Release workflow fails for backport tags because `check-release-notes` runs from the tag checkout

[rwgk]

Description

When running the CI: Release workflow from main for a backport release tag, the check-release-notes job can fail before it actually checks the release notes.

Example workflow run:

• https://github.com/NVIDIA/cuda-python/actions/runs/26492939119

The run was manually dispatched from main with:

• git-tag: v12.9.7
• component: cuda-bindings

The job failed with:

Run python ci/tools/check_release_notes.py \
+ python ci/tools/check_release_notes.py --git-tag v12.9.7 --component cuda-bindings
python: can't open file '/home/runner/work/cuda-python/cuda-python/ci/tools/check_release_notes.py': [Errno 2] No such file or directory
Error: Process completed with exit code 2.

Root cause

The check-release-notes job checks out the release tag:

- name: Checkout Source
  uses: actions/checkout@...
  with:
    ref: ${{ inputs.git-tag }}

For v12.9.7, that means the job checks out the 12.9.x backport branch commit:

v12.9.7 -> a4e89b567d7fa367414b2a1fb1e2bcb706124967

That commit does not contain ci/tools/check_release_notes.py. The checker was added later on main in:

• CI: Check versioned release notes exist before releasing #1907

As a result, the release workflow definition from main tries to run a helper script that exists on main, but the job workspace has already been replaced with the older backport tag checkout.

Why this is different from #2062

This is related to, but different from:

• [BUG] CI: "Self-test release-notes checker" fails due to root conftest.py import error #2062

Issue #2062 was about the Self-test release-notes checker step failing because pytest ci/tools/tests imported the repo-level conftest.py, which required cuda.pathfinder. That issue was worked around by commenting out the self-test step in:

• [no-ci] Prepare for cuda.core v1.0.1 release #2073

The current failure happens after that step is skipped/commented out. It fails in the actual Check versioned release notes exist step because the checker script is not present in the checked-out release tag.

Expected behavior

The release workflow should be able to validate release notes for older/backport tags, even when the helper script was introduced after the release branch diverged.

In this scenario, it should either:

• run the checker from the workflow branch/ref, while checking release-note files in the release-tag checkout; or
• avoid running the checker for tags whose checked-out source tree does not contain the checker; or
• otherwise make the check-release-notes job robust for backport releases.

Suggested fix

Use separate checkouts for the workflow tooling and the release source tree. For example:

1. Checkout the workflow ref/current branch normally so ci/tools/check_release_notes.py is available.
2. Checkout ${{ inputs.git-tag }} into a subdirectory such as release-src.
3. Run the checker from the workflow checkout, but pass the release checkout as --repo-root:

python ci/tools/check_release_notes.py \
  --repo-root release-src \
  --git-tag "${{ inputs.git-tag }}" \
  --component "${{ inputs.component }}"

This keeps the validation logic on main, while validating the release-note files that actually belong to the release tag.

Additional context

The current v12.9.7 release attempt needs this path because v12.9.7 is a backport release from 12.9.x, while the release workflow being dispatched from main includes newer release-checking infrastructure.