From 133a1f1c16930a4df8a808108f87d00dba81ac3e Mon Sep 17 00:00:00 2001 From: LinYushen Date: Fri, 17 Apr 2026 22:34:25 +0800 Subject: [PATCH] ci(release): restrict tag pattern to semver and reject -dirty tags (#1280) The release workflow previously triggered on 'v*', which matched a stray 'v0.2.5-dirty' tag pushed to the repository. GoReleaser ran again and overwrote the Homebrew formula with a 0.2.5-dirty version whose tarball URLs 404. Tighten the trigger to semver-shaped tags and add an explicit guard that fails the job if the tag name contains '-dirty' (which can come from 'git describe --tags --dirty'). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/release.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c973ab4094..6445bafd36 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,7 +3,8 @@ name: Release on: push: tags: - - "v*" + - "v[0-9]+.[0-9]+.[0-9]+" + - "v[0-9]+.[0-9]+.[0-9]+-*" permissions: contents: write @@ -17,6 +18,15 @@ jobs: with: fetch-depth: 0 + - name: Validate tag name + run: | + tag="${GITHUB_REF_NAME}" + echo "Triggered by tag: $tag" + if [[ "$tag" == *-dirty* ]]; then + echo "::error::Refusing to release from dirty tag '$tag'." + exit 1 + fi + - name: Setup Go uses: actions/setup-go@v5 with: