From 5d43fc670a1d66eed7d98bfe9f575b8da73984c4 Mon Sep 17 00:00:00 2001 From: 514sid Date: Wed, 4 Nov 2026 06:42:52 +0000 Subject: [PATCH 1/2] Check the release tag against the manifest instead of overwriting it build.yaml and test.yaml wrote the tag version over the committed manifest, so the version in the repo was never the one that shipped and nothing noticed when they differed. The manifests are now copied into the build unchanged, and a tag build in build.yaml fails when the tag does not equal the manifest version. Branch and PR builds now carry the manifest version instead of 0.0.0. --- .github/workflows/build.yaml | 17 +++++++++++------ .github/workflows/test.yaml | 11 +---------- CONTRIBUTING.md | 8 +++----- 3 files changed, 15 insertions(+), 21 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 15a2848..2023f85 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -26,16 +26,21 @@ jobs: uses: actions/checkout@v7 - name: Prepare manifest.json + env: + MANIFEST: src/manifest-${{ matrix.platform }}.json run: | + # The committed manifest carries the version. A tag build ships it as + # is, so the tag has to match it. if [[ $GITHUB_REF == refs/tags/v* ]]; then - export SCREENLY_CE_VERSION=${GITHUB_REF#refs/tags/v} - else - export SCREENLY_CE_VERSION="0.0.0" + TAG_VERSION=${GITHUB_REF#refs/tags/v} + MANIFEST_VERSION=$(jq -r .version "$MANIFEST") + if [[ "$TAG_VERSION" != "$MANIFEST_VERSION" ]]; then + echo "::error::Tag v$TAG_VERSION does not match $MANIFEST version $MANIFEST_VERSION. Bump both manifests on master, then tag that commit." + exit 1 + fi fi - cat src/manifest-${{ matrix.platform }}.json \ - | jq --arg version "$SCREENLY_CE_VERSION" '.version = $version' \ - > src/manifest.json + cp "$MANIFEST" src/manifest.json - name: Build Docker images run: | diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 8490cac..965726b 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -23,16 +23,7 @@ jobs: uses: actions/checkout@v7 - name: Prepare manifest.json - run: | - if [[ $GITHUB_REF == refs/tags/v* ]]; then - export SCREENLY_CE_VERSION=${GITHUB_REF#refs/tags/v} - else - export SCREENLY_CE_VERSION="0.0.0" - fi - - cat src/manifest-${{ matrix.platform }}.json \ - | jq --arg version "$SCREENLY_CE_VERSION" '.version = $version' \ - > src/manifest.json + run: cp src/manifest-${{ matrix.platform }}.json src/manifest.json - name: Build Docker images run: | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1d46fcc..282bce5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -44,11 +44,9 @@ which is what `build.yaml` triggers on. both on `master` first, then tag that commit, and keep the tag and the manifests equal. -Nothing checks that yet. `build.yaml` and `test.yaml` still derive `.version` -from the git ref and write it over the manifest on the way into the build, which -is how the committed number came to differ from every released one. Replacing -that with a check is a follow-up; until it lands, the tag and the manifests -agreeing is a convention rather than a guarantee. +`build.yaml` enforces this: a tag build fails when the tag does not equal the +manifest version, and the manifests are copied into the build unchanged, so +what you commit is what ships. `package.json` is the build tooling's own manifest (`sce-webpack`, `private`), not the extension's. Its version is unrelated and is not bumped for a release. From b81c33f1248c15168acdf231452d353de954b61b Mon Sep 17 00:00:00 2001 From: 514sid Date: Wed, 4 Nov 2026 06:49:34 +0000 Subject: [PATCH 2/2] Check the tag against both manifests before either build starts The check ran inside each matrix job, so a tag that matched only one manifest let the job for that platform go on to create the release while the other failed. A separate check-version job now compares the tag with both manifests, and the build jobs need it. It runs on every trigger and exits early off tags, so branch and PR builds are not skipped. --- .github/workflows/build.yaml | 43 +++++++++++++++++++++++------------- CONTRIBUTING.md | 7 +++--- 2 files changed, 32 insertions(+), 18 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 2023f85..a3349aa 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -11,9 +11,36 @@ on: tags: - v*.* jobs: + check-version: + runs-on: ubuntu-latest + name: Check Tag Matches Manifests + steps: + - name: Checkout + uses: actions/checkout@v7 + + - name: Compare the tag with both manifests + run: | + # The committed manifests carry the version and ship as is, so a tag + # build has to match both before either platform can be released. + if [[ $GITHUB_REF != refs/tags/v* ]]; then + exit 0 + fi + + TAG_VERSION=${GITHUB_REF#refs/tags/v} + STATUS=0 + for MANIFEST in src/manifest-chrome.json src/manifest-firefox.json; do + MANIFEST_VERSION=$(jq -r .version "$MANIFEST") + if [[ "$TAG_VERSION" != "$MANIFEST_VERSION" ]]; then + echo "::error::Tag v$TAG_VERSION does not match $MANIFEST version $MANIFEST_VERSION. Bump both manifests on master, then tag that commit." + STATUS=1 + fi + done + exit $STATUS + build: runs-on: ubuntu-latest name: Build and Generate Artifact + needs: check-version permissions: id-token: write contents: write @@ -26,21 +53,7 @@ jobs: uses: actions/checkout@v7 - name: Prepare manifest.json - env: - MANIFEST: src/manifest-${{ matrix.platform }}.json - run: | - # The committed manifest carries the version. A tag build ships it as - # is, so the tag has to match it. - if [[ $GITHUB_REF == refs/tags/v* ]]; then - TAG_VERSION=${GITHUB_REF#refs/tags/v} - MANIFEST_VERSION=$(jq -r .version "$MANIFEST") - if [[ "$TAG_VERSION" != "$MANIFEST_VERSION" ]]; then - echo "::error::Tag v$TAG_VERSION does not match $MANIFEST version $MANIFEST_VERSION. Bump both manifests on master, then tag that commit." - exit 1 - fi - fi - - cp "$MANIFEST" src/manifest.json + run: cp src/manifest-${{ matrix.platform }}.json src/manifest.json - name: Build Docker images run: | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 282bce5..7818a03 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -44,9 +44,10 @@ which is what `build.yaml` triggers on. both on `master` first, then tag that commit, and keep the tag and the manifests equal. -`build.yaml` enforces this: a tag build fails when the tag does not equal the -manifest version, and the manifests are copied into the build unchanged, so -what you commit is what ships. +`build.yaml` enforces this: on a tag, a check job compares the tag with both +manifests and the builds only start once it passes, so a mismatch stops the +release for both platforms. The manifests are copied into the build unchanged, +so what you commit is what ships. `package.json` is the build tooling's own manifest (`sce-webpack`, `private`), not the extension's. Its version is unrelated and is not bumped for a release.