Problem: The first stable CLI publication failed before GoReleaser could build because the protected release-control checkout appeared as an untracked directory in the immutable product checkout.
Root cause: Preview recovery reused an existing CLI release and never exercised GoReleaser dirty-state validation. A new stable release does, and the nested control-plane checkout made the otherwise clean product tree dirty.
Fix: Add only the exact release-control directory to the product checkout local exclude file, verify the nested checkout is ignored, and fail closed if any other product-tree dirt remains. Resolve the common Git directory absolutely so normal clones and linked worktrees behave consistently.
Verification:
- bash scripts/release-workflows.test.sh
- actionlint v1.7.7 release workflows
- bash scripts/cache-guard.sh
- bash -n scripts/release-workflows.test.sh
- git diff --check
SivanCola
04984cdfc0