflow shape where validation runs pre-trust.
• Workflow-shape regression test (analogous to agentd's workspace_contract test) asserts the ordering invariant.
• CHANGELOG.md entry documenting the security correction.
• RELEASING.md describes "early validation" as early-after-trust, not pre-trust.

Reference implementation

tesserine/agentd@1e6281ee — fix landed via PR #130 with reorder + metadata validator extension + regression coverage. Direct port to base's substrate, adapted for base's non-cargo helper-script pattern (test substrate is bash, not Rust).

Predecessor

• feat(release-ceremony): adopt ecosystem release ceremony tooling in base #10 (landed) — original release-ceremony adoption that introduced the ordering defect
• fix(release-ceremony): align workflow tag pattern with minimatch and tighten regex to SemVer grammar agentd#129 (landed) — surfaced and fixed the same defect in agentd
• epic(release-ceremony): adopt ecosystem release ceremony for multi-repo coordination commons#21 — parent release-ceremony epic