release.sh resumes only its own bump PR from this repository #671

This was generated by AI during triage.

Private record: https://github.com/JacobStephens2/thirdshift/security/advisories/GHSA-7qwq-m6r7-c8jf

What to change

When scripts/release.sh <version> resumes an earlier release, find_earlier_run treats a release-<version> PR as that release's bump PR only if:

• its head branch is in this repository (the same repository as origin), and
• for an open PR, its head commit equals refs/heads/release-<version> on origin.

It also checks that the PR changes nothing except the version bump commit_bump makes: the version in Cargo.toml and Cargo.lock. Any other matching PR is refused, with a message naming it, and nothing is merged, tagged or pushed. wait_and_merge merges the PR it picked by number or URL, not by branch name.

Acceptance criteria

• An open or merged release-<version> PR whose head is in another repository is refused: nothing is merged, no tag is pushed, and the script exits 1.
• An open PR whose head differs from release-<version> on origin is refused before anything is merged.
• A resumed PR that changes anything beyond the version bump, compared with its merge base, is refused before anything is merged or tagged.
• wait_and_merge merges the selected PR by number or URL.
• The existing resume cases in tests/release.rs still pass: a branch with no PR, an open PR, a merged PR, an already tagged release, and a closed PR whose branch was deleted. New fake-gh tests cover each refusal above.

Out of scope

• The fresh-release path (commit_bump, check_can_release).
• Repository branch-protection or Actions settings.
• The release workflow and crates.io publishing.