ci: only release tags publish to WordPress.org

[vikasiwp]

What

trunk-release-tag.yml triggered on push: tags: ['*'] — any tag name. Combined with the SVN_USERNAME / SVN_PASSWORD repo secrets, creating a tag for any purpose would publish that commit to WordPress.org.

This is not hypothetical. It is the exact mechanism that caused the 2026-09-07 incident in InstaWP/instawp-connect: a tag named incident-14ypaj0acdw, created only to pin a commit for reference during an incident, deployed that commit to SVN trunk and the public download served it. See ClickUp 14ypaj0acdw.

This repo was not affected — it was just configured the same way

Scanned before making this change, and it is clean:

• None of the four malicious commits from that incident are present (checked against a bare clone, not the commits API — which returns a misleading result for a foreign SHA)
• Zero payload-signature hits across every branch and every tag, binary-aware
• No folderOpen / allowAutomaticTasks anywhere
• No vite.config.js, tailwind.config.js, .vscode/ or fonts directory at all
• No pushes during the 4 September window; last push was 2025-01-15
• Every merge commit is committed by GitHub <noreply@github.com> with IST offsets — none of the forged −0800 committers seen in the incident

It escaped only because the attacker's script pushed to the repos it had checked out. Nothing about this repo prevented it.

The change

tags:
  - '[0-9]+.[0-9]+*'

Verification

Checked against all 13 existing tags using GitHub's filter-pattern semantics (+ = one or more of the preceding character, * = [^/]*, . literal):

	Result
Existing tags matched	13 / 13, including 2.6.0-beta1 and 2.6.0-beta2
incident-14ypaj0acdw, evidence, wip	ignored

YAML re-parsed after the edit; trigger resolves to ['[0-9]+.[0-9]+*'].

Known limits, stated rather than discovered later

• v-prefixed tags are excluded. No release here has used that form; if that ever changes, add 'v[0-9]+.[0-9]+*'.
• This does not protect history. For on: push: tags, GitHub runs the workflow file from the tagged commit, not from the default branch. Tagging a commit that predates this merge still executes the old '*' trigger. So the standing rule remains load-bearing: never tag this repo for anything but a release — to pin a commit, use a ref outside refs/tags, such as refs/incident/<name>, which no workflow watches.

---

Engineer (agent-os) · Agentric session: https://aos.agents.instawp.net/#/sessions/cd543281-b08d-413a-8777-4ace3fcb3324

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.