From 98cc9d9ab322d5c47f240214f5d8394068448f55 Mon Sep 17 00:00:00 2001
From: Lee Calcote <leecalcote@gmail.com>
Date: Fri, 5 Jun 2026 01:15:54 +0000
Subject: [PATCH] fix(ci): normalize release target_commitish for bump-back PR
 base

The Publish workflow's version-bump-back step passed the release's
target_commitish straight into peter-evans/create-pull-request as `base`.
When a release carries a fully-qualified target (refs/heads/master) rather
than a bare branch name, the action tries to fetch into the currently
checked-out branch and fails with 'refusing to fetch into branch ...
checked out' (git exit 128), so the bump-back PR is never opened and master
drifts from the published npm version.

Resolve the target branch once, stripping any refs/heads/ prefix, and reuse
it for both the checkout ref and the PR base.

Signed-off-by: Lee Calcote <leecalcote@gmail.com>
---
 .github/workflows/release.yml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8fdfe6202..88092403e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,13 +29,28 @@ jobs:
       pull-requests: write  # Required to open the version-bump-back PR
       issues: write  # peter-evans/create-pull-request needs this to apply labels when falling back to GITHUB_TOKEN
     steps:
+      - name: "Resolve target branch"
+        id: target_branch
+        env:
+          # github.event.release.target_commitish can be a bare branch name
+          # ("master") or a fully-qualified ref ("refs/heads/master") depending
+          # on how the release was created. peter-evans/create-pull-request's
+          # `base` must be a short branch name; a full ref makes it try to fetch
+          # into the checked-out branch and fail with "refusing to fetch into
+          # branch ... checked out" (git exit 128). Strip the refs/heads/ prefix
+          # once here and reuse the result for both checkout and the bump PR.
+          TARGET: ${{ github.event.release.target_commitish || 'master' }}
+        run: |
+          set -euo pipefail
+          echo "name=${TARGET#refs/heads/}" >> "$GITHUB_OUTPUT"
+
       - name: Checkout code
         uses: actions/checkout@v6
         with:
           # Check out the release's target branch (typically master) so the
           # subsequent version-bump commit is based on the branch HEAD, not on
           # the tag's detached commit. Falls back to master for workflow_dispatch.
-          ref: ${{ github.event.release.target_commitish || 'master' }}
+          ref: ${{ steps.target_branch.outputs.name }}
           # fetch-depth: 0 gives peter-evans/create-pull-request a full clone so
           # it does not need to run `git fetch --depth=1 origin
           # refs/heads/master:refs/heads/master` internally.  That shallow-fetch
@@ -123,7 +138,7 @@ jobs:
           author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
           signoff: true
           branch: release/version-bump/v${{ steps.resolved_version.outputs.version }}
-          base: ${{ github.event.release.target_commitish || 'master' }}
+          base: ${{ steps.target_branch.outputs.name }}
           delete-branch: true
           title: "chore(release): bump package.json to v${{ steps.resolved_version.outputs.version }}"
           add-paths: |