From bcbdfc02628532d37592cc81a0e845f0066a0d7c Mon Sep 17 00:00:00 2001
From: Hein <hein.puth@gmail.com>
Date: Wed, 23 Sep 2026 20:40:26 +0200
Subject: [PATCH] ci(publish): update workflow to require release_tag input

---
 .gitea/workflows/publish.yml | 18 +++++++++++++++---
 AGENTS.md                    | 11 ++++++-----
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index c308d28..231b49e 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -4,6 +4,11 @@ on:
     tags:
       - 'v*'
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing tag to publish (must match package.json version, e.g. v1.1.0)
+        required: true
+        type: string
 
 jobs:
   publish:
@@ -12,6 +17,8 @@ jobs:
       PACKAGE_REGISTRY: https://git.warky.dev/api/packages/${{ gitea.repository_owner }}/npm/
     steps:
       - uses: https://github.com/actions/checkout@v4
+        with:
+          ref: ${{ inputs.release_tag || gitea.ref }}
       - uses: https://github.com/pnpm/action-setup@v4
       - uses: https://github.com/actions/setup-node@v4
         with:
@@ -21,13 +28,18 @@ jobs:
           cache: pnpm
       - name: Verify release tag
         env:
-          RELEASE_REF: ${{ gitea.ref }}
+          EVENT_NAME: ${{ gitea.event_name }}
+          TRIGGER_REF: ${{ gitea.ref }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           node --input-type=module <<'JS'
           import { readFileSync } from 'node:fs';
           const { version } = JSON.parse(readFileSync('package.json', 'utf8'));
-          if (process.env.RELEASE_REF !== `refs/tags/v${version}`) {
-            throw new Error(`Release tag must be v${version} to match package.json`);
+          const tag = process.env.EVENT_NAME === 'workflow_dispatch'
+            ? process.env.RELEASE_TAG
+            : process.env.TRIGGER_REF.replace(/^refs\/tags\//, '');
+          if (tag !== `v${version}`) {
+            throw new Error(`Release tag must be v${version}; received ${tag || '(empty)'}`);
           }
           JS
       - run: pnpm install --frozen-lockfile
diff --git a/AGENTS.md b/AGENTS.md
index e376d96..0a12809 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,11 +35,12 @@ repository's user or organization (not necessarily the npm scope `warkypublic`).
 2. Run `pnpm exec changeset version` to apply pending changesets. Review and commit
    the updated version, changelog, and consumed changesets with the release changes.
 3. Create and push a matching tag to the Gitea remote, for example `v1.1.0` for
-   package version `1.1.0`. To dispatch manually, select that existing matching tag
-   as the workflow run ref in the Actions UI; the workflow rejects branch refs and
-   tags that do not exactly match the package version. It runs the tests and
-   bundle checks, then publishes using pnpm so the `publishConfig` overrides point
-   consumers to the built JavaScript and declarations.
+   package version `1.1.0`. To publish manually, run the workflow from the Actions
+   UI and set its required `release_tag` input to the matching tag. Checkout and
+   validation use that tag; the workflow rejects tags that do not exactly match the
+   package version. It then runs tests and bundle checks before publishing with
+   pnpm, which applies the `publishConfig` entries for built JavaScript and
+   declarations.
 
 Stable versions receive the `latest` dist-tag; prereleases receive `next`.
 Existing package versions cannot be overwritten; release a new version instead.