From c061dae4f956879204ab49590169d22a2c516063 Mon Sep 17 00:00:00 2001
From: Josh Radcliff <jradcliff@users.noreply.github.com>
Date: Wed, 23 Sep 2026 10:42:34 -0400
Subject: [PATCH] ci(release): default DRY_RUN to true and validate boolean
 values

Default DRY_RUN to "true" in .kokoro/release.sh when unset so that
unparameterized or local builds cannot accidentally trigger a live
release. Also validate at the start of the script that DRY_RUN is
strictly "true" or "false" before building or modifying Artifact
Registry staging packages.

Change-Id: I5affb0f87a27e9271e1d80efc151f8dc788865ff
---
 .kokoro/release.cfg |  2 +-
 .kokoro/release.sh  | 11 +++++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.kokoro/release.cfg b/.kokoro/release.cfg
index e2deabd..9f0a8df 100644
--- a/.kokoro/release.cfg
+++ b/.kokoro/release.cfg
@@ -2,7 +2,7 @@
 
 build_file: "github/data-manager-node/.kokoro/release.sh"
 
-# Default to DRY_RUN=true for safety; can be overridden via Stubby/Kokoro API
+# Default to DRY_RUN=true for safety; can be overridden via API or UI
 env_vars: {
   key: "DRY_RUN"
   value: "true"
diff --git a/.kokoro/release.sh b/.kokoro/release.sh
index c07eb16..ffa0bd1 100755
--- a/.kokoro/release.sh
+++ b/.kokoro/release.sh
@@ -1,13 +1,20 @@
 #!/bin/bash
 set -euo pipefail
 
+# Default to dry-run for safety unless DRY_RUN=false is explicitly passed.
+DRY_RUN="${DRY_RUN:-true}"
+if [[ "${DRY_RUN}" != "true" && "${DRY_RUN}" != "false" ]]; then
+  echo "ERROR: DRY_RUN must be 'true' or 'false' (got '${DRY_RUN}')." >&2
+  exit 1
+fi
+
 # -----------------------------------------------------------------------------
 # 1. Workspace & Directory Resolution
 # -----------------------------------------------------------------------------
 REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "${REPO_DIR}"
 
-echo "=== Building and Releasing from: ${REPO_DIR} ==="
+echo "=== Building and Releasing from: ${REPO_DIR} (DRY_RUN=${DRY_RUN}) ==="
 
 # -----------------------------------------------------------------------------
 # 2. Environment & Tooling Setup
@@ -79,7 +86,7 @@ npx google-artifactregistry-auth
 
 # If DRY_RUN is set to "true", stop here so you can verify the process without
 # consuming the version and without publishing to public npm.
-if [[ "${DRY_RUN:-false}" == "true" ]]; then
+if [[ "${DRY_RUN}" == "true" ]]; then
   echo "=== DRY_RUN is enabled. Skipping Artifact Registry and manifest upload."
   echo "===   Uploading to Artifact Registry would claim the current version,  "
   echo "===   preventing us from actually releasing it via DRY_RUN=false.      "