Publish curated Knowledge Hub source from 2ed833f290b439a7bc91e5fd19b042c269e3bee9

scripts/generate-release-manifest.mjs

@@ -24,6 +24,12 @@ import { spawnSync } from "node:child_process";
 
 const repoRoot = process.cwd();
 const outputPath = process.argv[2] ?? path.join(repoRoot, "release-manifest.json");
+const semverIdentifier = "(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)";
+const semverPattern = new RegExp(
+  `^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)` +
+  `(?:-(${semverIdentifier}(?:\\.${semverIdentifier})*))?` +
+  `(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$`
+);
 
 function sha256File(relativePath) {
   const fullPath = path.join(repoRoot, relativePath);
@@ -88,6 +94,18 @@ function readOpenApiVersion() {
 }
 
 function readSemanticVersion() {
+  const releaseTag = nonEmpty(process.env.RELEASE_TAG);
+  if (releaseTag) {
+    const version = releaseTag.startsWith("v") ? releaseTag.slice(1) : "";
+    if (!version || !semverPattern.test(version)) {
+      throw new Error(`RELEASE_TAG must be a v-prefixed semantic version; received '${releaseTag}'.`);
+    }
+    // Docker's web-build stage intentionally has no .git directory. A validated
+    // release tag is therefore the authoritative semantic version for tagged
+    // images, while the full tag remains separately recorded as releaseTag.
+    return version;
+  }
+
   const versionFile = path.join(repoRoot, "VERSION");
   if (fs.existsSync(versionFile)) {
     return fs.readFileSync(versionFile, "utf8").trim();