From b3dc9dfa641b127d36103a817b91f474c079ba05 Mon Sep 17 00:00:00 2001
From: Kent Pitman <kent_pitman@hms.harvard.edu>
Date: Thu, 12 Mar 2020 23:28:28 -0400
Subject: [PATCH] Make sure only a tagged commit gets published. (As with
 Travis, this doesn't check that the tag matches what we will publish. This
 should be good enough for now, though.)

---
 bin/publish | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/bin/publish b/bin/publish
index 733bf1d..d0a4fa6 100755
--- a/bin/publish
+++ b/bin/publish
@@ -10,11 +10,34 @@ if [ -z "$PYPI_PASSWORD" ]; then
     exit 1    
 fi
 
-read -p "Are you sure you want to publish $(poetry version) to PyPi? " -n 1 -r
-if [[ ! $REPLY =~ ^[Yy]$ ]]
-then
-    exit 1
+changes=`git diff`
+
+if [ -n "${changes}" ]; then
+  echo "You have made changes to this branch that you have not committed."
+  exit 1
+fi
+
+staged_changes=`git diff --staged`
+
+if [ -n "${staged_changes}" ]; then
+  echo "You have staged changes to this branch that you have not committed."
+  exit 1
 fi
 
+tagged=`git log -1 --decorate | head -1 | grep 'tag:'`
+
+if [ -z "$tagged" ]; then
+  # We don't encourage people to tag it unless they have no changes pending.
+  echo "You can only publish a tagged commit."
+  exit 1
+fi
+
+read -p "Are you sure you want to publish $(poetry version) to PyPi? "
+REPLY=`echo "$REPLY" | tr '[:upper:]' '[:lower:]'`
+if [ "$REPLY" != 'y' ] && [ "$REPLY" != "yes" ]
+then
+  echo "Publishing aborted."
+  exit 1
+fi
 
 poetry publish --no-interaction --build --username=$PYPI_USER --password=$PYPI_PASSWORD