From c4d75931f0c4bf0ef891e416800570bdb32d1eda Mon Sep 17 00:00:00 2001
From: Jarrett Lusso <jclusso@gmail.com>
Date: Fri, 29 May 2026 10:13:00 -0400
Subject: [PATCH] Keep plugin.json version in sync with release tags

Add a make release VERSION=x.y.z target that validates the version, rewrites the version field in .claude-plugin/plugin.json, commits, and tags v$(VERSION). It refuses to run on a dirty tree or with a non-semver version.

Add a verify-version job to the release workflow that gates GoReleaser: on a tag push it compares the tag against plugin.json and fails the release if they differ, so a forgotten bump can never ship.

Follow-up from PR #16.
---
 .github/workflows/release.yml | 18 ++++++++++++++++++
 Makefile                      | 19 ++++++++++++++++++-
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52955d6..3cd89ea 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,8 +9,26 @@ permissions:
   contents: write
 
 jobs:
+  verify-version:
+    name: Verify plugin.json version
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Check tag matches plugin.json
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          plugin="$(jq -r .version .claude-plugin/plugin.json)"
+          if [ "$tag" != "$plugin" ]; then
+            echo "::error::Tag v$tag does not match .claude-plugin/plugin.json version $plugin. Run 'make release VERSION=$tag'."
+            exit 1
+          fi
+          echo "Tag matches plugin.json version: $plugin"
+
   goreleaser:
     name: GoReleaser
+    needs: verify-version
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
diff --git a/Makefile b/Makefile
index 8306ca5..724c683 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,8 @@
-.PHONY: build test fmt lint clean run release-snapshot man
+.PHONY: build test fmt lint clean run release release-snapshot man
 
 BINARY := emailable
 PKG    := .
+PLUGIN := .claude-plugin/plugin.json
 
 build:
 	go build -o bin/$(BINARY) $(PKG)
@@ -22,6 +23,22 @@ clean:
 run:
 	go run $(PKG) $(ARGS)
 
+# Cut a release: sync the plugin manifest version, commit, and tag.
+# Usage: make release VERSION=1.2.3
+# Pushing the tag triggers the GoReleaser workflow, which also verifies the
+# tag matches plugin.json (see .github/workflows/release.yml).
+release:
+ifndef VERSION
+	$(error VERSION is required, e.g. make release VERSION=1.2.3)
+endif
+	@echo "$(VERSION)" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$$' || { echo "error: VERSION must be semver x.y.z (got '$(VERSION)')"; exit 1; }
+	@test -z "$$(git status --porcelain)" || { echo "error: working tree not clean; commit or stash first"; exit 1; }
+	@tmp=$$(mktemp) && sed -E 's/("version": *")[^"]*(")/\1$(VERSION)\2/' $(PLUGIN) > $$tmp && mv $$tmp $(PLUGIN)
+	@git add $(PLUGIN)
+	@git commit -m "Release v$(VERSION)"
+	@git tag -a v$(VERSION) -m "v$(VERSION)"
+	@echo "Tagged v$(VERSION). Push the commit and tag to release: git push --follow-tags"
+
 release-snapshot:
 	goreleaser release --snapshot --clean