From e9f64dbe75f45194c5d13f5ddf55d9413048313e Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Tue, 21 Jul 2026 13:55:11 -0700
Subject: [PATCH 1/3] fix(ci): release from the dispatched branch instead of a
 branch input

A reusable workflow's job definition (including the node-version test
matrix) is read from the same git ref as the caller, not from the
checked-out code. A 'branch' input could only change which code was tested,
never which matrix ran. Releasing v4.x from master would test against
master's node versions and miss v4.x-supported versions.

Drive the release off github.ref_name so v4.x's own shared-ci matrix
(18.x/20.x/22.x/24.x/latest) governs its release. Remove the misleading
'branch' input. Publish now checks out by branch name so it includes the
version-bump commit pushed by the version job (previously it checked out
the pre-bump triggering SHA).

To release v4.x, dispatch the Release workflow from the v4.x branch.
---
 .github/workflows/prod-release.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index 131370f3c..5101d2de9 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -14,10 +14,6 @@ on:
         description: 'NPM distribution tag'
         required: false
         default: 'latest'
-      branch:
-        description: 'The branch to release from'
-        required: false
-        default: 'master'
 
 env:
   NODE_OPTIONS: "--max-old-space-size=4096"
@@ -72,8 +68,11 @@ jobs:
           gh auth setup-git
 
       - name: Configure git
+        # Release the branch the workflow was dispatched from. The reusable
+        # shared-ci workflow's test matrix is read from this same ref, so the
+        # branch being released must be the ref the workflow runs on.
         env:
-          BRANCH: ${{ github.event.inputs.branch }}
+          BRANCH: ${{ github.ref_name }}
           VERSION_BUMP: ${{ github.event.inputs.version_bump }}
         run: |
           git config --global user.name "aws-crypto-tools-ci-bot"
@@ -105,7 +104,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: [pre-release-ci, version]
     steps:
+      # Check out by branch name (not the triggering SHA) so we pick up the
+      # version-bump commit the `version` job just pushed to this branch.
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref_name }}
 
       - uses: actions/setup-node@v4
         with:

From c6810e57ddd6381746668a52224c85ce1c48190c Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Tue, 21 Jul 2026 14:07:00 -0700
Subject: [PATCH 2/3] chore(ci): trim slop comments

---
 .github/workflows/prod-release.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index 5101d2de9..e8c52b567 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -68,9 +68,6 @@ jobs:
           gh auth setup-git
 
       - name: Configure git
-        # Release the branch the workflow was dispatched from. The reusable
-        # shared-ci workflow's test matrix is read from this same ref, so the
-        # branch being released must be the ref the workflow runs on.
         env:
           BRANCH: ${{ github.ref_name }}
           VERSION_BUMP: ${{ github.event.inputs.version_bump }}
@@ -104,8 +101,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [pre-release-ci, version]
     steps:
-      # Check out by branch name (not the triggering SHA) so we pick up the
-      # version-bump commit the `version` job just pushed to this branch.
+      # Include the version-bump commit the version job pushed
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.ref_name }}

From cd31491b182ef8b2032bc48f4ba1877c3d753d19 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Tue, 21 Jul 2026 14:57:37 -0700
Subject: [PATCH 3/3] fix(ci): guard release against non-branch dispatch

lerna version pushes to the branch head, so releasing from a tag or detached
commit fails. Fail fast with a clear message instead.
---
 .github/workflows/prod-release.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index e8c52b567..eec61380f 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -28,6 +28,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: [pre-release-ci]
     steps:
+      - name: Require a branch
+        if: github.ref_type != 'branch'
+        run: |
+          echo "::error::Dispatch this workflow from a branch (got ${{ github.ref_type }} '${{ github.ref_name }}'). To release a specific commit, point a branch at it first."
+          exit 1
+
       - name: Checkout code
         uses: actions/checkout@v4
         with: