Repository navigation
[P3][ci] Verify release tag matches package.json version before publish #41
Description
Summary
publish.yml does not verify that GitHub Release tag matches package.json version before publishing — mismatched release could ship wrong semver.
Audit ID: Section 4 Low — Wave 3
Location: .github/workflows/publish.yml:141 area
Fix
Add step before publish:
TAG="${GITHUB_REF_NAME#v}"
PKG="$(node -p 'require("./package.json").version')"
test "$TAG" = "$PKG" || { echo "Tag $TAG != package.json $PKG"; exit 1; }Handle v prefix convention consistently with existing releases.
Acceptance criteria
- Mismatch fails workflow loudly.
- No changeset.
Activity
feat: pre-announcement hardening across kernel, adapters, lenses, CLI…
cevheri commentedon Jul 3, 2026
Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.