[rishikeshdadam136]

TICKET: WCI-2204

Description

Bind the bitgo/express Docker release build to the commit the release job published from, instead of re-resolving mutable git refs at publish time.

• release-bitgojs records and exports the publish commit SHA (publish-sha).
• get-express-release-context checks out that SHA and verifies the @bitgo/express@<version> tag resolves to a commit carrying the released express version within the published release history; the image is built from the verified tag commit, and the build fails closed otherwise.
• The release summary now shows the verified publish SHA.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

• actionlint passes on the modified workflow.
• The verification logic was exercised against a synthetic release history: legitimate releases pass; out-of-position or missing tags fail closed (6/6 scenarios).

See the Linear ticket (WCI-2204) for full details.

[linear-code]

WCI-2204

[rishikeshdadam136]

@claude review this pr

[claude]

Besides the inline finding, I looked at two other things and neither is a problem. First, an empty publish-sha: get-express-release-context lists release-bitgojs in needs and only runs when dry-run is false and that job succeeded, so the output is always set. Second, the new ${{ }} interpolations in the verify step: they only carry a git rev-parse SHA and the express version read from the checked-out package.json, not external event input.

Extended reasoning...

The change touches only .github/workflows/npmjs-release.yml, which is the release pipeline that publishes the bitgo/express Docker image. The CODEOWNERS wildcard covers that file. The inline finding already marks this PR for human review, so this body only records the two other concerns I checked and ruled out.

[rishikeshdadam136]

@claude

[rishikeshdadam136]

@claude review please

[rishikeshdadam136]

@claude review again

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}