From 1a85619acaf4a14c54670b0b15aaa5ff080a21d9 Mon Sep 17 00:00:00 2001
From: Tony Giorgio <tonygiorgio@protonmail.com>
Date: Sat, 23 May 2026 20:43:17 -0500
Subject: [PATCH] Validate release tag matches app version

---
 .github/workflows/release.yml          |  8 ++----
 flake.nix                              |  9 +++++++
 scripts/ci/validate-release-version.sh | 36 ++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 6 deletions(-)
 create mode 100755 scripts/ci/validate-release-version.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a30e3c61..9ac206029 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,12 +30,8 @@ jobs:
             exit 1
           fi
 
-          if [[ ! "${RELEASE_TAG}" =~ ^v?[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z.-]+)?([+][0-9A-Za-z.-]+)?$ ]]; then
-            echo "Refusing to build unexpected release tag: ${RELEASE_TAG}" >&2
-            exit 1
-          fi
-
-          echo "version=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
+          version="$(./scripts/ci/validate-release-version.sh "${RELEASE_TAG}")"
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
 
   build-tauri:
     needs: create-release
diff --git a/flake.nix b/flake.nix
index 14fbe59c6..4e4ab0076 100644
--- a/flake.nix
+++ b/flake.nix
@@ -662,6 +662,15 @@
               zapstore-publish.yml
             touch "$out"
           '';
+
+          release-metadata = pkgs.runCommand "maple-release-metadata-check" {
+            nativeBuildInputs = commonPackages;
+            src = ./.;
+          } ''
+            cd "$src"
+            bash ./scripts/ci/validate-release-version.sh >/dev/null
+            touch "$out"
+          '';
         };
 
         apps = {
diff --git a/scripts/ci/validate-release-version.sh b/scripts/ci/validate-release-version.sh
new file mode 100755
index 000000000..ad7b93f0a
--- /dev/null
+++ b/scripts/ci/validate-release-version.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/_common.sh"
+
+release_tag="${1:-${RELEASE_TAG:-${GITHUB_REF_NAME:-}}}"
+package_version="$(jq -er '.version' "${FRONTEND_DIR}/package.json")"
+tauri_version="$(jq -er '.version' "${TAURI_DIR}/tauri.conf.json")"
+
+if [ "${package_version}" != "${tauri_version}" ]; then
+  echo "frontend/package.json version does not match frontend/src-tauri/tauri.conf.json." >&2
+  echo "package=${package_version}" >&2
+  echo "tauri=${tauri_version}" >&2
+  exit 1
+fi
+
+if [ -z "${release_tag}" ]; then
+  printf '%s\n' "${tauri_version}"
+  exit 0
+fi
+
+if [[ ! "${release_tag}" =~ ^v?[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z.-]+)?([+][0-9A-Za-z.-]+)?$ ]]; then
+  echo "Refusing to build unexpected release tag: ${release_tag}" >&2
+  exit 1
+fi
+
+release_version="${release_tag#v}"
+if [ "${release_version}" != "${tauri_version}" ]; then
+  echo "Release tag version does not match app version." >&2
+  echo "tag=${release_tag}" >&2
+  echo "tag_version=${release_version}" >&2
+  echo "app_version=${tauri_version}" >&2
+  exit 1
+fi
+
+printf '%s\n' "${release_version}"