From 2a7bf8ca4e5392b7ba36133030e87da19f0a1532 Mon Sep 17 00:00:00 2001
From: "Jason R. Clark" <jasonrclark@github.com>
Date: Tue, 7 Apr 2026 23:07:13 +0000
Subject: [PATCH 1/4] Script to just confirm tagged version matches code
 version

---
 .github/workflows/check-version.sh | 11 +++++++++++
 cmd/version.go                     |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100755 .github/workflows/check-version.sh

diff --git a/.github/workflows/check-version.sh b/.github/workflows/check-version.sh
new file mode 100755
index 0000000..66d3f53
--- /dev/null
+++ b/.github/workflows/check-version.sh
@@ -0,0 +1,11 @@
+#! /bin/bash
+
+set -ex
+
+TAG=$(git describe --tags --abbrev=0)
+FILE_VERSION=$(sed -nE 's/var Version = "(.*)"/\1/p' cmd/version.go)
+
+if [ "$TAG" != "v$FILE_VERSION" ]; then
+  echo "Version mismatch: tag is $TAG but version.go has $FILE_VERSION"
+  exit 1
+fi
\ No newline at end of file
diff --git a/cmd/version.go b/cmd/version.go
index a1cf6a4..fda328f 100644
--- a/cmd/version.go
+++ b/cmd/version.go
@@ -8,7 +8,7 @@ import (
 )
 
 // Version of the CLI app.
-var Version = "0.1.0"
+var Version = "0.0.10"
 
 // The command prints out the version of the CLI app.
 func init() {

From 09e9bd93bbae48275b51889828fd6e408539dd75 Mon Sep 17 00:00:00 2001
From: "Jason R. Clark" <jasonrclark@github.com>
Date: Tue, 7 Apr 2026 23:11:23 +0000
Subject: [PATCH 2/4] Use script from release

---
 .github/workflows/release.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b0e7501..873b8fa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - name: Confirm tag and code versions match
+        run: |
+          .github/workflows/check-version.sh
+
       - uses: cli/gh-extension-precompile@v2
         with:
           generate_attestations: true

From 3fc40bbb4316680b57684a412ce55654897817c1 Mon Sep 17 00:00:00 2001
From: "Jason R. Clark" <jasonrclark@github.com>
Date: Tue, 7 Apr 2026 17:09:41 -0700
Subject: [PATCH 3/4] More standard shebang

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/check-version.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check-version.sh b/.github/workflows/check-version.sh
index 66d3f53..d2b557b 100755
--- a/.github/workflows/check-version.sh
+++ b/.github/workflows/check-version.sh
@@ -1,4 +1,4 @@
-#! /bin/bash
+#!/bin/bash
 
 set -ex
 

From 5828da271ec4a3a732a7be577f99864dd48b1763 Mon Sep 17 00:00:00 2001
From: "Jason R. Clark" <jasonrclark@github.com>
Date: Tue, 7 Apr 2026 17:11:28 -0700
Subject: [PATCH 4/4] Use GITHUB_REF_NAME instead of from git

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/check-version.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check-version.sh b/.github/workflows/check-version.sh
index d2b557b..a215757 100755
--- a/.github/workflows/check-version.sh
+++ b/.github/workflows/check-version.sh
@@ -2,7 +2,11 @@
 
 set -ex
 
-TAG=$(git describe --tags --abbrev=0)
+TAG="${GITHUB_REF_NAME:-${GITHUB_REF#refs/tags/}}"
+if [ -z "$TAG" ] || [ "$TAG" = "$GITHUB_REF" ]; then
+  echo "Unable to determine tag from GitHub Actions environment"
+  exit 1
+fi
 FILE_VERSION=$(sed -nE 's/var Version = "(.*)"/\1/p' cmd/version.go)
 
 if [ "$TAG" != "v$FILE_VERSION" ]; then