Skip to content

Refuse to tag a VERSION that is not a release version - #42

Merged
bdbarnett merged 1 commit into
mainfrom
housekeeping/validate-version-before-tag
Sep 22, 2026
Merged

bdbarnett merged 1 commit into
mainfrom
housekeeping/validate-version-before-tag

Conversation

@bdbarnett

Copy link
Copy Markdown
Contributor

Fixes #32.

reusable-tag-on-release-merge.yml ran gh release create "v$V" on whatever
VERSION said. Any string that is a legal git ref became a tag and a GitHub
Release — including the placeholder a repository carries between releases,
since versions are named by hand here. audiocomponents mitigated it with a
local validate job; every other consumer is unguarded.

The check now lives in the reusable, in the step that already reads VERSION,
so consumers get it without a local job. Same grammar the prepare-release PR
and the publish chain accept: X.Y.Z[{a|b|rc}N|.devN].

How it was proved

The step is shell, so tests/test_tag_on_release_merge.py lifts the run:
body out of the YAML and runs it in a throwaway git repository under bash -e
— the shell GitHub uses — with a real GITHUB_OUTPUT. It tests the workflow's
text, not a transcription of it.

Refused (exit 1, nothing written to GITHUB_OUTPUT):
0.0.0-PLACEHOLDER-BRAD-NAMES-THIS, v0.2.0, 0.2, the empty string,
0.2.0-rc1.
Accepted (changed=true, version= set): 0.2.0, 0.2.0rc1, 0.2.0.dev1,
1.10.3b2. Two more cover the paths the guard must not disturb: a commit that
did not touch VERSION, and a version already tagged.

$ python3 -m unittest discover -s tests
Ran 24 tests in 1.725s

OK

And with the guard removed, to show the fixtures are not passing vacuously:

Ran 5 tests in 0.094s

FAILED (failures=5)
AssertionError: 0 != 1 : '0.2' was not refused

actionlint clean, ruff check scripts/ tests/ clean.

Live only at the next publishing-vN tag. Consumers pin
@publishing-v6/@publishing-v8, so nothing changes for them until a new tag
is cut, which is not mine to do. audiocomponents can drop its local
validate job when it moves to that tag; I have left it in place.

reusable-tag-on-release-merge tagged whatever VERSION said, verbatim: any
string that is a legal git ref became a tag and a GitHub Release. Versions are
named by hand everywhere in this org, so a placeholder sitting in VERSION
between releases is the normal state, and a burned tag cannot be reused.
audiocomponents mitigated this locally with a validate job; every other
consumer is unguarded.

The grammar check moves into the reusable, in the step that already reads
VERSION, so consumers get it without a local job. It is the same grammar the
prepare-release PR and the publish chain accept.

tests/test_tag_on_release_merge.py lifts the step's shell out of the YAML and
runs it in a throwaway git repository under bash -e, the shell GitHub uses.

Closes #32
@bdbarnett
bdbarnett merged commit ba795bf into main Sep 22, 2026
5 checks passed
@bdbarnett
bdbarnett deleted the housekeeping/validate-version-before-tag branch September 22, 2026 02:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

reusable-tag-on-release-merge: validate VERSION against the release grammar before tagging

1 participant