@@ -124,22 +124,34 @@ jobs:
124124 git config user.name "github-actions[bot]"
125125 git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
126126
127- - name : Commit version bump + push tag
127+ - name : Verify release PR contained version bump
128128 if : steps.label.outputs.should-release == 'true'
129129 env :
130130 NEW_VERSION : ${{ steps.version.outputs.new-version }}
131- BUMP : ${{ steps.label.outputs.bump }}
132- PR_NUMBER : ${{ github.event.pull_request.number }}
133131 run : |
134132 set -euo pipefail
133+ # Main's branch protection requires all changes via PR — the workflow
134+ # cannot push a version-bump commit. The release PR MUST already
135+ # contain the sync-versions.sh output (run it locally before opening
136+ # the PR). sync-versions.sh is re-run above as a sanity check; if it
137+ # produced diff, the PR was missing the bump.
135138 git add -u
136- if git diff --cached --quiet; then
137- echo "No manifest changes from sync-versions.sh — unexpected; aborting"
139+ if ! git diff --cached --quiet; then
140+ echo "::error::PR merged with release:${{ steps.label.outputs.bump }} label but VERSIONS/manifests are out of sync with tag v${NEW_VERSION}."
141+ echo "::error::Before opening a release PR, run: scripts/sync-versions.sh ${NEW_VERSION} → commit → open PR → merge with release label."
142+ git diff --cached
138143 exit 1
139144 fi
140- git commit -m "chore: release v${NEW_VERSION} (${BUMP} bump from PR #${PR_NUMBER})"
145+ echo "::notice::Manifests already bumped to v${NEW_VERSION} in the release PR."
146+
147+ - name : Push tag to trigger release.yml
148+ if : steps.label.outputs.should-release == 'true'
149+ env :
150+ NEW_VERSION : ${{ steps.version.outputs.new-version }}
151+ run : |
152+ set -euo pipefail
153+ # Tags are not subject to branch protection, so the workflow token can push them.
141154 git tag "v${NEW_VERSION}"
142- git push origin main
143155 git push origin "v${NEW_VERSION}"
144156 echo "::notice::Pushed tag v${NEW_VERSION} — release.yml will now build and create a draft release"
145157
0 commit comments