From 6a1b0b09b61b1d7e55095f90b15805fac9fdac5d Mon Sep 17 00:00:00 2001
From: Hood Chatham <roberthoodchatham@gmail.com>
Date: Wed, 28 Feb 2024 14:03:57 -0800
Subject: [PATCH] Add CI job to check that release version matches repo file
 contents

---
 .circleci/config.yml  | 30 ++++++++++++++++++++++++++++--
 tools/bump_version.py | 17 +++++++++++++++--
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 14a086403..8760a6781 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -479,6 +479,18 @@ jobs:
       - store_artifacts:
           path: /root/repo/dist/benchmarks.json
 
+  check-release-version:
+    # Check that the tag matches the version numbers in the repo and fail the
+    # release if not
+    <<: *defaults
+
+    steps:
+      - checkout
+      - run:
+          name: check-release-version
+          command: |
+            ./tools/bump_version --check --new-version ${CIRCLE_TAG}
+
   deploy-release:
     # To reduce chance of deployment issues, try to keep the steps here as
     # similar as possible to the steps in deploy-dev!
@@ -515,8 +527,14 @@ jobs:
             # If it has an 'a' in the tag it's an alpha so mark it as a prelease
             [[ "${CIRCLE_TAG}" =~ a ]] && export MAYBE_PRE_RELEASE=-prerelease
 
-            /tmp/ghr-bin -t "${GITHUB_TOKEN}" -u "${CIRCLE_PROJECT_USERNAME}" \
-              -r "${CIRCLE_PROJECT_REPONAME}" -c "${CIRCLE_SHA1}" \
+            # Options have to come first, last two lines have to be
+            # ${CIRCLE_TAG} and dist.
+            # TODO: Should we get rid of -delete?
+            /tmp/ghr-bin \
+              -t "${GITHUB_TOKEN}" \
+              -u "${CIRCLE_PROJECT_USERNAME}" \
+              -r "${CIRCLE_PROJECT_REPONAME}" \
+              -c "${CIRCLE_SHA1}" \
               -delete \
               ${MAYBE_PRE_RELEASE} \
               "${CIRCLE_TAG}" \
@@ -931,8 +949,16 @@ workflows:
             tags:
               only: /.*/
 
+      - check-release-version:
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /^\d+\.\d+\.\w+$/
+
       - deploy-release:
           requires:
+            - check-release-version
             - test-core-firefox
             - test-packages-firefox
             - build-pyodide-debug
diff --git a/tools/bump_version.py b/tools/bump_version.py
index 697f4de51..e1c17963d 100755
--- a/tools/bump_version.py
+++ b/tools/bump_version.py
@@ -178,6 +178,11 @@ def parse_args():
     parser.add_argument(
         "--dry-run", action="store_true", help="Don't actually write anything"
     )
+    parser.add_argument(
+        "--check",
+        action="store_true",
+        help="Compare the current contents to the updated contents and fail if it would change anything",
+    )
 
     return parser.parse_args()
 
@@ -210,12 +215,20 @@ def main():
         if new_content is not None:
             update_queue.append((target, new_content))
 
+    if args.check:
+        if update_queue:
+            print("Version update would change files, failing", file=sys.stderr)
+            return 1
+        return 0
     if args.dry_run:
-        return
+        return 0
 
     for target, content in update_queue:
         target.file.write_text(content)
+    return 0
 
 
 if __name__ == "__main__":
-    main()
+    import sys
+
+    sys.exit(main())