fix(ci): publish an explicit qualification run

[alongubkin]

Summary

• accept an optional qualification run ID for stable publication
• require it to be numeric and identify a successful Release qualification run
• retain all existing manifest source/version/tree, artifact checksum, and image digest verification
• preserve automatic PR-head discovery for the normal publication path

Validation

• parsed workflow YAML
• verified run 30548395023 reports workflow Release qualification and conclusion success
• its manifest remains subject to the existing exact df0b29fe source/tree checks before publication

Linear: ALIEN-411

[greptile-apps]

Qualification source identity is overwritten

When an explicit run ID selects the successful qualification created for a release PR head, this branch replaces that run's source SHA with the distinct merged commit SHA. The subsequent manifest comparison rejects the valid run with Qualified artifact set does not match the merged release tree, and image verification would likewise look for a tag based on the wrong SHA.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 358

Comment:
**Qualification source identity is overwritten**

When an explicit run ID selects the successful qualification created for a release PR head, this branch replaces that run's source SHA with the distinct merged commit SHA. The subsequent manifest comparison rejects the valid run with `Qualified artifact set does not match the merged release tree`, and image verification would likewise look for a tag based on the wrong SHA.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Greptile Summary

Adds an optional explicit qualification-run selector for stable publication.

• Exposes the run ID through reusable and manually dispatched workflow inputs.
• Validates that the input is numeric and names a successful Release qualification run.
• Retains manifest metadata, artifact checksum, and image digest verification.
• Preserves automatic qualification-run discovery when no explicit ID is supplied.

Confidence Score: 4/5

This PR should not merge until explicit publication preserves the selected qualification run's actual source SHA.

A normal release qualification records the PR head SHA, but the new explicit-run branch compares it against the distinct merged commit SHA, causing the feature's intended publication path to fail before artifacts can be published.

Files Needing Attention: .github/workflows/release.yml

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds explicit qualification-run selection, but binds validation to the merge commit and therefore rejects the normal PR-head qualification run.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Input[Explicit qualification run ID] --> Validate[Validate successful Release qualification run]
  Validate --> Select[Select run artifacts]
  Select --> Assign[Set HEAD_SHA to merged release commit]
  Assign --> Manifest[Read manifest headSha recorded from qualification source]
  Manifest --> Compare{Manifest headSha equals HEAD_SHA?}
  Compare -->|PR qualification: no| Fail[Reject publication]
  Compare -->|Merged-commit requalification: yes| Verify[Verify checksums and image digests]

Loading

Prompt To Fix All With AI

### Issue 1
.github/workflows/release.yml:358
**Qualification source identity is overwritten**

When an explicit run ID selects the successful qualification created for a release PR head, this branch replaces that run's source SHA with the distinct merged commit SHA. The subsequent manifest comparison rejects the valid run with `Qualified artifact set does not match the merged release tree`, and image verification would likewise look for a tag based on the wrong SHA.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(ci): publish an explicit qualificati..." | Re-trigger Greptile}