Refuse to bump the tap when the version string disagrees with the tag

[k3KAW8Pnf7mkmdSMPHz27]

Why

Sources/EventKitService/EventKitService.swift hardcodes public let eventKitServiceVersion = "1.0.0". The binary reports that string from --version (the ArgumentParser CommandConfiguration) and in MCP serverInfo (EventKitMCPServer.swift). Homebrew takes its version from the git tag. So if v1.1.0 is tagged without bumping the string, brew list says 1.1.0 while the server tells Claude Desktop it is 1.0.0. No test pins the string.

Every release passes through bump-tap.yml, so the check goes there.

What

A new step, Check the version string matches the tag, runs right after "Resolve tag and commit" and before "Mint a scoped token for the tap". It:

1. Reads EventKitService.swift at the resolved commit SHA (steps.release.outputs.sha), not at the run's own ref. Under workflow_dispatch the run's ref is a branch, not the tag.

2. Fails closed. The step errors, naming the file, when:

   • the fetch fails (missing file, bad SHA, API error), or
   • the public let eventKitServiceVersion = "..." declaration matches zero times or more than once.

3. Compares the string to ${TAG#v}. On a mismatch it prints both values and what to do:

   ::error::Sources/EventKitService/EventKitService.swift at v9.9.9 declares eventKitServiceVersion = "1.0.0", but the tag says 9.9.9. Bump the string to "9.9.9" on main, then re-tag v9.9.9 on that commit.
   

Because it runs before the token step, a bad tag fails before any credential is minted. The tag, SHA and repo reach the script through env:, the same pattern as the existing steps. The file's contents never touch a ${{ }} expression.

How the file is fetched: gh api, not actions/checkout

gh api -H 'Accept: application/vnd.github.raw+json' \
  "repos/${SOURCE_REPO}/contents/${VERSION_FILE}?ref=${SHA}"

This uses the default GITHUB_TOKEN under the existing contents: read, so permissions are unchanged. I chose it over a sparse checkout because:

• It is one request for one file. A checkout at a SHA still fetches the commit's tree and sets up a git repo on the runner.
• It adds no new action use and no extra with: settings (ref, sparse-checkout, sparse-checkout-cone-mode, persist-credentials, path).
• It leaves no token behind. actions/checkout writes the token into .git/config unless persist-credentials: false is set, and this job later checks out the tap with a different token.
• A missing file comes back as an HTTP 404, and the step turns that into an ::error::.

The response goes to $RUNNER_TEMP, and grep/cut read it from there. cut -d '"' -f 2 takes the value between the first pair of quotes on the one matching line.

Testing

Real run. gh workflow run bump-tap.yml --ref bump-tap-version-guard -f tag=v1.0.0 ran run 35894192997, which succeeded:

Step	Result
Resolve tag and commit	success (Pinning v1.0.0 -> dc1316c…)
Check the version string matches the tag	success (eventKitServiceVersion at v1.0.0 is "1.0.0"; matches the tag.)
Mint a scoped token for the tap	success
Check out the tap	success
Rewrite the formula pin	success (Formula already pinned to v1.0.0; nothing to do.)
Write the PR body / Open or update the bump PR	skipped (no change)
Revoke the token	success

No PR was opened on the tap.

Local runs. I ran the step's parse and compare lines verbatim against the real file and against edited copies in /tmp. The fetch line ran separately with its values filled in.

Case	Result
v1.0.0 vs the real file at dc1316c	passes: eventKitServiceVersion at v1.0.0 is "1.0.0"; matches the tag.
v9.9.9 vs the real file	exit 1, mismatch error as shown above
declaration changed to public var	exit 1: Expected exactly one 'public let eventKitServiceVersion = "..."' in Sources/EventKitService/EventKitService.swift at v1.0.0, found 0
declaration duplicated	exit 1: same error, found 2
empty file	exit 1: same error, found 0
stale commented-out declaration above the real one	passes (the pattern is anchored, so comments don't match)
missing file (Sources/Nope.swift)	gh: Not Found (HTTP 404), then exit 1: Could not read Sources/Nope.swift at v1.0.0 (dc1316c…)

ruby -ryaml parses the workflow, and the new step is at index 1, ahead of the token step. actionlint and shellcheck were not run because they are not installed.

[k3KAW8Pnf7mkmdSMPHz27]

Closing without merging. Superseded by #8.

This guard checks that the tagged commit's eventKitServiceVersion equals the tag, and it works as written. The dispatch run against v1.0.0 passed, and the negative cases failed closed. #8 changes where the version lives, though. The source now keeps a 0.0.0-dev placeholder, and the Homebrew formula writes the tag's version in at build time (k3KAW8Pnf7mkmdSMPHz27/homebrew-mcp#1). Under that design, every tagged commit holds the placeholder, so this guard would block every release.

The mismatch it was meant to catch is now caught in two other places:

• The formula's inreplace fails the build if the declaration can't be found.
• The formula's test do asserts that --version equals the formula's version.