ci(release): set umask and pipefail for .deb package build

.gitea/workflows/release.yml

@@ -123,6 +123,9 @@ jobs:
 
       - name: Build .deb packages
         run: |
+          set -euo pipefail
+          # Runner umask can be 000; dpkg-deb rejects group/world-writable package dirs.
+          umask 022
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           PKGVER="${VERSION#v}"
 

Makefile

@@ -2,6 +2,12 @@ APP     := pgtidy
 CMD     := ./cmd/pgtidy
 DIST    := dist
 
+ARCH_PKGBUILDS := linux/arch/pgtidy-bin/PKGBUILD linux/arch/pgtidy-src/PKGBUILD
+RPM_SPEC       := linux/centos/pgtidy.spec
+VSCODE_PKG     := editors/vscode/package.json
+DATAGRIP_PROPS := editors/datagrip/gradle.properties
+PKG_FILES      := $(ARCH_PKGBUILDS) $(RPM_SPEC) $(VSCODE_PKG) $(DATAGRIP_PROPS)
+
 .PHONY: installer-windows build test lint vet fmt clean release release-version snapshot vscode-compile vscode-package
 
 ## build: compile binary for the current platform
@@ -44,12 +50,28 @@ release:
 	MAJOR=$$(echo $$CURRENT | sed 's/v\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\1/'); \
 	MINOR=$$(echo $$CURRENT | sed 's/v\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\2/'); \
 	PATCH=$$(echo $$CURRENT | sed 's/v\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\).*/\3/'); \
-	NEXT="v$$MAJOR.$$MINOR.$$((PATCH + 1))"; \
-	PKGVER="$$MAJOR.$$MINOR.$$((PATCH + 1))"; \
-	echo "Current: $$CURRENT → Next: $$NEXT"; \
-	sed -i "s/^pkgver=.*/pkgver=$$PKGVER/" linux/arch/pgtidy-bin/PKGBUILD linux/arch/pgtidy-src/PKGBUILD; \
-	sed -i "s/^Version:.*/Version:        $$PKGVER/" linux/centos/pgtidy.spec; \
-	git add linux/arch/pgtidy-bin/PKGBUILD linux/arch/pgtidy-src/PKGBUILD linux/centos/pgtidy.spec; \
+	echo "Current: $$CURRENT"; \
+	$(MAKE) --no-print-directory release-version VERSION="$$MAJOR.$$MINOR.$$((PATCH + 1))"
+
+## release-version: release VERSION=X.Y.Z — set and verify version in all package files, commit, tag, push
+release-version:
+	@set -e; PKGVER="$(VERSION)"; PKGVER="$${PKGVER#v}"; NEXT="v$$PKGVER"; \
+	if ! echo "$$PKGVER" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$$'; then \
+		echo "VERSION must be X.Y.Z (got '$(VERSION)')"; exit 1; fi; \
+	if git rev-parse -q --verify "refs/tags/$$NEXT" >/dev/null; then \
+		echo "Tag $$NEXT already exists"; exit 1; fi; \
+	echo "Releasing $$NEXT"; \
+	sed -i "s/^pkgver=.*/pkgver=$$PKGVER/" $(ARCH_PKGBUILDS); \
+	sed -i "s/^Version:.*/Version:        $$PKGVER/" $(RPM_SPEC); \
+	sed -i "s/^  \"version\": \".*\",$$/  \"version\": \"$$PKGVER\",/" $(VSCODE_PKG); \
+	sed -i "s/^pluginVersion=.*/pluginVersion=$$PKGVER/" $(DATAGRIP_PROPS); \
+	fail=0; \
+	for f in $(ARCH_PKGBUILDS); do grep -qx "pkgver=$$PKGVER" $$f || { echo "pkgver not set in $$f"; fail=1; }; done; \
+	grep -qx "Version:        $$PKGVER" $(RPM_SPEC) || { echo "Version not set in $(RPM_SPEC)"; fail=1; }; \
+	grep -qx "  \"version\": \"$$PKGVER\"," $(VSCODE_PKG) || { echo "version not set in $(VSCODE_PKG)"; fail=1; }; \
+	grep -qx "pluginVersion=$$PKGVER" $(DATAGRIP_PROPS) || { echo "pluginVersion not set in $(DATAGRIP_PROPS)"; fail=1; }; \
+	if [ $$fail -ne 0 ]; then git checkout -- $(PKG_FILES); echo "Aborted — package files restored"; exit 1; fi; \
+	git add $(PKG_FILES); \
 	git commit -m "chore(release): bump version to $$PKGVER"; \
 	git tag -a "$$NEXT" -m "Release $$NEXT"; \
 	git push origin HEAD "$$NEXT"; \