From 8e3425b9dce7d4e1903d281e91899962b24931b0 Mon Sep 17 00:00:00 2001
From: Adam J Esslinger <aesslinger@lilly.com>
Date: Tue, 11 Aug 2026 08:51:27 -0400
Subject: [PATCH] ci: add release-version validation and PR-title enforcement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- release.yml: a validate job gates the build matrix on the pushed tag
  matching .tabularium's version field (stripped of the v prefix) —
  ported from the tabularis-elasticsearch-plugin sibling's pattern. Not
  just convention: the registry's own manifest schema documents this as
  a hard rule ("the registry rejects ingests whose tag and manifest
  version disagree"), so this catches the mismatch at tag-push time
  instead of at registry-submission time.
- ci.yml: a pr-title job enforces Conventional Commits PR titles via
  amannn/action-semantic-pull-request, on plain pull_request (not
  pull_request_target) since this repo doesn't need fork-PR support and
  the plain event avoids the elevated-permission surface entirely.

Rebased onto the current main (already at 1.0.0-beta.2 with its own
release/CI fixes) — drops the version-bump/CHANGELOG changes this PR
originally carried, since main now covers that independently.
---
 .github/workflows/ci.yml      | 11 +++++++++++
 .github/workflows/release.yml | 17 +++++++++++++++++
 CHANGELOG.md                  | 13 +++++++++++++
 3 files changed, 41 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54754e1..be41428 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,6 +44,17 @@ jobs:
       - name: Validate against the live registry schema
         run: npx --yes @tabularium/cli validate .tabularium --registry https://registry.tabularis.dev --kind driver
 
+  pr-title:
+    name: PR title (Conventional Commits)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    steps:
+      - uses: amannn/action-semantic-pull-request@v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   markdownlint:
     name: Markdown lint
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2347bb4..1c8e800 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,8 +6,25 @@ on:
       - "v*"
 
 jobs:
+  validate:
+    name: Validate release version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Check tag matches manifest version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          TABULARIUM_VERSION=$(jq -r .version .tabularium)
+
+          if [ "$TAG_VERSION" != "$TABULARIUM_VERSION" ]; then
+            echo "::error::Tag version ($TAG_VERSION) does not match .tabularium version ($TABULARIUM_VERSION)"
+            exit 1
+          fi
+
   build:
     name: ${{ matrix.platform-label }}
+    needs: validate
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 841164c..702034f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,19 @@
 
 ### Added
 
+- Two more CI checks:
+  - `release.yml`: a `validate` job gates the build matrix on the pushed
+    tag matching `.tabularium`'s `version` field (stripped of the `v`
+    prefix) — ported from the `tabularis-elasticsearch-plugin` sibling's
+    pattern. This isn't just convention: the registry's own manifest
+    schema documents this as a hard rule ("the registry rejects ingests
+    whose tag and manifest version disagree"), so this catches the
+    mismatch at tag-push time instead of at registry-submission time.
+  - `ci.yml`: a `pr-title` job enforces Conventional Commits PR titles via
+    `amannn/action-semantic-pull-request`, triggered on plain
+    `pull_request` (not `pull_request_target`) since this repo doesn't
+    need fork-PR support and the plain event avoids the elevated-
+    permission surface entirely.
 - CI hardening — deliberately set a higher bar than the sibling plugin
   repos and the org's own documented requirements (no sibling runs
   `cargo audit`; only 2 of 11 Rust siblings gate on clippy/fmt at all):