check-release-tag.yml

name: Check release tag

on:
  workflow_call:
    inputs:
      version:
        type: string
        required: false
      skip_validation:
        type: boolean
        default: false
    outputs:
      version:
        description: "Resolved release version"
        value: ${{ jobs.check.outputs.version }}

jobs:
  check:
    name: Validate tag against .version file and release content
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.resolve.outputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Validate tag matches .version file
        id: resolve
        env:
          REF_TYPE: ${{ github.ref_type }}
          INPUT_VERSION: ${{ inputs.version }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          if [[ "$REF_TYPE" != "tag" ]]; then
            echo "::notice::Not triggered by a tag push (ref_type=$REF_TYPE); skipping .version check."
            echo "version=$INPUT_VERSION" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if [[ ! -f .version ]]; then
            echo "::error::.version file not found in repository root."
            exit 1
          fi

          FILE_VERSION="$(tr -d '[:space:]' < .version)"
          TAG_VERSION="$REF_NAME"

          if [[ "$TAG_VERSION" != "$FILE_VERSION" ]]; then
            echo "::error::Tag '$TAG_VERSION' does not match version in .version file ('$FILE_VERSION'). Refusing to release."
            exit 1
          fi

          echo "Tag '$TAG_VERSION' matches .version file."
          echo "version=$TAG_VERSION" >> "$GITHUB_OUTPUT"

      - name: Validate release
        if: ${{ !inputs.skip_validation }}
        env:
          RESOLVED_VERSION: ${{ steps.resolve.outputs.version }}
        run: tools/check-release.sh "--version=$RESOLVED_VERSION"