From 03159d48af433bea7fe64c9bbfe82a3a511cd2fa Mon Sep 17 00:00:00 2001 From: Martin Hinshelwood Date: Thu, 17 Sep 2026 14:07:07 +0100 Subject: [PATCH 1/2] Use exact pushed tag for platform release builds --- .build/Get-PlatformVersion.ps1 | 13 +++++++- tests/Core/PlatformTagVersion.Tests.ps1 | 42 +++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 tests/Core/PlatformTagVersion.Tests.ps1 diff --git a/.build/Get-PlatformVersion.ps1 b/.build/Get-PlatformVersion.ps1 index d7c9db4..546f642 100644 --- a/.build/Get-PlatformVersion.ps1 +++ b/.build/Get-PlatformVersion.ps1 @@ -2,6 +2,17 @@ [CmdletBinding()] param([string]$WorkspaceRoot=(Split-Path $PSScriptRoot -Parent)) Import-Module "$PSScriptRoot/../system/OpenGuidePlatform.PowerShell.PlatformBuild/OpenGuidePlatform.PowerShell.PlatformBuild.psm1" -$version=Get-PlatformBuildVersion -WorkspaceRoot $WorkspaceRoot +if($env:GITHUB_ACTIONS -eq 'true' -and $env:GITHUB_REF -like 'refs/tags/*'){ + if($env:GITHUB_REF -cnotmatch '^refs/tags/v([0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?)$'){ + throw "Unsupported platform release tag: $env:GITHUB_REF" + } + $releaseVersion=$Matches[1] + $tagCommit=(& git -C $WorkspaceRoot rev-parse "$($env:GITHUB_REF)^{commit}" 2>$null) + if($LASTEXITCODE -ne 0){throw "Cannot resolve platform release tag: $env:GITHUB_REF"} + $version=Get-PlatformBuildVersion -WorkspaceRoot $WorkspaceRoot -Version $releaseVersion + if($tagCommit.Trim() -cne $version.Sha){throw "Platform release tag $env:GITHUB_REF does not identify the checked-out commit."} +}else{ + $version=Get-PlatformBuildVersion -WorkspaceRoot $WorkspaceRoot +} if($env:GITHUB_OUTPUT){[IO.File]::AppendAllText($env:GITHUB_OUTPUT,"semVer=$($version.SemVer)`nsha=$($version.Sha)`n")} $version diff --git a/tests/Core/PlatformTagVersion.Tests.ps1 b/tests/Core/PlatformTagVersion.Tests.ps1 new file mode 100644 index 0000000..190071e --- /dev/null +++ b/tests/Core/PlatformTagVersion.Tests.ps1 @@ -0,0 +1,42 @@ +BeforeAll { + $root=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent + $entry=Join-Path $root '.build/Get-PlatformVersion.ps1' +} + +Describe 'Platform version selection for a pushed release tag' { + BeforeEach { + $fixture=Join-Path $TestDrive ([guid]::NewGuid().ToString('N')) + New-Item -ItemType Directory $fixture|Out-Null + git init -q -b main $fixture + git -C $fixture -c user.name=Test -c user.email=test@example.test commit --allow-empty -qm 'Release source' + git -C $fixture tag v1.0.1 + git -C $fixture tag v1.0.1-Preview.6 + git -C $fixture tag v1.0.2 + $commit=(git -C $fixture rev-parse HEAD).Trim() + $priorActions=$env:GITHUB_ACTIONS + $priorRef=$env:GITHUB_REF + $priorOutput=$env:GITHUB_OUTPUT + $env:GITHUB_ACTIONS='true' + $env:GITHUB_REF='refs/tags/v1.0.2' + $env:GITHUB_OUTPUT=Join-Path $TestDrive 'github-output.txt' + } + AfterEach { + $env:GITHUB_ACTIONS=$priorActions + $env:GITHUB_REF=$priorRef + $env:GITHUB_OUTPUT=$priorOutput + } + It 'uses the pushed exact tag even when other release tags identify the same commit' { + $result=& $entry -WorkspaceRoot $fixture + $result.SemVer|Should -BeExactly '1.0.2' + $result.Sha|Should -BeExactly $commit + Get-Content $env:GITHUB_OUTPUT|Should -Be @('semVer=1.0.2',"sha=$commit") + } + It 'rejects a tag that does not identify the checked-out source' { + git -C $fixture -c user.name=Test -c user.email=test@example.test commit --allow-empty -qm 'Later source' + { & $entry -WorkspaceRoot $fixture }|Should -Throw '*does not identify the checked-out commit*' + } + It 'rejects an unsupported tag before calculating a version' { + $env:GITHUB_REF='refs/tags/v1.0' + { & $entry -WorkspaceRoot $fixture }|Should -Throw '*Unsupported platform release tag*' + } +} From ba6f5376366949f7e1f7585a560b01e147f7ef99 Mon Sep 17 00:00:00 2001 From: Martin Hinshelwood Date: Fri, 18 Sep 2026 14:50:36 +0100 Subject: [PATCH 2/2] Reject noncanonical platform release tags --- .build/Get-PlatformVersion.ps1 | 4 ++++ tests/Core/PlatformTagVersion.Tests.ps1 | 18 +++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/.build/Get-PlatformVersion.ps1 b/.build/Get-PlatformVersion.ps1 index 546f642..aa96342 100644 --- a/.build/Get-PlatformVersion.ps1 +++ b/.build/Get-PlatformVersion.ps1 @@ -7,6 +7,10 @@ if($env:GITHUB_ACTIONS -eq 'true' -and $env:GITHUB_REF -like 'refs/tags/*'){ throw "Unsupported platform release tag: $env:GITHUB_REF" } $releaseVersion=$Matches[1] + $parsedVersion=$null + if(-not [System.Management.Automation.SemanticVersion]::TryParse($releaseVersion,[ref]$parsedVersion) -or $parsedVersion.ToString() -cne $releaseVersion){ + throw "Unsupported platform release tag: $env:GITHUB_REF" + } $tagCommit=(& git -C $WorkspaceRoot rev-parse "$($env:GITHUB_REF)^{commit}" 2>$null) if($LASTEXITCODE -ne 0){throw "Cannot resolve platform release tag: $env:GITHUB_REF"} $version=Get-PlatformBuildVersion -WorkspaceRoot $WorkspaceRoot -Version $releaseVersion diff --git a/tests/Core/PlatformTagVersion.Tests.ps1 b/tests/Core/PlatformTagVersion.Tests.ps1 index 190071e..759346d 100644 --- a/tests/Core/PlatformTagVersion.Tests.ps1 +++ b/tests/Core/PlatformTagVersion.Tests.ps1 @@ -18,7 +18,7 @@ Describe 'Platform version selection for a pushed release tag' { $priorOutput=$env:GITHUB_OUTPUT $env:GITHUB_ACTIONS='true' $env:GITHUB_REF='refs/tags/v1.0.2' - $env:GITHUB_OUTPUT=Join-Path $TestDrive 'github-output.txt' + $env:GITHUB_OUTPUT=Join-Path $fixture 'github-output.txt' } AfterEach { $env:GITHUB_ACTIONS=$priorActions @@ -39,4 +39,20 @@ Describe 'Platform version selection for a pushed release tag' { $env:GITHUB_REF='refs/tags/v1.0' { & $entry -WorkspaceRoot $fixture }|Should -Throw '*Unsupported platform release tag*' } + It 'rejects noncanonical semantic version without writing workflow outputs' -ForEach @( + @{Tag='v01.0.0'} + @{Tag='v1.0.0-.alpha'} + @{Tag='v1.0.0-01'} + ) { + git -C $fixture tag $Tag + $env:GITHUB_REF="refs/tags/$Tag" + { & $entry -WorkspaceRoot $fixture }|Should -Throw '*Unsupported platform release tag*' + Test-Path $env:GITHUB_OUTPUT|Should -BeFalse + } + It 'uses the exact prerelease tag when stable tags identify the same commit' { + $env:GITHUB_REF='refs/tags/v1.0.1-Preview.6' + $result=& $entry -WorkspaceRoot $fixture + $result.SemVer|Should -BeExactly '1.0.1-Preview.6' + $result.Sha|Should -BeExactly $commit + } }