From 818029e7b25f336eaf55618ced10521a780aacb2 Mon Sep 17 00:00:00 2001 From: cypherair <262752927+cypherair@users.noreply.github.com> Date: Sat, 12 Sep 2026 21:36:44 -0700 Subject: [PATCH] Derive the stable tag check from the pinned SQLCIPHER_TAG The tag check hardcoded the upstream version, so every SQLCipher bump silently invalidated stable releases until the workflow was edited too. It now reads the pinned tag from scripts/build-sqlcipher-xcframework.sh. RELEASE_TAG is set at job level so the failure cleanup step can run when validation fails before exporting it. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/stable-release.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/stable-release.yml b/.github/workflows/stable-release.yml index 084442f..d13453e 100644 --- a/.github/workflows/stable-release.yml +++ b/.github/workflows/stable-release.yml @@ -14,6 +14,7 @@ jobs: build-and-publish: runs-on: macos-26 env: + RELEASE_TAG: ${{ github.ref_name }} RELEASE_METADATA: SQLCipher.xcframework.release.json RELEASE_ASSETS: >- SQLCipher.xcframework.zip @@ -38,8 +39,14 @@ jobs: echo "::error::Stable SQLCipher release workflow must run from a tag." exit 1 fi - if ! printf '%s' "$RELEASE_TAG" | grep -Eq '^sqlcipher-xcframework-v4\.17\.0-cypherair\.[0-9]+$'; then - echo "::error::Unexpected stable SQLCipher release tag: $RELEASE_TAG" + expected_upstream_tag="$(sed -n 's/^SQLCIPHER_TAG="\${SQLCIPHER_TAG:-\(v[0-9][0-9.]*\)}"$/\1/p' scripts/build-sqlcipher-xcframework.sh)" + if [ -z "$expected_upstream_tag" ]; then + echo "::error::Could not read the pinned SQLCIPHER_TAG from scripts/build-sqlcipher-xcframework.sh" + exit 1 + fi + expected_pattern="^sqlcipher-xcframework-${expected_upstream_tag//./\\.}-cypherair\.[0-9]+$" + if ! printf '%s' "$RELEASE_TAG" | grep -Eq "$expected_pattern"; then + echo "::error::Unexpected stable SQLCipher release tag: $RELEASE_TAG (expected sqlcipher-xcframework-${expected_upstream_tag}-cypherair.)" exit 1 fi