Update validate.yml

.github/workflows/validate.yml

@@ -2,12 +2,12 @@ name: Validate Schemas
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
+    tags-ignore: ["*"]  # <- do not run this workflow for tags
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
   workflow_dispatch:
 
-# Cancel older runs of the same branch/PR
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -21,15 +21,15 @@ jobs:
     runs-on: ubuntu-latest
     env:
       FORCE_COLOR: "1"
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          # Always checkout the exact SHA for PRs/pushes
+          ref: ${{ github.sha }}
 
-      # Ensure runner uses LF and does not rewrite files
-      - name: Normalize git on runner
+      - name: Normalize git on runner (LF)
         run: |
           git config --global core.autocrlf false
           git config --global core.eol lf
@@ -49,25 +49,19 @@ jobs:
       - name: Validate examples
         run: npm run validate:examples
 
+      # Regenerate checksums only on branches (not tags)
       - name: Generate checksums
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         run: node scripts/generate-checksums.mjs schemas/v1.0.0 checksums.txt
 
-      # Helpful debug if drift occurs
-      - name: Debug checksum drift
-        if: always()
-        run: |
-          echo "::group::git status"
-          git status --porcelain || true
-          echo "::endgroup::"
-          echo "::group::diff checksums.txt"
-          git diff -- checksums.txt || true
-          echo "::endgroup::"
-
+      # Compare checksums only on branches (not tags)
       - name: Verify checksums are current
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         run: git diff --exit-code checksums.txt
 
+      # Upload artifact on failure to help debug
       - name: Upload checksums artifact (for debugging)
-        if: failure() || cancelled()
+        if: always()
         uses: actions/upload-artifact@v4
         with:
           name: checksums.txt