fix: guard legacy iOS delivery refs

[altaywtf]

Summary

• Adds the protected-main half of the safe legacy beta/release dispatch contract for Restore a dispatchable legacy iOS beta and release entrypoint #162
• Companion prerequisite for Restore legacy iOS beta and release dispatch #163, which restores the default-branch entrypoints

Reviewer Guide

• Highest-risk area: the secretless validation job in .github/workflows/legacy-delivery-ref.yml
• Start with the event SHA, expected SHA, branch protection, and immutable checkout checks

Visual Aids

N/A

Changed

• Require manual dispatches to name the exact protected main SHA
• Validate the GitHub event SHA and current protected main head before entering the release Environment
• Preserve published semantic release-tag delivery and checkout its immutable event SHA
• Keep all signing and App Store secrets in the existing release Environment jobs
• Persist the existing beta TestFlight group input for the distribution step
• Reject CR/LF in TestFlight groups before the value can reach GITHUB_ENV
• Add structured YAML contract tests and update distribution documentation

Risks

• Restore legacy iOS beta and release dispatch #163 must not merge before this guard is on main; otherwise same-path direct main dispatches would bypass the default-branch relay
• A main movement between relay resolution and workflow creation fails closed before Environment access
• No GitHub Environment, secret, signing, versioning, bundle identifier, or provider configuration changes

Validation

• mise run verify
• pnpm exec tsc --noEmit
• node --test 'scripts/**/*.test.ts'
• actionlint
• pnpm install --frozen-lockfile
• Manual runtime check — intentionally deferred; no beta or release workflow was dispatched
• mise run run-simulator — not applicable; auth, keychain, and signed-in persistence are unchanged

Sanity Checks

• Direct manual main dispatch requires expected_sha to equal the workflow event SHA and current protected main head
• Published release events accept only exact semantic vX.Y.Z tag refs
• Validation has contents: read only and no Environment, secrets, checkout, or signing access
• Delivery jobs retain environment: release and check out only the validated SHA

Complexity

One reusable secretless guard is shared by the existing beta and release workflows. Delivery policy remains in those workflows; this PR adds no parallel signing or publishing implementation.

Benchmarks

N/A

Notes

The user-facing default-branch workflows and relay are in #163. Post-merge acceptance must confirm workflow registration and perform a deliberately authorized beta dispatch separately; this work does not dispatch, sign, upload, or publish anything.

[Copilot]

Pull request overview

Adds a secretless, reusable GitHub Actions guard to ensure legacy iOS beta/release deliveries only proceed when the workflow event is bound to an immutable, trusted ref (protected main head for manual dispatches, semantic vX.Y.Z tags for published releases), before entering the release Environment.

Changes:

• Introduces a reusable legacy-delivery-ref.yml workflow that validates github.ref/github.sha, protected-main head, and semantic release tag refs, and outputs an immutable SHA for checkout.
• Updates beta.yml and release.yml to require expected_sha, run the validation job first, and check out only the validated SHA in the Environment-bearing job.
• Adds Node-based YAML contract tests for workflow structure and behavior, plus supporting docs and tooling deps.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/legacy-delivery-workflows.test.ts	Adds contract tests that parse workflows and assert the validation-before-environment and immutable-checkout guarantees.
package.json	Adds yaml devDependency to support workflow contract parsing in Node tests.
pnpm-lock.yaml	Locks the new yaml@2.9.0 dependency.
docs/DISTRIBUTION.md	Updates distribution docs to describe the new protected-main SHA guard and immutable checkout behavior.
.github/workflows/beta.yml	Adds expected_sha input and gates the release Environment job behind the reusable validation job and validated checkout SHA.
.github/workflows/release.yml	Adds expected_sha input, validates refs before Environment access, and checks out the validated SHA for both manual and published-release flows.
.github/workflows/legacy-delivery-ref.yml	New reusable, secretless validation workflow producing an immutable SHA output for downstream jobs.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

.github/workflows/release.yml:35

• release.yml is triggered by both release and workflow_dispatch. Referencing inputs.expected_sha directly can be undefined for release-triggered runs, which would break the guard invocation. Use a defensive fallback so published releases pass an empty string for expected_sha.

      expected_sha: ${{ inputs.expected_sha }}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.