[CI] Restrict stable release workflows to vX.Y.Z and vX.Y.Z.postN tags

.github/workflows/_build-efa-wheel.yaml

@@ -83,6 +83,21 @@ jobs:
         with:
           persist-credentials: ${{ inputs.build-profile == 'release' }}
 
+      - name: Check tag matches wheel version
+        if: ${{ inputs.build-profile == 'release' }}
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          tag_version="${RELEASE_TAG#v}"
+          wheel_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' mooncake-wheel/pyproject.toml | head -n 1)"
+          if [[ "${tag_version}" != "${wheel_version}" ]]; then
+            echo "::error::Tag ${RELEASE_TAG} does not match mooncake-wheel/pyproject.toml version '${wheel_version}'; bump pyproject.toml and re-tag"
+            exit 1
+          fi
+          echo "Tag ${RELEASE_TAG} matches wheel version ${wheel_version}"
+
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:

.github/workflows/_build-wheel.yaml

@@ -119,6 +119,21 @@ jobs:
             echo "CMAKE_ARGS=$cmake_args"
           } >> "$GITHUB_ENV"
 
+      - name: Check tag matches wheel version
+        if: ${{ github.ref_type == 'tag' && inputs.version-override == '' }}
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          tag_version="${RELEASE_TAG#v}"
+          wheel_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' mooncake-wheel/pyproject.toml | head -n 1)"
+          if [[ "${tag_version}" != "${wheel_version}" ]]; then
+            echo "::error::Tag ${RELEASE_TAG} does not match mooncake-wheel/pyproject.toml version '${wheel_version}'; bump pyproject.toml and re-tag"
+            exit 1
+          fi
+          echo "Tag ${RELEASE_TAG} matches wheel version ${wheel_version}"
+
       - name: Set version
         run: |
           if [ -n "${{ inputs.version-override }}" ]; then

.github/workflows/pre-release.yaml

@@ -3,13 +3,15 @@ name: Pre-Release
 # Build the same core wheel matrix as the stable release workflows and attach
 # the artifacts to a GitHub Pre-release. Also publish the exact artifacts to
 # TestPyPI, then consume them in smoke and T-one tests. No production PyPI upload.
+# Stable vX.Y.Z / vX.Y.Z.postN tags go to release*.yaml instead. Tags that match
+# neither set (e.g. v0.3.14a1, v0.3.14post1) trigger no workflow at all.
 on:
   push:
     tags:
-      - 'v*-rc*'
-      - 'v*-alpha*'
-      - 'v*-beta*'
-      - 'v*-pre*'
+      - 'v*rc*'
+      - 'v*alpha*'
+      - 'v*beta*'
+      - 'v*pre*'
 
 jobs:
   version-stamp:

.github/workflows/release-cuda13.yaml

@@ -2,8 +2,12 @@ name: Release CUDA 13
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
 
 jobs:
   build:

.github/workflows/release-efa-cuda13.yaml

@@ -2,8 +2,12 @@ name: Release EFA CUDA 13
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
 
 # Publishes mooncake-transfer-engine-efa-cuda13, the CUDA 13-aware AWS EFA wheel.
 jobs:

.github/workflows/release-efa-non-cuda.yaml

@@ -2,8 +2,12 @@ name: Release EFA Non-CUDA
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
 
 # Publishes mooncake-transfer-engine-efa-non-cuda, the CPU/DRAM AWS EFA wheel.
 jobs:

.github/workflows/release-efa.yaml

@@ -2,8 +2,12 @@ name: Release EFA
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
 
 # Publishes mooncake-transfer-engine-efa, the CUDA 12-aware AWS EFA wheel.
 jobs:

.github/workflows/release-musa.yaml

@@ -2,8 +2,12 @@ name: Release MUSA
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
   workflow_dispatch:
     inputs:
       tag:
@@ -50,7 +54,7 @@ jobs:
           RELEASE_TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
-          if [[ "${RELEASE_TAG}" != v* || "${RELEASE_TAG}" == *-* ]]; then
+          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(\.post[0-9]+)?$ ]]; then
             echo "::error::Backfill tag must be a stable release tag starting with v"
             exit 1
           fi
@@ -63,6 +67,20 @@ jobs:
           fi
           echo "Build source: ${RELEASE_TAG} at ${BUILD_SHA}"
 
+      - name: Check tag matches wheel version
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          tag_version="${RELEASE_TAG#v}"
+          wheel_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' mooncake-wheel/pyproject.toml | head -n 1)"
+          if [[ "${tag_version}" != "${wheel_version}" ]]; then
+            echo "::error::Tag ${RELEASE_TAG} does not match mooncake-wheel/pyproject.toml version '${wheel_version}'; bump pyproject.toml and re-tag"
+            exit 1
+          fi
+          echo "Tag ${RELEASE_TAG} matches wheel version ${wheel_version}"
+
       - name: Setup Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:

.github/workflows/release-non-cuda.yaml

@@ -2,8 +2,12 @@ name: Release Non-CUDA
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
 
 jobs:
   # manylinux2_28 for the toolchain only (USE_CUDA=OFF); keeps the glibc floor

.github/workflows/release-npu.yaml

@@ -2,8 +2,12 @@ name: Release Ascend NPU
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
   workflow_dispatch:
     inputs:
       tag:
@@ -43,6 +47,31 @@ jobs:
           ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }}
           fetch-depth: 0
 
+      - name: Validate release tag
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(\.post[0-9]+)?$ ]]; then
+            echo "::error::Release tag must be a stable release tag (vX.Y.Z or vX.Y.Z.postN)"
+            exit 1
+          fi
+
+      - name: Check tag matches wheel version
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          tag_version="${RELEASE_TAG#v}"
+          wheel_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' mooncake-wheel/pyproject.toml | head -n 1)"
+          if [[ "${tag_version}" != "${wheel_version}" ]]; then
+            echo "::error::Tag ${RELEASE_TAG} does not match mooncake-wheel/pyproject.toml version '${wheel_version}'; bump pyproject.toml and re-tag"
+            exit 1
+          fi
+          echo "Tag ${RELEASE_TAG} matches wheel version ${wheel_version}"
+
       - name: Setup Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:

.github/workflows/release-rocm.yaml

@@ -2,8 +2,12 @@ name: Release ROCm
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
   workflow_dispatch:
     inputs:
       tag:
@@ -79,7 +83,7 @@ jobs:
           RELEASE_TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
-          if [[ "${RELEASE_TAG}" != v* || "${RELEASE_TAG}" == *-* ]]; then
+          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(\.post[0-9]+)?$ ]]; then
             echo "::error::Backfill tag must be a stable release tag starting with v"
             exit 1
           fi
@@ -91,6 +95,20 @@ jobs:
             exit 1
           fi
 
+      - name: Check tag matches wheel version
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          tag_version="${RELEASE_TAG#v}"
+          wheel_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' mooncake-wheel/pyproject.toml | head -n 1)"
+          if [[ "${tag_version}" != "${wheel_version}" ]]; then
+            echo "::error::Tag ${RELEASE_TAG} does not match mooncake-wheel/pyproject.toml version '${wheel_version}'; bump pyproject.toml and re-tag"
+            exit 1
+          fi
+          echo "Tag ${RELEASE_TAG} matches wheel version ${wheel_version}"
+
       - name: Ensure checked-out tree supports the ROCm wheel variant
         shell: bash
         run: |

.github/workflows/release.yaml

@@ -2,8 +2,14 @@ name: Release
 
 on:
   push:
+    # Stable tags only (vX.Y.Z or vX.Y.Z.postN). PEP 440 pre-release tags
+    # such as v0.3.14rc1 must not reach production PyPI; pre-release.yaml
+    # handles them. Any other form (v0.3.14a1, v0.3.14dev1, v0.3.14post1,
+    # v0.3.14+local) matches no release workflow, so nothing runs: re-tag
+    # in one of the forms above instead of pushing the same tag again.
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+.post[0-9]+'
 
 jobs:
   # Skip semver pre-release tags (e.g. v1.0.0-rc1); those are handled by pre-release.yaml.