From 39eb9b8d364d765933491a39fbbc6db86fb04012 Mon Sep 17 00:00:00 2001
From: Atishyy27 <142108881+Atishyy27@users.noreply.github.com>
Date: Fri, 14 Aug 2026 01:57:41 +0530
Subject: [PATCH] fix: guard release tag against workspace version mismatch

release.sh takes the release tag as an arbitrary CLI arg and never checks
it against [workspace.package].version in Cargo.toml. infigraph-cli's
--version comes from clap's version field, which pulls CARGO_PKG_VERSION
at compile time from that same Cargo.toml. So a forgotten version bump
(or a typo in the tag arg) ships binaries whose --version output silently
disagrees with the git tag/GitHub release they're uploaded under, with
no way to fix it after the fact short of deleting the release.

Guard by comparing the tag (v-prefix stripped) against the workspace
version before any build starts, and fail with a clear message pointing
at the fix in either direction.
---
 release.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/release.sh b/release.sh
index aa205b6b..2c4745b5 100755
--- a/release.sh
+++ b/release.sh
@@ -23,6 +23,17 @@ fi
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 cd "$SCRIPT_DIR"
 
+# Guard: the tag must match the workspace version, or the binaries built
+# below will report a version (via clap's `version` from CARGO_PKG_VERSION)
+# that disagrees with the release tag they're uploaded under.
+CARGO_VERSION="$(grep -m1 '^version = ' Cargo.toml | sed -E 's/version = "(.*)"/\1/')"
+TAG_VERSION="${VERSION#v}"
+if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
+  echo "Error: release tag ${VERSION} does not match [workspace.package].version ${CARGO_VERSION} in Cargo.toml."
+  echo "Bump the workspace version to ${TAG_VERSION}, or run: $0 v${CARGO_VERSION}"
+  exit 1
+fi
+
 # Detect current platform
 OS="$(uname -s)"