From 9be140597763effbb37e81fb4d9d5f34bd867099 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 19:25:57 +0000
Subject: [PATCH] Release job: create the autobuild tag at the commit that was
 built

`gh release create` with no `--target` creates the tag at the default
branch's HEAD at the time the release job runs, not at inputs.build_ref,
which is what every build job checked out and what the tarballs contain.
For preview releases the tag therefore never points at the PR head it is
named after (autobuild-preview-pr-<n>-<sha8>), and for main releases it
points at whatever landed on main during the ~35 minute build (33 of the
last 186 autobuild-<sha> tags point at a commit other than <sha>).

Pass `--target "$BUILD_REF"`. build.yml and build-preview.yml both pass a
full commit sha as build_ref, which is one of the two forms --target takes;
the input description now says so. Existing tags are left as they are.
---
 .github/workflows/build-reusable.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml
index 9cfcdaa7f515..9e6df5c6e10a 100644
--- a/.github/workflows/build-reusable.yml
+++ b/.github/workflows/build-reusable.yml
@@ -7,7 +7,7 @@ on:
   workflow_call:
     inputs:
       build_ref:
-        description: 'Git ref to build (commit SHA, branch, or tag)'
+        description: 'What to build; release_tag is created at it (full commit SHA or branch name)'
         type: string
         required: true
       release_tag:
@@ -728,11 +728,14 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           TAG: ${{ inputs.release_tag }}
+          BUILD_REF: ${{ inputs.build_ref }}
           PRERELEASE: ${{ inputs.is_prerelease }}
         run: |
           set -euo pipefail
           if ! gh release view "$TAG" >/dev/null 2>&1; then
-            flags=(--title "$TAG" --generate-notes)
+            # without --target the tag is created at main's HEAD of this moment, which is never the
+            # PR head a preview was built from and is not the main commit either once something lands during the build
+            flags=(--title "$TAG" --target "$BUILD_REF" --generate-notes)
             [ "$PRERELEASE" = "true" ] && flags+=(--prerelease)
             gh release create "$TAG" "${flags[@]}"
           fi