Harden release recovery

Author: galjos

.github/workflows/release.yml

@@ -9,7 +9,9 @@ on:
       tag:
         description: Existing release tag to publish
         required: true
-        type: string
+        type: choice
+        options:
+          - v0.1.0
 
 permissions:
   contents: read
@@ -34,9 +36,16 @@ jobs:
         run: |
           git fetch --no-tags origin main:refs/remotes/origin/main
           release_sha=$(git rev-parse HEAD)
-          tag_sha=$(git rev-parse "$RELEASE_TAG^{commit}")
+          tag_object=$(git rev-parse --verify "refs/tags/${RELEASE_TAG}")
+          tag_sha=$(git rev-parse --verify "refs/tags/${RELEASE_TAG}^{commit}")
           test "$release_sha" = "$tag_sha"
           git merge-base --is-ancestor "$release_sha" origin/main
+          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
+            test "$GITHUB_REF" = "refs/heads/main"
+            test "$RELEASE_TAG" = "v0.1.0"
+            test "$tag_object" = "1bac90e875b7373fe391f7fbe359783ef545a522"
+            test "$release_sha" = "82f510c3a40aa576bfeef277dd406d42b788250b"
+          fi
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
@@ -185,6 +194,9 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.ref }}
+      - name: Verify recovery source
+        if: github.event_name == 'workflow_dispatch'
+        run: test "$(git rev-parse HEAD)" = "82f510c3a40aa576bfeef277dd406d42b788250b"
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"