@@ -21,9 +21,84 @@ permissions:
2121 contents : write
2222
2323jobs :
24+ # ---------------------------------------------------------------------------
25+ # Pre-flight gates. These run on every invocation and block all build jobs
26+ # from starting if the release artifact would be inconsistent with the
27+ # sources. Both gates are skipped for `workflow_dispatch` runs where
28+ # `publish_release=false`, so maintainers can still dry-run the build matrix
29+ # without a tag.
30+ # ---------------------------------------------------------------------------
31+ changelog-gate :
32+ name : CHANGELOG.md has section for tag
33+ runs-on : ubuntu-latest
34+ if : ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release) }}
35+
36+ steps :
37+ - name : Checkout repository
38+ uses : actions/checkout@v6
39+
40+ - name : Verify CHANGELOG.md contains the tagged version
41+ shell : bash
42+ run : |
43+ set -euo pipefail
44+ ref="${GITHUB_REF_NAME}"
45+ # Strip leading `v` (tags are `vX.Y.Z`; CHANGELOG uses `[X.Y.Z]`).
46+ version="${ref#v}"
47+ if ! grep -qE "^## \[${version}\]( - [0-9]{4}-[0-9]{2}-[0-9]{2})?$" CHANGELOG.md; then
48+ echo "::error file=CHANGELOG.md::Missing '## [${version}]' section in CHANGELOG.md" >&2
49+ echo "Expected a heading like '## [${version}] - YYYY-MM-DD' (Keep a Changelog)." >&2
50+ exit 1
51+ fi
52+ echo "CHANGELOG.md contains a section for ${version}."
53+
54+ version-consistency :
55+ name : Version is consistent across sources
56+ runs-on : ubuntu-latest
57+ if : ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.publish_release) }}
58+
59+ steps :
60+ - name : Checkout repository
61+ uses : actions/checkout@v6
62+
63+ - name : Set up uv with Python
64+ uses : astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
65+ with :
66+ python-version : " 3.12"
67+ enable-cache : true
68+
69+ - name : Verify __version__, [tool.briefcase].version, and git tag agree
70+ shell : bash
71+ run : |
72+ set -euo pipefail
73+ ref="${GITHUB_REF_NAME}"
74+ tag_version="${ref#v}"
75+ pkg_version=$(uv run --no-sync --no-project python -c "import re, pathlib; \
76+ src = pathlib.Path('src/dbs_annotator/__init__.py').read_text(); \
77+ m = re.search(r'^__version__\\s*=\\s*[\"\\'](?P<v>[^\"\\']+)[\"\\']', src, re.MULTILINE); \
78+ print(m.group('v') if m else '')")
79+ briefcase_version=$(uv run --no-sync --no-project python -c "import tomllib, pathlib; \
80+ data = tomllib.loads(pathlib.Path('pyproject.toml').read_text()); \
81+ print(data['tool']['briefcase'].get('version', ''))")
82+ echo "git tag : ${tag_version}"
83+ echo "__version__ : ${pkg_version}"
84+ echo "[tool.briefcase].ver : ${briefcase_version}"
85+ fail=0
86+ if [ "${pkg_version}" != "${tag_version}" ]; then
87+ echo "::error file=src/dbs_annotator/__init__.py::__version__ (${pkg_version}) != tag (${tag_version})" >&2
88+ fail=1
89+ fi
90+ if [ "${briefcase_version}" != "${tag_version}" ]; then
91+ echo "::error file=pyproject.toml::[tool.briefcase].version (${briefcase_version}) != tag (${tag_version})" >&2
92+ fail=1
93+ fi
94+ exit "${fail}"
95+
2496 build-python-dist :
2597 name : Build Python distribution
2698 runs-on : ubuntu-latest
99+ needs :
100+ - changelog-gate
101+ - version-consistency
27102
28103 steps :
29104 - name : Checkout repository
49124 build-briefcase-msi :
50125 name : Build Briefcase MSI (Windows)
51126 runs-on : windows-latest
127+ needs :
128+ - changelog-gate
129+ - version-consistency
52130
53131 steps :
54132 - name : Checkout repository
@@ -139,6 +217,9 @@ jobs:
139217 build-briefcase-macos-arm :
140218 name : Build Briefcase macOS DMG (arm64)
141219 runs-on : macos-14
220+ needs :
221+ - changelog-gate
222+ - version-consistency
142223
143224 steps :
144225 - name : Checkout repository
@@ -227,6 +308,9 @@ jobs:
227308 build-briefcase-linux-x86 :
228309 name : Build Briefcase Linux package (x86_64)
229310 runs-on : ubuntu-latest
311+ needs :
312+ - changelog-gate
313+ - version-consistency
230314
231315 steps :
232316 - name : Checkout repository
0 commit comments