fix(release): verify draft ancestry using remote branch history

src/Application/Release/Port/ReleaseDraftRepository.php

@@ -10,6 +10,8 @@ interface ReleaseDraftRepository
 {
     public function branchHead(string $repository, string $branch): string;
 
+    public function isAncestor(string $repository, string $ancestorSha, string $descendantSha): bool;
+
     public function tagTarget(string $repository, string $tag): ?string;
 
     public function releaseByTag(string $repository, string $tag): ?ReleaseDraftInfo;

src/Application/Release/ReleaseDrafter.php

@@ -34,7 +34,11 @@ public function prepare(
         }
 
         $branchHead = $this->github->branchHead($prepared->repository, $prepared->branch);
-        if ($branchHead !== $prepared->finalSha && !$this->git->isAncestor($prepared->finalSha, $branchHead)) {
+        if ($branchHead !== $prepared->finalSha && !$this->github->isAncestor(
+            $prepared->repository,
+            $prepared->finalSha,
+            $branchHead,
+        )) {
             throw new DomainException(sprintf(
                 'Release branch no longer contains finalized release %s; current head is %s.',
                 $prepared->finalSha,

src/Infrastructure/GitHub/GitHubReleaseDraftRepository.php

@@ -55,6 +55,29 @@ public function branchHead(string $repository, string $branch): string
         return $sha;
     }
 
+    public function isAncestor(string $repository, string $ancestorSha, string $descendantSha): bool
+    {
+        if ($ancestorSha === $descendantSha) {
+            return true;
+        }
+
+        $data = $this->request(
+            'GET',
+            sprintf(
+                '/repos/%s/compare/%s...%s',
+                $repository,
+                rawurlencode($ancestorSha),
+                rawurlencode($descendantSha),
+            ),
+        );
+        $status = $data['status'] ?? null;
+        if (!in_array($status, ['ahead', 'behind', 'diverged', 'identical'], true)) {
+            throw new DomainException('GitHub returned an invalid commit comparison status.');
+        }
+
+        return $status === 'ahead' || $status === 'identical';
+    }
+
     public function tagTarget(string $repository, string $tag): ?string
     {
         $response = $this->client->request('GET', sprintf(