fix(plugins): release each ABI as a new plugin version and verify the built kit matches its label (#1380)

Author: datlechin

.github/workflows/build-plugin.yml

@@ -248,6 +248,24 @@ jobs:
           ./scripts/build-plugin.sh "${{ steps.plugin.outputs.target }}" arm64 "${{ steps.plugin.outputs.version }}"
           ./scripts/build-plugin.sh "${{ steps.plugin.outputs.target }}" x86_64 "${{ steps.plugin.outputs.version }}"
 
+      - name: Verify built PluginKit version matches the release label
+        run: |
+          BUNDLE_NAME="${{ steps.plugin.outputs.bundleName }}"
+          EXPECTED="${{ matrix.pluginKitVersion }}"
+          WORK=$(mktemp -d)
+          unzip -oq "build/Plugins/${BUNDLE_NAME}-arm64.zip" -d "$WORK"
+          PLIST=$(find "$WORK" -path '*.tableplugin/Contents/Info.plist' | head -1)
+          if [ -z "$PLIST" ]; then
+            echo "::error::Could not find Info.plist in the built ${BUNDLE_NAME} bundle."
+            exit 1
+          fi
+          ACTUAL=$(plutil -extract TableProPluginKitVersion raw "$PLIST")
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "::error::${BUNDLE_NAME} was built for PluginKit $ACTUAL but this release is labeled PluginKit $EXPECTED. Refusing to publish a mislabeled binary. Re-release from a commit whose plugin Info.plist matches the target PluginKit version."
+            exit 1
+          fi
+          echo "Verified ${BUNDLE_NAME}: built PluginKit $ACTUAL matches the release label."
+
       - name: Read checksums
         id: sha
         run: |

scripts/release-all-plugins.sh

@@ -4,9 +4,13 @@
 # Usage: ./scripts/release-all-plugins.sh <pluginKitVersion>
 # Example: ./scripts/release-all-plugins.sh 14
 #
-# Reads the latest tag for each plugin from git, pairs it with the given
-# pluginKitVersion, and fires one workflow_dispatch on build-plugin.yml so all
-# plugins build in parallel as a single matrix run.
+# Reads the latest tag for each plugin, bumps the patch version, and pairs the
+# NEW version with the given pluginKitVersion, then fires one workflow_dispatch
+# on build-plugin.yml so all plugins build in parallel as a single matrix run.
+#
+# An ABI bump must publish fresh binaries at a NEW release tag. Reusing the
+# existing tag overwrites that release's assets, which breaks the previous ABI's
+# consumers and serves stale copies from the GitHub release CDN.
 #
 # Prerequisites: gh CLI authenticated, run from repo root.
 
@@ -59,16 +63,20 @@ for PLUGIN in "${PLUGINS[@]}"; do
     done
 done
 
+git fetch --tags --quiet origin 2>/dev/null || true
+
 TAG_LIST=""
 FIRST=true
-echo "Resolving latest tag for each plugin:"
+echo "Resolving next release version for each plugin (PluginKit $PKV):"
 for PLUGIN in "${PLUGINS[@]}"; do
     LATEST_TAG=$(git tag -l "plugin-${PLUGIN}-v*" | sort -V | tail -1)
     if [ -z "$LATEST_TAG" ]; then
         echo "  WARNING: No tag found for plugin-${PLUGIN}-v*. Skipping."
         continue
     fi
-    PAIR="${LATEST_TAG}:${PKV}"
+    LATEST_VER="${LATEST_TAG#plugin-${PLUGIN}-v}"
+    NEW_TAG="plugin-${PLUGIN}-v${LATEST_VER%.*}.$(( ${LATEST_VER##*.} + 1 ))"
+    PAIR="${NEW_TAG}:${PKV}"
     if [ "$FIRST" = true ]; then
         TAG_LIST="$PAIR"
         FIRST=false