From 9237d3b337bbf021498c9da79db374d596472829 Mon Sep 17 00:00:00 2001 From: Shane Engelman Date: Thu, 8 Oct 2026 10:00:15 -0700 Subject: [PATCH] fix(release): cut prerelease tags from dev release.sh required every tag to be cut from the default branch. In repositories whose default branch is stable, the documented prerelease path (vX.Y.Z-rc.N from dev) died with "not trunk 'stable'". Tags matching -rc.N now require a clean dev checkout equal to the remote dev. Release tags still require the default branch. Verified in a scratch repo: rc on dev reaches the confirm prompt, rc on stable and a release on dev or a detached HEAD are refused. Refs blacklanternsecurity/bbot-enterprise#139 --- scripts/release.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/scripts/release.sh b/scripts/release.sh index 6a581ec..9b8954e 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -14,11 +14,13 @@ git rev-parse --git-dir >/dev/null 2>&1 || die "not inside a git repository" git remote set-head "$remote" --auto >/dev/null trunk=$(git symbolic-ref --short "refs/remotes/$remote/HEAD") trunk=${trunk#"$remote/"} +source=$trunk +[[ $tag == *-rc.* ]] && source=dev branch=$(git symbolic-ref --quiet --short HEAD || true) -[ "$branch" = "$trunk" ] || die "on '${branch:-detached HEAD}', not trunk '$trunk'" +[ "$branch" = "$source" ] || die "on '${branch:-detached HEAD}', $tag is cut from '$source'" -git fetch --quiet --tags "$remote" "$trunk" -[ "$(git rev-parse HEAD)" = "$(git rev-parse "$remote/$trunk")" ] || die "local $trunk differs from $remote/$trunk" +git fetch --quiet --tags "$remote" "$source" +[ "$(git rev-parse HEAD)" = "$(git rev-parse "$remote/$source")" ] || die "local $source differs from $remote/$source" git rev-parse -q --verify "refs/tags/$tag" >/dev/null && die "tag $tag already exists" manifest() { uv run --quiet --no-project --with packaging --with pyyaml python "$here/manifest.py" "$@"; } caller=$(manifest caller) || die "no workflow here calls release-check.yml"