From a7f463f7c0e75f3305b2dfab560ee9a6c315343d Mon Sep 17 00:00:00 2001
From: Serhii Shpak <sergak.shpak@gmail.com>
Date: Thu, 2 Jul 2026 10:28:47 +0300
Subject: [PATCH] fix(PP-3449): guard release.yml against non-tag
 workflow_dispatch runs

workflow_dispatch lets this workflow run against any ref (branch or
tag). Without a check, dispatching against main/develop would derive
VERSION from the branch name and proceed to build/bump/publish with
a bogus version. Exit early unless GITHUB_REF_NAME matches a v* tag.

Addresses CodeRabbit review comment on PR #186.
---
 .github/workflows/release.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9357608..4ff7fd6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,6 +30,11 @@ jobs:
       - name: Extract version from tag
         id: version
         run: |
+          if [[ "$GITHUB_REF_NAME" != v* ]]; then
+            echo "This workflow must be run against a version tag (e.g. v1.0.0)."
+            exit 1
+          fi
+
           VERSION=${GITHUB_REF_NAME#v}
           echo "version=$VERSION" >> $GITHUB_OUTPUT