From 0029a79d33dc6406fb833998aa5bcbea5c704623 Mon Sep 17 00:00:00 2001
From: Blankeos <carloantonioct@gmail.com>
Date: Mon, 31 Aug 2026 04:34:01 +0800
Subject: [PATCH] chore(release): refuse tagging unless on main

just tag on a feature branch still created a GitHub Release and
updated Homebrew. Guard the local script and release workflows so
tags must come from main.
---
 justfile                   |  2 +-
 scripts/tag_and_release.sh | 20 +++++++++++++++++---
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/justfile b/justfile
index 8b58c382..3f5bf6d3 100644
--- a/justfile
+++ b/justfile
@@ -76,6 +76,6 @@ log:
 sync_readme:
     cp README.md npm/README.md
 
-[doc('Release: bump versions, commit, and tag (just tag [patch|minor|major])')]
+[doc('Release: bump versions, commit, and tag from main (just tag [patch|minor|major])')]
 tag bump="":
     sh scripts/tag_and_release.sh {{ bump }}
diff --git a/scripts/tag_and_release.sh b/scripts/tag_and_release.sh
index 36ae538a..daa5e261 100644
--- a/scripts/tag_and_release.sh
+++ b/scripts/tag_and_release.sh
@@ -12,6 +12,21 @@ if [ -n "$(git status --porcelain)" ]; then
     exit 1
 fi
 
+branch="$(git branch --show-current)"
+if [[ "$branch" != "main" ]]; then
+    echo "❗ Releases must be tagged from main (currently on '${branch:-detached HEAD}')."
+    echo "   git checkout main && git pull && just tag"
+    exit 1
+fi
+
+echo "🦋 Fetching origin/main..."
+git fetch --quiet origin main
+
+if ! git merge-base --is-ancestor origin/main HEAD; then
+    echo "❗ local main has diverged from origin/main. Pull/rebase first."
+    exit 1
+fi
+
 # Written by AI :)
 NAME=$(sed -n 's/^name *= *"\([^"]*\)".*/\1/p' Cargo.toml)
 CURRENT=$(sed -n 's/^version *= *"\([^"]*\)".*/\1/p' Cargo.toml)
@@ -74,9 +89,8 @@ echo "🦋 Creating git tag v${NEW}"
 git tag "v${NEW}"
 
 # Create release binaries (with cargo-dist)
-echo "🦋 Pushing..."
-git push
-git push --tags
+echo "🦋 Pushing release commit and tag atomically..."
+git push --atomic origin main "v${NEW}"
 
 # ============================================
 # PUBLISHING: I put it here as documentation, but this is manual for now!