fix: honour the merged PR version label on a default-branch dispatch

A workflow_dispatch on the default branch is the documented recovery route for
a failed or cancelled release run. Pull request association was gated on
$isPush, so a dispatch resolved no pull request, saw no version label, and
silently applied the AutoPatching patch fallback.

Widen the gate to cover a manual dispatch on the default branch, so the same
association and selection path runs for the same merge commit.

Also fail loudly when a merged default-branch pull request is associated with
the commit but does not match it, instead of falling back to a patch bump. A
wrong version published to the PowerShell Gallery cannot be reclaimed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 2 people

.github/actions/Get-PSModuleSettings/src/Get-PSModuleSettings.Helpers.psm1

@@ -109,6 +109,103 @@ function Select-PullRequestForPush {
         Select-Object -First 1
 }
 
+function Test-ShouldResolveAssociatedPullRequest {
+    <#
+        .SYNOPSIS
+        Decides whether a commit's associated pull request must be resolved from the GitHub API.
+
+        .DESCRIPTION
+        A push to any branch resolves its associated pull request so a default-branch release
+        honours the merged pull request's version label. A manual dispatch on the default branch is
+        the documented recovery route for a failed or cancelled release run and targets the same
+        merge commit, so it must resolve the same pull request. Excluding it left the pull request
+        null and silently downgraded a labelled Major or Minor release to a Patch bump.
+
+        .OUTPUTS
+        Boolean. True when the association lookup must run.
+
+        .EXAMPLE
+        Test-ShouldResolveAssociatedPullRequest -IsPush $false -IsManualDispatchToDefaultBranch $true -CommitSha 'abc123'
+
+        Returns $true, because a default-branch dispatch releases the same commit a push would.
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        # Whether the workflow was triggered by a push event.
+        [Parameter()]
+        [bool] $IsPush,
+
+        # Whether the workflow was manually dispatched against the default branch.
+        [Parameter()]
+        [bool] $IsManualDispatchToDefaultBranch,
+
+        # The commit the workflow is resolving a release for.
+        [Parameter()]
+        [string] $CommitSha
+    )
+
+    ($IsPush -or $IsManualDispatchToDefaultBranch) -and -not [string]::IsNullOrWhiteSpace($CommitSha)
+}
+
+function Get-DiscardedReleasePullRequest {
+    <#
+        .SYNOPSIS
+        Reports merged default-branch pull requests whose version label would be discarded.
+
+        .DESCRIPTION
+        Select-PullRequestForPush returns nothing both when a commit has no associated pull request
+        and when every associated pull request fails its criteria. Only the first case is safe: a
+        commit pushed directly to the default branch has no label to honour, so the direct-release
+        path applies the default patch bump.
+
+        The unsafe case is a pull request that was merged into the default branch, and therefore
+        carries the version label that was meant to drive the release, but was not selected because
+        its merge commit does not match the commit being released. Falling back to a patch bump
+        there publishes a version nobody asked for, and a PowerShell Gallery version cannot be
+        reclaimed, so the caller must fail instead.
+
+        Pull requests that are not merged are ignored. The GitHub commit association endpoint also
+        returns open pull requests whose branch contains the commit, which is expected and carries
+        no release intent.
+
+        .OUTPUTS
+        String, one description per merged pull request that was rejected. Nothing when the
+        associated pull requests carry no release intent.
+
+        .EXAMPLE
+        Get-DiscardedReleasePullRequest -PullRequest $associated -DefaultBranch main -CommitSha $sha
+
+        Returns '#412 was merged into [main] with merge commit [abc123]'.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        # The pull requests the GitHub API associated with the commit.
+        [Parameter()]
+        [object[]] $PullRequest,
+
+        # The repository default branch a release must target.
+        [Parameter(Mandatory)]
+        [string] $DefaultBranch,
+
+        # The commit the workflow is resolving a release for.
+        [Parameter(Mandatory)]
+        [string] $CommitSha
+    )
+
+    foreach ($candidate in ($PullRequest | Where-Object { $null -ne $_ })) {
+        $isMergedToDefaultBranch = (
+            $candidate.Base.Ref -eq $DefaultBranch -and
+            -not [string]::IsNullOrWhiteSpace($candidate.merged_at)
+        )
+        if (-not $isMergedToDefaultBranch) { continue }
+        if ($candidate.merge_commit_sha -eq $CommitSha) { continue }
+
+        "#$($candidate.Number) was merged into [$DefaultBranch] with merge commit [$($candidate.merge_commit_sha)]"
+    }
+}
+
 function Get-FilesFromGitTree {
     <#
         .SYNOPSIS

.github/actions/Get-PSModuleSettings/src/main.ps1

@@ -242,19 +242,52 @@ LogGroup 'Calculate Job Run Conditions:' {
     $isManualDispatchToDefaultBranch = $isManualDispatch -and $workflowRef -eq $defaultBranch
     $pullRequest = $eventData.PullRequest
 
-    if ($isPush -and $commitSha) {
+    # A manual dispatch on the default branch is the documented recovery route for a failed or
+    # cancelled release run. It targets the same merge commit as the push it replaces, so it must
+    # resolve the same pull request and honour the same version label. Gating this lookup on
+    # $isPush alone left $pullRequest null for a dispatch, which silently downgraded a labelled
+    # Major or Minor release to a Patch bump through the AutoPatching fallback.
+    $shouldResolvePullRequest = Test-ShouldResolveAssociatedPullRequest -IsPush $isPush `
+        -IsManualDispatchToDefaultBranch $isManualDispatchToDefaultBranch `
+        -CommitSha $commitSha
+    if ($shouldResolvePullRequest) {
         LogGroup "Resolve pull request for commit [$commitSha]" {
             $owner = $env:GITHUB_REPOSITORY_OWNER
             $repo = $env:GITHUB_REPOSITORY_NAME
             $response = Invoke-GitHubAPI -ApiEndpoint "/repos/$owner/$repo/commits/$commitSha/pulls" -Method GET
-            $associatedPullRequests = @($response.Response)
+            $associatedPullRequests = @($response.Response | Where-Object { $null -ne $_ })
             $pullRequest = Select-PullRequestForPush -PullRequest $associatedPullRequests `
                 -DefaultBranch $defaultBranch `
                 -CommitSha $commitSha
 
             if ($pullRequest) {
                 Write-Host "Resolved pull request #$($pullRequest.Number) from commit [$commitSha]."
             } else {
+                # Distinguish 'no pull request carries release intent' from 'a merged default-branch
+                # pull request exists but was not selected'. The first is a legitimate direct push to
+                # the default branch, which the direct-release path handles with the default patch
+                # bump. The second means the commit carries a version label that would be discarded,
+                # and a wrong version published to the PowerShell Gallery cannot be reclaimed, so
+                # fail loudly instead. Only release-bearing events are checked; a push to a feature
+                # branch has no release to get wrong.
+                $isReleaseEvent = $isPushToDefaultBranch -or $isManualDispatchToDefaultBranch
+                $discardedPullRequests = if ($isReleaseEvent) {
+                    @(Get-DiscardedReleasePullRequest -PullRequest $associatedPullRequests `
+                            -DefaultBranch $defaultBranch `
+                            -CommitSha $commitSha)
+                } else {
+                    @()
+                }
+                if ($discardedPullRequests.Count -gt 0) {
+                    throw (
+                        "Commit [$commitSha] cannot be released because its version label cannot be determined. " +
+                        'The following merged pull request(s) are associated with it but none matches the commit ' +
+                        "being released: $($discardedPullRequests -join '; '). " +
+                        'Refusing to fall back to a patch bump, because a wrong version published to the ' +
+                        'PowerShell Gallery cannot be reclaimed. Re-run the workflow against the merge commit ' +
+                        'of the pull request you intend to release.'
+                    )
+                }
                 Write-Host "::notice::No pull request is associated with commit [$commitSha]."
             }
         }