bahdotsh ef407a4273 ci(release): add --locked to builds and guard changelog tag lookup ...

The release builds were running without --locked, which means cargo
is free to re-resolve dependencies however it pleases. For a release
binary, that's *not great* — you want reproducible builds from the
exact Cargo.lock that was committed, not whatever cargo feels like
doing today.

While at it, the changelog generation was silently falling through
to the "list all commits" path if the release tag wasn't found in
the tag list. Now it emits a ::warning annotation so you at least
know something went sideways instead of staring at a suspiciously
long changelog wondering where it all came from.

2026-04-02 16:29:38 +05:30

..

ci.yml

ci: harden CI permissions and fix release tag validation

2026-04-02 16:26:16 +05:30

release.yml

ci(release): add --locked to builds and guard changelog tag lookup

2026-04-02 16:29:38 +05:30