From 13673308ebefdc4cf88ee7c90b8d93a40d187739 Mon Sep 17 00:00:00 2001
From: Pavel Feldman <pavel.feldman@gmail.com>
Date: Tue, 13 Oct 2026 16:38:45 -0700
Subject: [PATCH] devops: publish only tags on their release branch

---
 .github/workflows/publish.yml | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 649668c2a..a409ae39b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -30,10 +30,27 @@ jobs:
         fetch-depth: 0
     - name: Check the tag
       run: |
-        if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+        if [[ ! "$TAG" =~ ^v([0-9]+\.[0-9]+)\.[0-9]+$ ]]; then
           echo "Can only publish a release tag (vX.Y.Z), got: $TAG"
           exit 1
         fi
+        MINOR="${BASH_REMATCH[1]}"
+        BRANCH="release-$MINOR"
+        if ! git rev-parse --verify --quiet "origin/$BRANCH" > /dev/null; then
+          echo "Branch $BRANCH does not exist, so $TAG cannot be on it"
+          exit 1
+        fi
+        if ! git merge-base --is-ancestor HEAD "origin/$BRANCH"; then
+          echo "$TAG is not on $BRANCH"
+          exit 1
+        fi
+        # Release branches are cut from main, so the head of an older release
+        # branch can also be on $BRANCH. Check the driver version too.
+        DRIVER="$(cat DRIVER_VERSION)"
+        if [[ "$DRIVER" != "$MINOR."* ]]; then
+          echo "$TAG has driver $DRIVER, expected $MINOR.x"
+          exit 1
+        fi
     - name: Set up Python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with: