From 9b86eef64d6c7ad9b7d1fc7c96337a6aa0ddb240 Mon Sep 17 00:00:00 2001
From: Bruno Devic <bruno.devic@parity.io>
Date: Fri, 27 Mar 2026 19:41:03 +0100
Subject: [PATCH 1/3] Add safe.directory in failure handler

---
 .github/workflows/release-80_publish-crates.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release-80_publish-crates.yml b/.github/workflows/release-80_publish-crates.yml
index 46308989891b8..c0468d04b5610 100644
--- a/.github/workflows/release-80_publish-crates.yml
+++ b/.github/workflows/release-80_publish-crates.yml
@@ -379,6 +379,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           echo "Job failed. Pushing branch '$CRATES_RELEASE_BRANCH' to origin (paritytech-release) to preserve state for resume..."
+          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
           # Restore origin to the fork repo in case it was changed by the upstream push step
           git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git"
           git push origin "$CRATES_RELEASE_BRANCH" --force-with-lease

From 97c4af5dd7ff37d16da6c6afcb537a3a3f061cbc Mon Sep 17 00:00:00 2001
From: Bruno Devic <bruno.devic@parity.io>
Date: Fri, 27 Mar 2026 19:44:18 +0100
Subject: [PATCH 2/3] Remove safe.directory from failure handler

---
 .github/workflows/release-80_publish-crates.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/release-80_publish-crates.yml b/.github/workflows/release-80_publish-crates.yml
index c0468d04b5610..46308989891b8 100644
--- a/.github/workflows/release-80_publish-crates.yml
+++ b/.github/workflows/release-80_publish-crates.yml
@@ -379,7 +379,6 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           echo "Job failed. Pushing branch '$CRATES_RELEASE_BRANCH' to origin (paritytech-release) to preserve state for resume..."
-          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
           # Restore origin to the fork repo in case it was changed by the upstream push step
           git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git"
           git push origin "$CRATES_RELEASE_BRANCH" --force-with-lease

From 6190ccca86d1926adff10b219ce42c758717e797 Mon Sep 17 00:00:00 2001
From: Bruno Devic <bruno.devic@parity.io>
Date: Sat, 28 Mar 2026 00:30:40 +0100
Subject: [PATCH 3/3] Move validate step after configure git

---
 .../workflows/release-80_publish-crates.yml   | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/release-80_publish-crates.yml b/.github/workflows/release-80_publish-crates.yml
index 46308989891b8..a4fe5ad3dff5e 100644
--- a/.github/workflows/release-80_publish-crates.yml
+++ b/.github/workflows/release-80_publish-crates.yml
@@ -117,19 +117,6 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Validate resume preconditions
-        if: inputs.resume_from != 'full'
-        shell: bash
-        env:
-          CRATES_RELEASE_BRANCH: ${{ steps.derive_branch.outputs.CRATES_RELEASE_BRANCH }}
-          RESUME_FROM: ${{ inputs.resume_from }}
-        run: |
-          if ! git branch -r --list "origin/$CRATES_RELEASE_BRANCH" | grep -q "$CRATES_RELEASE_BRANCH"; then
-            echo "❌ ::error::Cannot resume from '$RESUME_FROM': branch '$CRATES_RELEASE_BRANCH' does not exist on remote. Use 'full' for a fresh run."
-            exit 1
-          fi
-          echo "Release branch '$CRATES_RELEASE_BRANCH' exists on remote. Resuming from '$RESUME_FROM'."
-
       - name: Import GPG keys
         shell: bash
         run: |
@@ -148,6 +135,19 @@ jobs:
           git config --global user.email "release-team@parity.io"
           git config --global user.signingKey "D8018FBB3F534D866A45998293C5FB5F6A367B51"
 
+      - name: Validate resume preconditions
+        if: inputs.resume_from != 'full'
+        shell: bash
+        env:
+          CRATES_RELEASE_BRANCH: ${{ steps.derive_branch.outputs.CRATES_RELEASE_BRANCH }}
+          RESUME_FROM: ${{ inputs.resume_from }}
+        run: |
+          if ! git branch -r --list "origin/$CRATES_RELEASE_BRANCH" | grep -q "$CRATES_RELEASE_BRANCH"; then
+            echo "❌ ::error::Cannot resume from '$RESUME_FROM': branch '$CRATES_RELEASE_BRANCH' does not exist on remote. Use 'full' for a fresh run."
+            exit 1
+          fi
+          echo "Release branch '$CRATES_RELEASE_BRANCH' exists on remote. Resuming from '$RESUME_FROM'."
+
       - name: Create or switch to release branch
         shell: bash
         env: