fix release environment ref evaluation

Author: maxistar

.github/workflows/create-release.yml

@@ -1,7 +1,9 @@
 name: Create Android Release
 
 on:
-  pull_request:
+  # Use the trusted base ref so release/production environment policies evaluate
+  # this post-merge run as master rather than refs/pull/<number>/merge.
+  pull_request_target:
     branches: [master]
     types: [closed]
   workflow_dispatch:
@@ -47,7 +49,7 @@ jobs:
       - name: Fetch stable history and tags
         run: git fetch origin master --tags
       - name: Require successful protected pull-request checks
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request_target'
         env:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}

scripts/test_release_workflows.py

@@ -22,11 +22,17 @@ def test_release_pr_is_read_only_and_has_no_protected_secrets(self):
 
     def test_orchestrator_only_accepts_merged_release_candidates(self):
         workflow = self.read("create-release.yml")
-        self.assertIn("pull_request:", workflow)
+        self.assertIn("pull_request_target:", workflow)
+        self.assertNotRegex(workflow, r"(?m)^  pull_request:$")
         self.assertIn("types: [closed]", workflow)
         self.assertIn("github.event.pull_request.merged == true", workflow)
         self.assertIn("startsWith(github.event.pull_request.head.ref, 'release/')", workflow)
         self.assertIn("startsWith(github.event.pull_request.head.ref, 'hotfix/')", workflow)
+        self.assertIn("if: github.event_name == 'pull_request_target'", workflow)
+        self.assertIn(
+            "ref: ${{ github.event.pull_request.merge_commit_sha || inputs.commit_sha }}",
+            workflow,
+        )
         self.assertIn("scripts/release_tool.py candidate", workflow)
         self.assertIn('gh pr checks "$PR_NUMBER" --required', workflow)
         self.assertIn("--check-play", workflow)