ci(cd): verify tag commit is reachable from master (#549)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nanotaboada

.github/workflows/python-cd.yml

@@ -24,6 +24,15 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Verify tag commit is reachable from master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Error: Tag commit ${{ github.sha }} is not reachable from master."
+            echo "Tags must only be created from master after the release PR is merged."
+            exit 1
+          fi
+          echo "Verified: tag commit ${{ github.sha }} is reachable from master."
+
       - name: Extract version from tag
         id: version
         run: |

CHANGELOG.md

@@ -44,6 +44,9 @@ This project uses famous football coaches as release codenames, following an A-Z
 
 ### Added
 
+- CD workflow now verifies tag commit is reachable from `master` before
+  proceeding with build and publish steps (#549)
+
 ### Changed
 
 - `GET /players/` cache check changed from `if not players` to

tests/conftest.py

@@ -2,6 +2,7 @@
 import pytest
 from fastapi.testclient import TestClient
 from main import app
+from tests.player_stub import nonexistent_player
 
 # Suppress the DeprecationWarning from httpx
 warnings.filterwarnings("ignore", category=DeprecationWarning)
@@ -20,3 +21,17 @@ def client():
     """
     with TestClient(app) as test_client:
         yield test_client
+
+
+@pytest.fixture(scope="function")
+def nonexistent_player_in_db(client):
+    """
+    Creates the nonexistent player in the database and removes it on teardown.
+
+    Yields:
+        Player: The player stub created in the database.
+    """
+    player = nonexistent_player()
+    client.post("/players/", json=player.__dict__)
+    yield player
+    client.delete(f"/players/squadnumber/{player.squad_number}")

tests/test_main.py

@@ -194,13 +194,17 @@ def test_request_post_player_body_nonexistent_response_status_created(client):
     """POST /players/ with nonexistent player returns 201 Created with a valid UUID"""
     # Arrange
     player = nonexistent_player()
-    # Act
-    response = client.post(PATH, json=player.__dict__)
-    # Assert
-    assert response.status_code == 201
-    body = response.json()
-    assert "id" in body
-    assert UUID(body["id"]).version == 4  # UUID v4 (API-created)
+    try:
+        # Act
+        response = client.post(PATH, json=player.__dict__)
+        # Assert
+        assert response.status_code == 201
+        body = response.json()
+        assert "id" in body
+        assert UUID(body["id"]).version == 4  # UUID v4 (API-created)
+    finally:
+        # Teardown — remove the created player
+        client.delete(PATH + "squadnumber/" + str(player.squad_number))
 
 
 # PUT /players/squadnumber/{squad_number} --------------------------------------
@@ -278,11 +282,12 @@ def test_request_delete_player_squadnumber_unknown_response_status_not_found(cli
     assert response.status_code == 404
 
 
-def test_request_delete_player_squadnumber_existing_response_status_no_content(client):
+def test_request_delete_player_squadnumber_existing_response_status_no_content(
+    client, nonexistent_player_in_db
+):
     """DELETE /players/squadnumber/{squad_number} with existing number returns 204 No Content"""
-    # Arrange — create the player to be deleted
-    player = nonexistent_player()
-    client.post(PATH, json=player.__dict__)
+    # Arrange
+    player = nonexistent_player_in_db
     # Act
     response = client.delete(PATH + "squadnumber/" + str(player.squad_number))
     # Assert