[xeaser]

Why

v0.4.0 published twice on 2026-08-17. The first run tagged feature-branch SHA dcc54e6 while PR #4 was still open (and lint was red). The second run retagged the squash-merge on main.

Tag-push events do not include a source branch, so branches: [main] cannot express this.

What

• release.yml: fail loudly if GITHUB_SHA is not an ancestor of origin/main, then wait up to 20 minutes for ci.yml on that SHA, then GoReleaser.
• ci.yml / release.yml: setup-go reads go.mod instead of a hardcoded 1.26.6.
• CONTRIBUTING.md: how to cut a release (tag the main/squash commit, not the feature-branch SHA).

Beads: squad-h7s.1. No admin override. No tag ruleset.

Test plan

CI on this PR is the go-version-file check.

Do not push a real product tag from this branch.

Safe checks after merge:

1. Local ancestor check (no publish):

   git fetch origin main
   git merge-base --is-ancestor <feature-sha> origin/main; echo exit:0
   git merge-base --is-ancestor origin/main origin/main; echo exit:0
   

   Feature SHA after a squash must be non-zero; origin/main must be zero.

2. Negative live test (after this is on main): tag a commit that is not on main with a throwaway name such as v0.0.0-guard-test, push the tag, confirm the release job goes red on the ancestor step and GoReleaser does not run, then delete that tag (it never published).

3. Happy path: next real v* on the main SHA after ci is green — same as today's cut, with the wait-for-ci step.