[gpmayorga]

Problem

app-promote-production.yml refuses any latest release whose tag commit is not an ancestor of main. A hotfix cut from an older release tag can never pass that check, even after it is merged back, because squash merges and cherry-picks give main new commits with new SHAs.

This blocked invest-v3 v3.3.5 on 2026-10-21 (failed run):

##[error]Release v3.3.5 (49412fee…) is not on main.

v3.3.5 was cut from v3.3.3 on hotfix/basin_allow_list because main carried unreleased work (the SDK snapshot bump and others). Its two commits were already on main as squash/cherry-pick equivalents (centrifuge/apps-invest#363 and centrifuge/apps-invest#341; git cherry origin/main v3.3.5 marks both -), merged the day before the release was published. The release went out through rollback.yml instead, which has no on-main check at all.

Change

When the tag is not on main, the check now:

1. finds where the release left main (git merge-base),
2. diffs the release against that point (--binary --no-renames),
3. requires that delta to reverse-apply cleanly to main's tree (git apply --cached --check --reverse against a temporary index; nothing is written).

So a hotfix promotes only once every change it carries is on main, however it got there (squash merge, merge commit, cherry-pick, multi-commit branch squashed into one PR). Releases on main take the unchanged ancestry fast path.

Still refused, with git apply naming the files:

• a hotfix with any change not merged back (new file, edited lines, deleted file or line),
• a hotfix whose lines main has since rewritten (rollback.yml stays the escape hatch for that case),
• a tag with no shared history with main.

Also updated: the Slack failure reason, the workflow header, the README gate description (which also gains the latest-tag dispatch allowed since #14), and a CLAUDE.md note so the check is not reverted to ancestry-only.

Validation

• actionlint 1.7.7 (with shellcheck) and yamllint (relaxed, line-length off): clean.
• Ran the step's run: block, extracted from the workflow, against apps-invest history:
  • v3.3.5 vs current main: passes (hotfix delta already on main).
  • v3.3.3 vs current main: passes (on main).
  • v3.3.5 vs main before centrifuge/apps-invest#363 merged: refused, naming instantRedemptionWhitelist.ts and its test.
• Synthetic repo: multi-commit hotfix squash-merged (with a binary change and a rename) passes; main moving on elsewhere in the same file passes; empty delta passes; unmerged added file, deleted file, removed line and rewritten hotfix lines are all refused.

Rollout

No contract change: inputs, secrets and permissions are untouched, so callers need nothing. Takes effect on the next promote run after merge.

---

Generated by Claude Code