Problem
.github/workflows/release.yml publishes on v* tags and also supports workflow_dispatch, but it only extracts .version from package.json. It never asserts that github.ref_name is v${version}, nor that a manual dispatch is running from a tag.
That leaves two release-integrity failure modes:
- a mistyped or stale tag can publish artifacts whose embedded/package version disagrees with the GitHub release tag;
- a manual dispatch from
mainor another branch can reach the Pantry/NPM publish steps whilegithub.ref_nameis a branch name.
This was found during the release-readiness audit following #254, #242, and #220. It is outside those issue lanes.
Evidence
- trigger:
push.tags: v*plus unrestrictedworkflow_dispatch - version source:
jq -r .version package.json - release/verification identity:
github.ref_name - no equality/ref-type guard exists before either publish path
Suggested acceptance criteria
- Before any build or publish, require a tag ref.
- Require the tag to equal
vplus the canonical workspace version. - Verify all publishable package manifests and
packages/zig/build.zig.zoncarry that same version. - Fail with a diagnostic naming every mismatch.
- Keep manual reruns possible by dispatching against an existing tag.
- Add a deterministic test/script for matching, mismatched, malformed, and branch-ref inputs.