From 8fc4942517c1e132eb5dbfbc9ad5954f14d81e65 Mon Sep 17 00:00:00 2001 From: Dillard Blom Date: Sat, 26 Sep 2026 17:08:22 +0200 Subject: [PATCH] Fix fourth Codex finding: reject a dirty tree before releasing VERSION/app_name are read live from the working tree's info.xml, but the packaged/signed content comes from git archive HEAD (the last commit). Bumping without committing first would tag and sign an artifact named/keyed after the new version while its actual contents are still the previous commit's. make version now refuses to proceed if there are any uncommitted changes to tracked files. --- Makefile | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 64e554b..9c84042 100644 --- a/Makefile +++ b/Makefile @@ -157,8 +157,18 @@ show-version: # make version RELEASE_REMOTE=fork RELEASE_REMOTE ?= origin +# VERSION/app_name are read live from the working tree's appinfo/info.xml, +# but the archive this tags/packages/signs is git archive HEAD - i.e. the +# last COMMITTED state. Without this check, bumping without +# committing first would tag and sign a package named/keyed after the new +# version while its actual contents are still the previous commit's. +.PHONY: check-clean-tree +check-clean-tree: + @git diff --quiet HEAD -- || \ + (echo "Uncommitted changes to tracked files - commit before releasing (see 'git status')." >&2; exit 1) + .PHONY: version -version: +version: check-clean-tree @echo "Creating version v$(VERSION)" @git tag v$(VERSION) @git push $(RELEASE_REMOTE) v$(VERSION)