name: Assert Stable Release
description: >-
  Defense-in-depth guard for package-manager bump workflows. Re-validates
  tag format, prerelease flag, and draft status before invoking third-party
  actions that hold write credentials to external package manager repos.

inputs:
  tag:
    description: "Tag to validate (e.g. v1.08.0)"
    required: true
  is_prerelease:
    description: "Whether the release is marked as prerelease (empty string treated as false)"
    required: false
    default: "false"
  is_draft:
    description: "Whether the release is a draft (empty string treated as false)"
    required: false
    default: "false"

runs:
  using: composite
  steps:
    - name: Assert release is stable
      shell: bash
      env:
        TAG: ${{ inputs.tag }}
        IS_PRERELEASE: ${{ inputs.is_prerelease }}
        IS_DRAFT: ${{ inputs.is_draft }}
      run: |
        set -euo pipefail
        echo "tag=$TAG prerelease=$IS_PRERELEASE draft=$IS_DRAFT"

        # Stable = exactly vMAJOR.MINOR.PATCH; reject everything else.
        if ! [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
          echo "::error::Tag $TAG does not match stable vMAJOR.MINOR.PATCH format; refusing bump"
          exit 1
        fi

        # Draft releases must never trigger bumps.
        if [[ "$IS_DRAFT" == "true" ]]; then
          echo "::error::Release is draft; refusing bump"
          exit 1
        fi

        # Prerelease flag cross-check (belt-and-suspenders with workflow-level `if:`).
        if [[ "$IS_PRERELEASE" == "true" ]]; then
          echo "::error::Release is prerelease; refusing bump"
          exit 1
        fi