@@ -88,6 +88,28 @@ jobs:
8888ref: ${{ inputs.tag }}
8989fetch-depth: 0
909091+ - name: Validate Tideclaw alpha preflight target
92+if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')
93+env:
94+RELEASE_REF: ${{ inputs.tag }}
95+WORKFLOW_REF: ${{ github.ref }}
96+run: |
97+ set -euo pipefail
98+ if [[ ! "${RELEASE_REF}" == *"-alpha."* && ! "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then
99+ echo "Tideclaw alpha preflight runs must target an alpha prerelease tag or SHA." >&2
100+ exit 1
101+ fi
102+ if [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
103+ echo "Tideclaw alpha preflight runs must run from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2
104+ exit 1
105+ fi
106+ alpha_branch="${WORKFLOW_REF#refs/heads/}"
107+ git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
108+ if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/${alpha_branch}"; then
109+ echo "Alpha preflight target must be reachable from ${alpha_branch}." >&2
110+ exit 1
111+ fi
112+91113 - name: Setup Node environment
92114uses: ./.github/actions/setup-node-env
93115with:
@@ -347,13 +369,19 @@ jobs:
347369permissions:
348370contents: read
349371steps:
350- - name: Require main or release workflow ref for publish
372+ - name: Require trusted workflow ref for publish
351373env:
374+RELEASE_TAG: ${{ inputs.tag }}
375+RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
352376WORKFLOW_REF: ${{ github.ref }}
353377run: |
354378 set -euo pipefail
355- if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]]; then
356- echo "Real publish runs must be dispatched from main or release/YYYY.M.D. Use preflight_only=true for other branch validation."
379+ tideclaw_alpha_publish=false
380+ if [[ "${RELEASE_TAG}" == *"-alpha."* && "${RELEASE_NPM_DIST_TAG}" == "alpha" && "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
381+ tideclaw_alpha_publish=true
382+ fi
383+ if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]] && [[ "${tideclaw_alpha_publish}" != "true" ]]; then
384+ echo "Real publish runs must be dispatched from main, release/YYYY.M.D, or a Tideclaw alpha branch for alpha prereleases. Use preflight_only=true for other branch validation."
357385 exit 1
358386 fi
359387@@ -409,6 +437,28 @@ jobs:
409437ref: refs/tags/${{ inputs.tag }}
410438fetch-depth: 0
411439440+ - name: Validate Tideclaw alpha publish target
441+if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')
442+env:
443+RELEASE_TAG: ${{ inputs.tag }}
444+WORKFLOW_REF: ${{ github.ref }}
445+run: |
446+ set -euo pipefail
447+ if [[ ! "${RELEASE_TAG}" == *"-alpha."* ]]; then
448+ echo "Tideclaw alpha publish runs must target an alpha prerelease tag." >&2
449+ exit 1
450+ fi
451+ if [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
452+ echo "Tideclaw alpha publish runs must run from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2
453+ exit 1
454+ fi
455+ alpha_branch="${WORKFLOW_REF#refs/heads/}"
456+ git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
457+ if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/${alpha_branch}"; then
458+ echo "Alpha publish tag must be reachable from ${alpha_branch}." >&2
459+ exit 1
460+ fi
461+412462 - name: Setup Node environment
413463uses: ./.github/actions/setup-node-env
414464with:
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。