ci: no publish on branch creation / empty commit range

.github/workflows/vendor.yml

@@ -49,6 +49,10 @@ concurrency:
 
 jobs:
   detect:
+    # Don't publish on branch creation: pushing a new release/* branch at an
+    # existing release commit has no new commits to release (it would otherwise
+    # cut a spurious version). Manual dispatch and normal pushes still run.
+    if: ${{ github.event_name != 'push' || !github.event.created }}
     runs-on: ubuntu-latest
     outputs:
       clang: ${{ steps.scan.outputs.clang }}
@@ -293,6 +297,7 @@ jobs:
           done
 
       - name: Compute next toolchain version
+        id: ver
         env:
           FLAVOR: ${{ github.event.inputs.flavor }}
         run: |
@@ -336,29 +341,40 @@ jobs:
           elif [ -z "$latest" ]; then
             next="0.1.0"
           else
+            # No new commits since this line's latest release => nothing to
+            # publish. Skip cleanly (the later steps are gated on ver.skip) so a
+            # no-op trigger can't fall through to a bump.
+            commits="$(git rev-list "v${latest}..HEAD")"
+            if [ -z "$commits" ]; then
+              echo "no new commits since v${latest} — nothing to release"
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
             maj=$(echo "$latest" | awk -F. '{print $1+0}')
             min=$(echo "$latest" | awk -F. '{print $2+0}')
             pat=$(echo "$latest" | awk -F. '{print $3+0}')   # missing patch -> 0
             rank=0   # highest level seen: 1=patch 2=minor 3=major
             while IFS= read -r sha; do
+              [ -n "$sha" ] || continue
               msg="$(git log -1 --format=%s "$sha")"   # subject line only
               if   printf '%s' "$msg" | grep -qi '\[bump:major\]'; then lvl=3
               elif printf '%s' "$msg" | grep -qi '\[bump:minor\]'; then lvl=2
               elif printf '%s' "$msg" | grep -qi '\[bump:patch\]'; then lvl=1
               else lvl=$default_lvl; fi
               [ "$lvl" -gt "$rank" ] && rank=$lvl
-            done < <(git rev-list "v${latest}..HEAD")
+            done <<< "$commits"
             case "$rank" in
               3) next="$((maj + 1)).0.0" ;;
+              2) next="${maj}.$((min + 1)).0" ;;
               1) next="${maj}.${min}.$((pat + 1))" ;;
-              *) next="${maj}.$((min + 1)).0" ;;   # rank 2, or 0 (empty range)
             esac
           fi
           echo "TC=$next" >> "$GITHUB_ENV"
           sed -i "s|^TOOLCHAIN_VERSION=.*|TOOLCHAIN_VERSION=${next}|" build/versions.env
           echo "next toolchain version: v${next}"
 
       - name: Record checksums in versions.env
+        if: steps.ver.outputs.skip != 'true'
         run: |
           set -euo pipefail
           # Record the checksum of every binary we publish, so a consumer
@@ -380,6 +396,7 @@ jobs:
           grep -E '_SHA256_|^LIBBPF_HEADERS_SHA256=' build/versions.env
 
       - name: Tag immutable v${{ env.TC }} snapshot
+        if: steps.ver.outputs.skip != 'true'
         run: |
           set -euo pipefail
           tag="v${TC}"
@@ -401,6 +418,7 @@ jobs:
           fi
 
       - name: Publish v${{ env.TC }} release
+        if: steps.ver.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |