From a5b2c3d9129f34e59b2b1da02ecc4cd6b2f07c91 Mon Sep 17 00:00:00 2001
From: Lahfir <nmhlahfir2@gmail.com>
Date: Tue, 19 May 2026 18:41:57 -0700
Subject: [PATCH] ci: guard release metadata consistency

---
 .github/workflows/ci.yml             |  3 +
 .github/workflows/release.yml        |  5 +-
 .github/workflows/supply-chain.yml   |  3 +
 scripts/check-release-consistency.sh | 87 ++++++++++++++++++++++++++++
 4 files changed, 96 insertions(+), 2 deletions(-)
 create mode 100755 scripts/check-release-consistency.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 71f6c98..966a826 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,6 +69,9 @@ jobs:
           fi
           echo "OK: core crate has no platform dependencies"
 
+      - name: Check release metadata consistency
+        run: scripts/check-release-consistency.sh
+
       - name: Clippy
         run: cargo clippy --locked --all-targets -- -D warnings
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b4a3c36..d105a53 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
             exit 0
           fi
 
-          git init release-pr
+          git init -b main release-pr
           cd release-pr
           git remote add origin "https://x-access-token:${GH_TOKEN}@github.com/${GH_REPO}.git"
           git fetch --depth=1 origin "$BRANCH"
@@ -54,7 +54,8 @@ jobs:
 
           rustup show
           VERSION=$(sed -n 's/.*version *= *"\([^"]*\)".*/\1/p' Cargo.toml | head -1)
-          cargo update --offline -p agent-desktop --precise "$VERSION"
+          cargo update -p agent-desktop --precise "$VERSION"
+          scripts/check-release-consistency.sh
 
           if git diff --quiet -- Cargo.lock; then
             echo "Cargo.lock already matches release version ${VERSION}"
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 1fab0b7..fbaaea0 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -24,6 +24,9 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Check release metadata consistency
+        run: scripts/check-release-consistency.sh
+
       - name: Cargo dependency policy
         uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2.0.18
         with:
diff --git a/scripts/check-release-consistency.sh b/scripts/check-release-consistency.sh
new file mode 100755
index 0000000..3cce97b
--- /dev/null
+++ b/scripts/check-release-consistency.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+read_toml_version() {
+  sed -n 's/^version *= *"\([^"]*\)".*/\1/p' Cargo.toml | head -1
+}
+
+read_json_version() {
+  local file="$1"
+  sed -n 's/.*"version" *: *"\([^"]*\)".*/\1/p' "$file" | head -1
+}
+
+read_manifest_version() {
+  sed -n 's/.*"\." *: *"\([^"]*\)".*/\1/p' .release-please-manifest.json | head -1
+}
+
+lock_version_for() {
+  local package="$1"
+  awk -v target="$package" '
+    /^\[\[package\]\]/ {
+      if (name == target) {
+        print version
+        found = 1
+        exit
+      }
+      name = ""
+      version = ""
+      next
+    }
+    /^name = / {
+      name = $3
+      gsub(/"/, "", name)
+      next
+    }
+    /^version = / {
+      version = $3
+      gsub(/"/, "", version)
+      next
+    }
+    END {
+      if (!found && name == target) {
+        print version
+      }
+    }
+  ' Cargo.lock
+}
+
+workspace_version="$(read_toml_version)"
+npm_version="$(read_json_version npm/package.json)"
+manifest_version="$(read_manifest_version)"
+
+[[ -n "$workspace_version" ]] || fail "could not read workspace version from Cargo.toml"
+[[ -n "$npm_version" ]] || fail "could not read npm package version"
+[[ -n "$manifest_version" ]] || fail "could not read release-please manifest version"
+
+[[ "$npm_version" == "$workspace_version" ]] \
+  || fail "npm/package.json version ${npm_version} does not match Cargo.toml ${workspace_version}"
+
+[[ "$manifest_version" == "$workspace_version" ]] \
+  || fail ".release-please-manifest.json version ${manifest_version} does not match Cargo.toml ${workspace_version}"
+
+packages=(
+  agent-desktop
+  agent-desktop-core
+  agent-desktop-ffi
+  agent-desktop-linux
+  agent-desktop-macos
+  agent-desktop-windows
+)
+
+for package in "${packages[@]}"; do
+  lock_version="$(lock_version_for "$package")"
+  [[ -n "$lock_version" ]] || fail "Cargo.lock is missing ${package}"
+  [[ "$lock_version" == "$workspace_version" ]] \
+    || fail "Cargo.lock ${package} version ${lock_version} does not match Cargo.toml ${workspace_version}"
+done
+
+cargo metadata --locked --no-deps --format-version 1 >/dev/null
+echo "OK: release metadata is internally consistent for ${workspace_version}"