Fix immutable tag history in release clipboard qualification

.github/workflows/release.yml

@@ -104,6 +104,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           ref: ${{ github.sha }}
+          fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:

tests/test_editor_release.py

@@ -206,6 +206,15 @@ def write():
     def test_clean_reviewed_rc_accepted(self):
         self.assertEqual(M.admit_source('v0.1.0-rc.2', self.root), self.source)
 
+    def test_commit_checkout_without_tag_ref_refuses_until_history_is_present(self):
+        # Checking out the correct commit is insufficient: admission also
+        # verifies the immutable tag and its membership in public main.
+        self.git('tag', '-d', 'v0.1.0-rc.2')
+        with self.assertRaises(subprocess.CalledProcessError):
+            M.admit_source('v0.1.0-rc.2', self.root)
+        self.git('tag', 'v0.1.0-rc.2', self.source)
+        self.assertEqual(M.admit_source('v0.1.0-rc.2', self.root), self.source)
+
     def test_stable_wrong_component_and_version_tags_refused(self):
         for tag in ('main', 'v0.1.0', 'v0.2.0-rc.2', 'terraphim_lab-v0.1.1', 'v0.1.0-rc.2;echo unsafe'):
             with self.subTest(tag=tag), self.assertRaises(ValueError): M.admit_source(tag, self.root)
@@ -220,6 +229,19 @@ def test_tag_mismatch_dirty_and_unreviewed_branch_refused(self):
 
 
 class WorkflowTests(unittest.TestCase):
+    def test_every_release_admission_job_fetches_tag_and_main_history(self):
+        workflow = (Path(__file__).resolve().parents[1] / '.github/workflows/release.yml').read_text()
+        sections = {
+            'candidate': workflow.split('  candidate:', 1)[1].split('  trusted-clipboard:', 1)[0],
+            'trusted-clipboard': workflow.split('  trusted-clipboard:', 1)[1].split('  publish:', 1)[0],
+            'publish': workflow.split('  publish:', 1)[1],
+        }
+        for name, section in sections.items():
+            checkout = section.split('- uses: actions/checkout@', 1)[1].split('\n      - ', 1)[0]
+            with self.subTest(job=name):
+                self.assertIn('ref: ${{ github.sha }}', checkout)
+                self.assertIn('fetch-depth: 0', checkout)
+
     def test_only_protected_dependent_job_can_publish_exact_qualified_artifact(self):
         workflow = (Path(__file__).resolve().parents[1] / '.github/workflows/release.yml').read_text()
         build, publish = workflow.split('  publish:', 1)