Name of Failure:

The v2.7.0 tag was published pointing at a commit that exists on no branch. This results in the following warning on v2.7.0:

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Additionally, the release process did not bump the version on master. The result was as if dry_run:true which was not the case. Despite all of this, the release had no failures.

Link to task:

https://github.com/mongodb/mongo-go-driver/actions/runs/27723314737/job/82015268412

Context of when and why the failure occurred:

As of GODRIVER-3780, then Go Driver began pinning GitHub actions to specific commit versions to satisfy security alerts concerning supply chain attacks. In GODRIVER-3797 we skip manual merge on dry run to reduce issues with running a test release. The resulting commit (9e807b4) was bumped in the Go Driver in PR #2402 (late May / early June 2026).

Why didn't this happen for the V2.6.0 release?

The commit for the release logic was pre-9e807b4.

Definition of Done

The tooling now requires users to add the following dry_run logic to release.yml, which the Go Driver did not do:

dry_run: ${{ inputs.push_changes != 'true' }}

This is not intuitive. Instead, we should give dry_run a default in the tooling so an omitted input no longer silently skips the merge-up:

dry_run:
    description: Whether this is a dry run
    default: "false"        # was: required: true

This way, when a caller omits dry_run, it resolves to "false" instead of "", so dry_run == 'false' is true and the merge-up runs.