Repository navigation
Validate release tags before running release steps - #5356
Merged
Merged
Conversation
Require the documented version format, pass versions through step environments, and cover the release sequence with local simulations. Assisted-by: GitHub Copilot (model: gpt-6.1-sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The quoted-tag test fails under Git-for-Windows Bash before reaching workflow validation because Windows disallows double quotes in loose-ref filenames.
1 open issue
What changed in this PR
This PR hardens Spec Kit’s release workflow by validating release tags before running release commands and passing the validated version to subsequent shell steps as data.
Changes:
- Reject malformed tags before publishing the version output.
- Replace direct version interpolation with environment variables.
- Document validation behavior and add tests for valid tags, malformed inputs, and release-step sequencing.
| File | Description |
|---|---|
| tests/test_github_workflows.py | Adds tag-validation, injection-safety, and release-sequence tests. |
| .github/workflows/release.yml | Validates tags and passes versions through environment variables. |
| .github/workflows/RELEASE-PROCESS.md | Documents early validation and safe version handling. |
Review effort: Balanced (auto)
Limit the platform skip to the real-tag simulation and retain quoted-tag coverage in shell-only validation. Assisted-by: GitHub Copilot (model: gpt-6.1-sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
kevinnguyenhoang91
pushed a commit
to kevinnguyenhoang91/spec-kit
that referenced
this pull request
Nov 10, 2026
* Validate release tags before running release steps Require the documented version format, pass versions through step environments, and cover the release sequence with local simulations. Assisted-by: GitHub Copilot (model: gpt-6.1-sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Skip quoted loose-ref simulation on Windows Limit the platform skip to the real-tag simulation and retain quoted-tag coverage in shell-only validation. Assisted-by: GitHub Copilot (model: gpt-6.1-sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Require release tags to match the documented
vMAJOR.MINOR.PATCHformat and stop the release job immediately when a tag is malformed. Pass the validated version to subsequent steps through environment variables. Update the release-process documentation and add coverage for tag validation and the release-step sequence.Testing
Set up this checkout's
.venvand editable install using the local development guide. Run commands from the checkout root..venv/bin/specify --help(Windows PowerShell:.\.venv\Scripts\specify.exe --help).venv/bin/python -m pytest tests -q(Windows PowerShell:.\.venv\Scripts\python.exe -m pytest tests -q); use affected test paths for focused checks andLC_ALL=en_US.UTF-8on macOS.venv/bin/specify --helppassed.LC_ALL=en_US.UTF-8 .venv/bin/python -m pytest tests/test_github_workflows.py -qpassed: 203 tests, including 10 local release-sequence simulations using temporary Git repositories and mocked GitHub calls. No live release was published. The full test suite was not run; a sample project is not applicable.AI Disclosure
AI disclosure: GitHub Copilot using GPT-6.1 Sol (model ID: gpt-6.1-sol), runtime-default reasoning settings and autonomous execution within a user-directed scope, generated the implementation, tests, documentation, and PR description and ran local validation. An additional read-only Copilot agent assisted with analysis; its model was not reported by the tool.