From 689cdd111294563c94ae9831877a3eb0a0ca00ff Mon Sep 17 00:00:00 2001
From: Kevin Longe <273747162+kvlonge@users.noreply.github.com>
Date: Thu, 1 Oct 2026 17:29:25 +0100
Subject: [PATCH] ci(release): merge a release pull request only while main is
 unchanged

---
 .github/workflows/release-please.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index e4b2a4b414..0869c385bb 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -215,4 +215,16 @@ jobs:
           # The delivery app merges, so the resulting push to main starts the tag and publish runs.
           GH_TOKEN: ${{ steps.delivery-token.outputs.token }}
           RELEASE_PR: ${{ needs.release-please.outputs.release_pr }}
-        run: gh pr merge "${RELEASE_PR}" --repo "${GITHUB_REPOSITORY}" --auto --squash
+          PROCESSED_SHA: ${{ github.sha }}
+        run: |
+          # A commit merged to main while these checks ran is not in this release pull request yet.
+          # Its own Release Please run is queued behind this one and refreshes and re-checks the
+          # pull request, so merging now would tag a release whose changelog omits that commit.
+          main_sha="$(gh api "repos/${GITHUB_REPOSITORY}/commits/main" --jq .sha)"
+          if [[ "${main_sha}" != "${PROCESSED_SHA}" ]]; then
+            gh pr merge "${RELEASE_PR}" --repo "${GITHUB_REPOSITORY}" --disable-auto 2>/dev/null || true
+            echo "main moved from ${PROCESSED_SHA} to ${main_sha}; leaving the merge to the queued run" \
+              >> "${GITHUB_STEP_SUMMARY}"
+            exit 0
+          fi
+          gh pr merge "${RELEASE_PR}" --repo "${GITHUB_REPOSITORY}" --auto --squash