From 4a57b8d491e4d23b2e2ae7fec382b09c79fd0081 Mon Sep 17 00:00:00 2001 From: myselfsiddharth Date: Sat, 22 Aug 2026 23:47:05 -0700 Subject: [PATCH] ci(release): fail when the tag and package.json version disagree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The tag decides when to publish; package.json decides what version is published. Nothing tied the two together, so `git tag v0.2.0` on a tree still saying 0.1.0 would publish 0.1.0 under a tag claiming otherwise — or fail at the registry as "already published", after the token had already been used. Found while pre-flighting the first release: a stale `v0.1.0` tag from 2026-08-09 already exists on main (commit 90f66c6, well behind current HEAD), and it predates release.yml, so it never fired. Whoever cuts the real release has to pick a new version, which is exactly the situation this guard covers. Verified both branches locally against the real package.json: v0.1.0 passes, v0.2.0 refuses. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3d5599e..15d0432 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,6 +28,22 @@ jobs: - name: Install run: npm ci + # The tag decides *when* to publish; package.json decides *what* version + # is published. Nothing tied the two together, so `git tag v0.2.0` on a + # tree still saying 0.1.0 would publish 0.1.0 — or fail as "already + # published" — with the tag claiming otherwise. Fail before the registry + # call instead, while it is still free to fix. + - name: Tag must match package.json version + run: | + tag_version="${GITHUB_REF_NAME#v}" + pkg_version="$(node -p "require('./package.json').version")" + if [ "$tag_version" != "$pkg_version" ]; then + echo "tag ${GITHUB_REF_NAME} implies version ${tag_version}," >&2 + echo "but package.json says ${pkg_version}. Bump package.json or retag." >&2 + exit 1 + fi + echo "publishing ${pkg_version} from tag ${GITHUB_REF_NAME}" + - name: Verify pack contents run: | npm pack --dry-run 2>&1 | tee /tmp/pack.txt