From ade8f3d19d939f237d3fbc4b7f5c2d5d16c78bda Mon Sep 17 00:00:00 2001
From: Mladen Jablanovic <mladen.jablanovic@phrase.com>
Date: Mon, 24 Aug 2026 15:09:18 +0200
Subject: [PATCH] fix(cli): verify build against pinned phrase-go version
 before tagging a release

phrase-cli's release build compiles against the phrase-go version pinned
in go.mod. Our generation pipeline only verified the build against a
freshly generated go client via a local replace directive, so a CLI
release could be tagged whose generated code outran the phrase-go
version actually pinned/published, breaking the public release build
(as happened with CLI 2.67.0 vs phrase-go v4.29.1).

Add a second build check, scoped to the moment a new CLI version tag is
about to be created, using the pinned (non-replaced) dependency exactly
as phrase-cli's own release workflow will. This intentionally excludes
routine, non-release pushes to phrase-cli's master: generated code there
routinely outpaces the last-published phrase-go version between a spec
change and its corresponding go client release, and that's harmless
since nothing consumes unreleased master content.

Release-As: 2.67.1
---
 .github/workflows/build.yml | 18 +++++++++++++++---
 clients/cli/Makefile        |  1 +
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3e57d4ba4..d77a81699 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -61,9 +61,9 @@ jobs:
           npm install
           npm run generate.go
           npm run generate.cli
-          # Verify the generated CLI compiles before publishing it. Build against
-          # the freshly generated go client so this does not depend on a released
-          # phrase-go version that may lag behind the spec.
+          # Verify the generated CLI compiles against the freshly generated go
+          # client, so this does not depend on a released phrase-go version
+          # that may lag behind the spec.
           (cd ./clients/cli && go mod edit -replace github.com/phrase/phrase-go/v4=../go && go build . && go mod edit -dropreplace github.com/phrase/phrase-go/v4)
           git clone https://$API_TOKEN_GITHUB@github.com/phrase/phrase-cli.git clones/cli &> /dev/null
           rsync -avI --delete --exclude='.git/' clients/cli/ clones/cli
@@ -75,6 +75,18 @@ jobs:
           git add .
           git commit --message "Deploying from  phrase/openapi@${GITHUB_SHA::8}"
           PACKAGE_VERSION=$(awk '/- Package version:/{print $NF}' README.md)
+          if ! git rev-parse "$PACKAGE_VERSION" >/dev/null 2>&1; then
+            # About to cut a new CLI release tag: this is the point that
+            # actually reaches users, so verify the build against the
+            # pinned, published phrase-go dependency too -- the same build
+            # phrase-cli's own release workflow will run. A mismatch (e.g.
+            # this release's generated code outrunning the last released
+            # phrase-go version) fails here instead of breaking the public
+            # release build. Routine, non-release pushes skip this since
+            # unreleased master content isn't consumed by anyone.
+            go mod download
+            go build ./...
+          fi
           git tag -a $PACKAGE_VERSION -m $PACKAGE_VERSION || true
           git push --tags origin master
           else
diff --git a/clients/cli/Makefile b/clients/cli/Makefile
index 7bb8a78a7..0f64c3db4 100644
--- a/clients/cli/Makefile
+++ b/clients/cli/Makefile
@@ -6,6 +6,7 @@ all: build test vet
 build:
 	go mod download
 	go get ./...
+	go build ./...
 
 test:
 	go test ./...