From a15584c777384550ee6ce3e600c453a642acc1c5 Mon Sep 17 00:00:00 2001
From: nicodes <nicozessoules@gmail.com>
Date: Thu, 27 Aug 2026 13:23:28 -0600
Subject: [PATCH] Fix release version stamping

---
 .github/actions/build/action.yml          |  6 ++-
 .github/scripts/verify-release-archive.sh | 55 +++++++++++++++++++++++
 .github/workflows/release.yml             | 10 ++++-
 3 files changed, 68 insertions(+), 3 deletions(-)
 create mode 100755 .github/scripts/verify-release-archive.sh

diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml
index 6f1a6bc..a2ef413 100644
--- a/.github/actions/build/action.yml
+++ b/.github/actions/build/action.yml
@@ -12,7 +12,7 @@ description: >
 
 inputs:
   version:
-    description: Version to stamp into the binary (without the v)
+    description: Complete version string to stamp into the binary (for example, v0.0.10)
     required: false
     default: dev
 
@@ -25,6 +25,10 @@ runs:
         VERSION: ${{ inputs.version }}
       run: |
         set -euo pipefail
+        if [[ "$VERSION" != dev && ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          echo "Unsupported version string: $VERSION" >&2
+          exit 1
+        fi
         mkdir -p dist
         # linux/386 and friends excluded on purpose: wazero's compiler backend
         # covers amd64/arm64, and everything else falls back to the
diff --git a/.github/scripts/verify-release-archive.sh b/.github/scripts/verify-release-archive.sh
new file mode 100755
index 0000000..6568a40
--- /dev/null
+++ b/.github/scripts/verify-release-archive.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+  echo "usage: $0 ARCHIVE EXPECTED_OUTPUT" >&2
+  exit 2
+fi
+
+archive=$1
+expected=$2
+workdir=$(mktemp -d)
+cleanup() {
+  rm -rf -- "$workdir"
+}
+trap cleanup EXIT
+
+listing="$workdir/listing"
+metadata="$workdir/metadata"
+actual="$workdir/actual"
+
+tar -tzf "$archive" > "$listing"
+if [[ $(wc -l < "$listing") -ne 1 ]] || [[ $(<"$listing") != termcade ]]; then
+  echo "archive must contain exactly one root entry named termcade" >&2
+  exit 1
+fi
+
+tar -tvzf "$archive" > "$metadata"
+if [[ $(wc -l < "$metadata") -ne 1 ]] || [[ $(<"$metadata") != -* ]]; then
+  echo "archive entry termcade must be a regular file" >&2
+  exit 1
+fi
+
+tar -xzf "$archive" -C "$workdir" --no-same-owner --no-same-permissions
+if [[ ! -f "$workdir/termcade" || -L "$workdir/termcade" ]]; then
+  echo "extracted termcade must be a regular, non-symlink file" >&2
+  exit 1
+fi
+chmod u+x "$workdir/termcade"
+
+if timeout 30s "$workdir/termcade" version > "$actual"; then
+  :
+else
+  status=$?
+  echo "termcade version command failed with exit $status" >&2
+  exit "$status"
+fi
+
+if ! printf '%s\n' "$expected" | cmp -s - "$actual"; then
+  echo "released binary version mismatch" >&2
+  printf 'expected: %q\n' "$expected" >&2
+  printf 'actual:   %q\n' "$(<"$actual")" >&2
+  exit 1
+fi
+
+printf 'verified: %s\n' "$expected"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7eac9a8..275ea88 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -88,11 +88,17 @@ jobs:
       # organisation does.
       - name: Build
         uses: ./.github/actions/build
+        with:
+          version: ${{ steps.release.outputs.tag }}
 
       - name: Test
         uses: ./.github/actions/test
-        with:
-          version: ${{ steps.release.outputs.version }}
+
+      - name: Verify released binary version
+        env:
+          ARCHIVE: dist/termcade_Linux_x86_64.tar.gz
+          EXPECTED: termcade v${{ steps.release.outputs.version }}
+        run: .github/scripts/verify-release-archive.sh "$ARCHIVE" "$EXPECTED"
 
       # Installed games run sandboxed, but the arcade itself runs with the
       # player's full permissions — worth tying the archives to this workflow,