ci(release): run the full CI on the tag before building a release

ci.yml is now callable with a ref to test. The release workflow calls it on the prepared tag and both build jobs wait for it, so a tag whose sources fail tests, lint or the build publishes nothing. A called run gets its own concurrency group and is never cancelled. The release steps now push main and wait for green CI before pushing the tag.

.github/workflows/ci.yml

@@ -4,13 +4,23 @@ on:
   push:
     branches: [main, feat/tauri-port]
   pull_request:
+  # The release workflow runs this on the tag before it builds anything.
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to check out and test (defaults to the triggering commit)'
+        type: string
+        required: false
 
 permissions:
   contents: read
 
+# A called run takes the caller's workflow name and the ref it was given, so
+# it never shares a group with a push or PR run. It is never cancelled
+# either: a newer push must not abort the checks a release waits on.
 concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
+  group: ci-${{ github.workflow }}-${{ inputs.ref || github.ref }}
+  cancel-in-progress: ${{ !inputs.ref }}
 
 jobs:
   build:
@@ -22,6 +32,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -88,6 +100,8 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
 
       - uses: dtolnay/rust-toolchain@stable
 

.github/workflows/release.yml

@@ -73,9 +73,19 @@ jobs:
             exit 1
           fi
 
+  # Nothing is built for release from a tag whose sources fail CI.
+  verify:
+    name: CI on the tag
+    needs: prepare
+    permissions:
+      contents: read
+    uses: ./.github/workflows/ci.yml
+    with:
+      ref: ${{ needs.prepare.outputs.tag }}
+
   win-x64:
     name: Windows x64
-    needs: prepare
+    needs: [prepare, verify]
     runs-on: windows-latest
     # The updater signing key decides what every installed client will
     # install, so only the steps that check or use it see it: never
@@ -135,7 +145,7 @@ jobs:
 
   linux-x64:
     name: Linux x64
-    needs: prepare
+    needs: [prepare, verify]
     runs-on: ubuntu-22.04
     # As on Windows, only the steps that check or use the signing key see it.
     steps: