[miguel-heygen]

What

bun run release:prepare and changelog:draft now draft from the remote's main, fetched at that moment, and print the commit they drafted from. A clone that cannot see the last tag's commit stops with a message instead of drafting.

Why

The draft covered last tag..HEAD of whatever the checkout held. A checkout a few commits behind drafted notes that left out merged work, and the release PR needed a redo each time main moved: three rounds on one release. The check that a release PR "contains" main only ran after the PR was open.

Related work

No open issue.

How

When no --to is given and the release tag does not exist yet, fetchDraftHead() runs git fetch origin main --tags --force, prints Drafting from origin/main at <sha>, and drafts up to origin/main. --to and --from still override. assertHasCommit() checks that the baseline commit exists in the clone and fails with a plain message if not. The existing skipped-tag check is unchanged.

What I measured

• scripts/draft-changelog.test.ts: 19 of 19. The new test builds a remote, a checkout that is one commit behind it, copies the scripts into that checkout and runs the draft; both the commit the checkout had and the one it lacked appear in the notes.
• fails without the fix: scripts/draft-changelog.test.ts "lists what merged on the remote since the checkout was last pulled" fails on main (the later commit is missing from the notes); the other 18 tests pass either way.

What I did NOT exercise

• A clone that really lacks the baseline commit: assertHasCommit has no test of its own.
• A remote not named origin: the script still assumes origin, as the push instructions in set-version.ts do; use --to there.
• A real release run end to end.

Test plan

• Unit tests added/updated
• Manual testing performed
• Documentation updated (if applicable)
• Comments follow CONTRIBUTING.md "Comments": they say why, not what

[heygengenesis]

Approving at 4b9e1e54.

The "fails without the fix" line checks out. With scripts/draft-changelog.ts reverted to the parent commit, "lists what merged on the remote since the checkout was last pulled" fails: the notes don't mention "merged after the pull". At this head the file passes 19/19.

Design: this fixes the cause of today's #7655 redos. CI's --verify in scripts/ci/release-only-diff.mjs checks the notes against the commits on main (HEAD^1 of the merge ref), not against the release branch's own base. So notes drafted from a freshly fetched origin/main pass the gate even if the local checkout the branch is cut from is a few commits behind. The tag is created at the merge SHA on main, so the notes match what actually ships. --to/--from still override, and when the version tag already exists the fetch is skipped, so a local tag can't be clobbered by --tags --force mid-release.

CI is green on this head: CI, Windows render verification, regression, preview-regression, Player perf, and CodeQL.

Non-blocking:

• assertHasCommit only catches a missing baseline commit. A shallow clone that has the tag commit but not the history between it and main would still pass that check and list the wrong commits. A git rev-parse --is-shallow-repository check would close this, but it doesn't affect a normal checkout.
• If main moves between drafting and merging, Release checks will still fail. That's correct, and expected.