ci(cd): verify tag commit is reachable from master (#439)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nanotaboada

.github/workflows/dotnet-cd.yml

@@ -25,6 +25,15 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Verify tag commit is reachable from master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "❌ Error: Tag commit ${{ github.sha }} is not reachable from origin/master"
+            echo "Ensure the PR is merged to master before pushing a release tag"
+            exit 1
+          fi
+          echo "✅ Verified: commit is reachable from master"
+
       - name: Extract version from tag
         id: version
         run: |

CHANGELOG.md

@@ -52,6 +52,8 @@ This project uses famous football stadiums (A-Z) that hosted FIFA World Cup matc
 
 ### Changed
 
+- Add "Verify tag commit is reachable from master" step to CD workflow using `git merge-base --is-ancestor` before any build or publish steps (#439)
+
 ### Fixed
 
 - `GET /players` now returns `200 OK` with an empty list `[]` when no players exist, instead of `404 Not Found` (#425)