From 0463bc74d307e95212b5b931d0f9cc917f17327a Mon Sep 17 00:00:00 2001 From: Felipe Freitag Date: Tue, 22 Sep 2026 14:18:30 -0300 Subject: [PATCH 1/2] chore: release stable versions only from commits merged into main A stable v* tag on a commit that is not on main now fails the ci job before anything is built. Prerelease tags are not checked. The checkout fetches full history so git merge-base can answer the question. --- .github/workflows/release.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 33588a7..59dbea0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,6 +18,8 @@ jobs: stable: ${{ steps.meta.outputs.stable }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + fetch-depth: 0 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.14" @@ -54,6 +56,15 @@ jobs: with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf8") as output: output.write(f"stable={stable}\n") EOF + - name: Verify the release commit is on ${{ github.event.repository.default_branch }} + if: github.ref_type == 'tag' && steps.meta.outputs.stable == 'true' + env: + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} + run: | + if ! git merge-base --is-ancestor "$GITHUB_REF_NAME" "origin/$DEFAULT_BRANCH"; then + echo "::error::$GITHUB_REF_NAME is not on $DEFAULT_BRANCH. Tag a stable release on a commit that was merged into $DEFAULT_BRANCH." + exit 1 + fi - name: Install dependencies run: pip install tox build - name: Lint From 606b5b53b88a018f8fb9862ae9b562c634554fd8 Mon Sep 17 00:00:00 2001 From: Felipe Freitag Date: Tue, 22 Sep 2026 14:34:40 -0300 Subject: [PATCH 2/2] chore: compare HEAD against the fully qualified remote branch ref A bare origin/main resolves tags before remote-tracking branches, so a tag named origin/main could satisfy the check. HEAD is the commit the package is built from and is pinned by the checkout. --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 59dbea0..a949fd3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -61,7 +61,7 @@ jobs: env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} run: | - if ! git merge-base --is-ancestor "$GITHUB_REF_NAME" "origin/$DEFAULT_BRANCH"; then + if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/$DEFAULT_BRANCH"; then echo "::error::$GITHUB_REF_NAME is not on $DEFAULT_BRANCH. Tag a stable release on a commit that was merged into $DEFAULT_BRANCH." exit 1 fi