Base the bump on the commit the suite tested

propose_bump checked out the default branch tip at bump time, not the tree the
test job ran against. The four-platform matrix takes tens of minutes; a default
branch that advances meanwhile puts the new engine pin on binding code nothing
tested, while the pull request body says the suite passed. github.sha is fixed
for the whole run, so checking that out makes the claim true.

Rooting the branch there means it can be behind the default branch, which is
honest and what GitHub already shows. It also reintroduces the case the previous
commit removed — a manual run from a branch that is not the default one would
carry that branch;s other changes into the bump — so the compare API decides:
identical or behind means the tested commit is on the default branch, anything
else declines to propose. Verified the three statuses against real refs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ShawnChen-Sirius

.github/workflows/engine-release-check.yml

@@ -90,11 +90,14 @@ jobs:
     outputs:
       pr: ${{ steps.bump.outputs.pr }}
     steps:
-      # Explicitly the default branch. A manual run from some other branch would
-      # otherwise root the bump there and open the pull request against it.
+      # The commit the suite actually ran against, not whatever the default branch
+      # has become since. github.sha is fixed for the whole run, so this is the
+      # same tree the test job exercised; a default branch that moved during a
+      # long matrix would otherwise put the new pin on untested code while the
+      # pull request claims the suite passed.
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.repository.default_branch }}
+          ref: ${{ github.sha }}
 
       - id: bump
         name: Open a PR moving the pin to this engine
@@ -114,6 +117,17 @@ jobs:
               exit 1 ;;
           esac
 
+          # A manual run from a branch that is not the default one would carry that
+          # branch's other changes into the bump. "behind" means the tested commit
+          # is an ancestor of the default branch; "identical" means it is the tip.
+          rel=$(gh api "repos/$GITHUB_REPOSITORY/compare/$DEFAULT_BRANCH...$GITHUB_SHA" --jq .status)
+          case "$rel" in
+            identical|behind) ;;
+            *)
+              echo "tested commit $GITHUB_SHA is $rel relative to $DEFAULT_BRANCH; not proposing a bump"
+              exit 0 ;;
+          esac
+
           current=$(grep -E '^CHDB_ENGINE_PIN=' update_libchdb.sh | cut -d= -f2)
           if [ "$current" = "$ENGINE_VERSION" ]; then
             echo "already pinned to $ENGINE_VERSION, nothing to propose"
@@ -158,6 +172,8 @@ jobs:
             echo
             echo "$RUN_URL"
             echo
+            echo "Based on $GITHUB_SHA, the commit that run tested."
+            echo
             echo "No checks will appear here. GitHub does not start workflow runs for"
             echo "commits a workflow pushed with \`GITHUB_TOKEN\`, and running CI on this"
             echo "branch would exercise the same tests against the same engine the check"