fix(release): gate on the last released tag, not the working tree

The gate asked whether anything moved since the last commit, so a
regeneration committed by hand left a clean tree and the next scheduled
run reported success while skipping every publish step. Nothing alerts,
because skipping is what the gate exists to do.

Compare the spec at the last release tag against the freshly regenerated
copy instead, which answers whether what is published was built from the
current spec. This needs fetch-depth 0, since the default checkout
fetches no tags and a missing tag reads as never released.

Author: ph33nx

.github/workflows/release.yml

@@ -23,6 +23,10 @@ jobs:
       - uses: actions/checkout@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          # Release tags are the ledger the gate below reads. The default shallow
+          # checkout fetches none of them, which would make every run look like a
+          # first release.
+          fetch-depth: 0
 
       - uses: astral-sh/setup-uv@v7
         with:
@@ -35,13 +39,28 @@ jobs:
       - name: Regenerate SDK from live spec
         run: uv run python generate.py
 
-      - name: Check if spec changed
+      # Compare against the last RELEASED tag, never against the working tree.
+      # "Did anything change since the last commit" is the wrong question: commit a
+      # regeneration by hand and the next run sees a clean tree, reports success and
+      # silently skips every publish step below, leaving the registry behind forever.
+      # The tag cannot lie, because whatever is published is what that tag built.
+      # The spec is the only generator input, so it is the only thing worth diffing;
+      # a generator version bump changes the output without touching the spec and is
+      # released deliberately through workflow_dispatch.
+      - name: Is the published release built from the current spec?
         id: diff
         run: |
-          if git diff --quiet specs/openapi.json src/roxy_sdk/factory.py; then
-            echo "changed=false" >> $GITHUB_OUTPUT
+          LAST=$(git describe --tags --abbrev=0 --match 'v*' 2>/dev/null || true)
+          if [ -z "$LAST" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git show "$LAST:specs/openapi.json" | jq -cS . > "$RUNNER_TEMP/released-spec.json"
+          jq -cS . specs/openapi.json > "$RUNNER_TEMP/current-spec.json"
+          if cmp -s "$RUNNER_TEMP/released-spec.json" "$RUNNER_TEMP/current-spec.json"; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
           else
-            echo "changed=true" >> $GITHUB_OUTPUT
+            echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Lint