ci: require releases to be tagged on a release/v* branch

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'release/v*']
   pull_request:
   workflow_dispatch:
 

.github/workflows/release.yml

@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
       - run: |
           set -euo pipefail
           crate=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
@@ -44,6 +46,15 @@ jobs:
               echo "::error::tag $GITHUB_REF_NAME does not match manifest version $crate"
               exit 1
             fi
+            # Releases are cut from release/vX.Y (or release/vX.Y.Z), never from main.
+            minor=$(printf '%s' "$GITHUB_REF_NAME" | cut -d. -f1,2)
+            git fetch --quiet origin '+refs/heads/release/v*:refs/remotes/origin/release/v*'
+            branches=$(git branch -r --contains "$GITHUB_SHA" --list 'origin/release/v*' | sed 's/^ *//')
+            echo "release branches containing $GITHUB_SHA: ${branches:-none}"
+            if ! printf '%s\n' "$branches" | grep -Fxq -e "origin/release/$minor" -e "origin/release/$GITHUB_REF_NAME"; then
+              echo "::error::tag $GITHUB_REF_NAME is not on release/$minor or release/$GITHUB_REF_NAME"
+              exit 1
+            fi
           fi
 
   crate:

AGENTS.md

@@ -19,6 +19,11 @@ A release is a docs event too. When you tag `vX.Y.Z`, open an issue on datahub-s
 start names the latest release, and a new minor version gets a frozen snapshot of the docs. The
 rules are in that repository's `AGENTS.md`, under "Versions".
 
+Releases are cut from a release branch, not from `main`. Tag `vX.Y.Z` on a commit of
+`release/vX.Y` (one branch per minor line; `release/vX.Y.Z` is also accepted). `release.yml`
+refuses to publish a tag that no matching release branch contains, so push the branch before the
+tag. CI runs on pushes to `main` and `release/v*`.
+
 ## Build / Test
 
 ```