From 594f03ce7d67b760c216ba81cdac729b9cc699a6 Mon Sep 17 00:00:00 2001
From: Victor Garcia <Victor@structupath.ai>
Date: Thu, 29 Oct 2026 14:59:31 -0600
Subject: [PATCH] fix(release): require full validation before publishing

---
 .github/workflows/ci.yml      |  3 +++
 .github/workflows/release.yml | 37 +++++++++++++++++++++++------------
 README.md                     |  3 ++-
 3 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 774f9ae..d042f29 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
   push:
     branches:
       - main
+  # Release calls this workflow so a tag is published only after the full
+  # suite has passed on the exact commit being released.
+  workflow_call:
 
 permissions:
   contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index adaa5f0..5e7244d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,31 +15,44 @@ permissions:
   contents: read
 
 jobs:
+  # A release that skips the checks is a release nobody verified. This is the
+  # whole CI workflow — Linux, macOS, races, and the committed UI bundle — run
+  # on the commit being released, which need not be on main.
+  ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+
   release:
     name: Cross-compiled binaries
+    needs: ci
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
-      # Only the release step needs write, and only on a tag.
+      # Only the publish step needs write, and only on a pushed tag.
       contents: write
+    env:
+      # A manual run on a v* tag still only builds: publishing takes a push.
+      PUBLISH: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # `git describe` stamps the version into the binary; a shallow
-          # checkout has no tags to describe from.
-          fetch-depth: 0
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
-      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
-
-      # A release that skips the checks is a release nobody verified.
-      - name: Run all checks
-        run: just check
 
+      # Unpublished builds are named for the exact commit: a branch name can
+      # hold a slash, which would split the archive path, and a tag name on a
+      # build that is not the release would pass for one.
       - name: Build release artifacts
-        run: scripts/release.sh "${GITHUB_REF_NAME}"
+        run: |
+          if [ "$PUBLISH" = true ]; then
+            version="${GITHUB_REF_NAME}"
+          else
+            version="dev-${GITHUB_SHA}"
+          fi
+          scripts/release.sh "$version"
 
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
@@ -48,7 +61,7 @@ jobs:
           if-no-files-found: error
 
       - name: Publish the release
-        if: startsWith(github.ref, 'refs/tags/v')
+        if: env.PUBLISH == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
diff --git a/README.md b/README.md
index 4acfca9..423e97a 100644
--- a/README.md
+++ b/README.md
@@ -49,7 +49,8 @@ BASE=https://github.com/StructuPath/jig/releases/download/$VERSION
 curl -fsSLO "$BASE/jig_${VERSION}_${OS}_${ARCH}.tar.gz"
 curl -fsSLO "$BASE/SHA256SUMS"
 
-sha256sum -c SHA256SUMS --ignore-missing            # macOS: shasum -a 256 -c
+# macOS: shasum -a 256 -c SHA256SUMS --ignore-missing
+sha256sum -c SHA256SUMS --ignore-missing
 tar -xzf "jig_${VERSION}_${OS}_${ARCH}.tar.gz"
 ./jig version
 ```