chore: merge main into feat/pkg-inventory

.github/workflows/release.yml

@@ -84,6 +84,32 @@ jobs:
             exit 1
           fi
 
+      - name: Check out release controller and Git history
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Node.js for checkpoint validation
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+
+      - name: Install checkpoint validation dependencies
+        run: npm ci
+
+      - name: Validate checkpoint version and ancestry before release creation
+        env:
+          RELEASE_PHASE: ${{ inputs.phase }}
+          RELEASE_BRANCH: ${{ inputs.release_branch }}
+          SOURCE_SHA: ${{ steps.branch.outputs.sha }}
+        run: >-
+          node scripts/verify-release-checkpoint.mjs
+          --phase "$RELEASE_PHASE" --release-branch "$RELEASE_BRANCH"
+          --source-sha "$SOURCE_SHA"
+
       - uses: googleapis/release-please-action@v4
         id: release
         with:
@@ -116,6 +142,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Node.js for generated documentation
@@ -129,6 +156,16 @@ jobs:
         if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
         run: npm ci
 
+      - name: Validate prepared release version and migration notes
+        if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
+        env:
+          RELEASE_BRANCH: ${{ inputs.release_branch }}
+          SOURCE_SHA: ${{ steps.branch.outputs.sha }}
+        run: >-
+          node scripts/verify-release-checkpoint.mjs
+          --phase prepare --stage candidate --release-branch "$RELEASE_BRANCH"
+          --source-sha "$SOURCE_SHA"
+
       - name: Regenerate release documentation
         if: inputs.phase == 'prepare' && steps.release.outputs.prs_created == 'true'
         run: npm run docs:generate