From 37b6228884d455208deee425c27039581abf3ef8 Mon Sep 17 00:00:00 2001 From: merefield Date: Mon, 24 Aug 2026 12:42:47 +0100 Subject: [PATCH 1/2] FIX: harden cross-platform release validation --- .github/workflows/release.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ce733fb..6d36907 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -75,6 +75,16 @@ jobs: with: fetch-depth: 0 ref: ${{ needs.validate.outputs.tag }} + - name: Verify validated commit + shell: bash + env: + EXPECTED_COMMIT: ${{ needs.validate.outputs.commit }} + run: | + actual_commit=$(git rev-parse HEAD) + if [[ "$actual_commit" != "$EXPECTED_COMMIT" ]]; then + echo "Release tag changed after validation." + exit 1 + fi - uses: actions/setup-go@v7 with: go-version-file: go.mod @@ -96,6 +106,8 @@ jobs: run: go vet ./... - name: Test run: go test -race ./... + - name: Build + run: go build -buildvcs=false -trimpath ./cmd/termcourse - name: Validate release configuration if: runner.os == 'Linux' uses: goreleaser/goreleaser-action@v7 From ec515491fde0bc69eae3e5cbcbc07af00230d0a8 Mon Sep 17 00:00:00 2001 From: merefield Date: Mon, 24 Aug 2026 14:48:50 +0100 Subject: [PATCH 2/2] FIX: improve release commit diagnostics --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6d36907..05207af 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -82,7 +82,8 @@ jobs: run: | actual_commit=$(git rev-parse HEAD) if [[ "$actual_commit" != "$EXPECTED_COMMIT" ]]; then - echo "Release tag changed after validation." + printf 'Release tag changed after validation (expected %s, got %s).\n' \ + "$EXPECTED_COMMIT" "$actual_commit" >&2 exit 1 fi - uses: actions/setup-go@v7