From c070f10d2c06d49401dc7da738ed28b2091819c0 Mon Sep 17 00:00:00 2001
From: SavinduDimal <dimalsavindu@gmail.com>
Date: Tue, 21 Jul 2026 11:04:32 +0530
Subject: [PATCH] Disable auto-release for SDK workflows

---
 .github/workflows/sdk-ai-release.yml   | 22 +++++++++++++---------
 .github/workflows/sdk-core-release.yml | 22 +++++++++++++---------
 .github/workflows/sdk-release.yml      | 22 +++++++++++++---------
 3 files changed, 39 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/sdk-ai-release.yml b/.github/workflows/sdk-ai-release.yml
index 1ea2ee120c..9c852b58c1 100644
--- a/.github/workflows/sdk-ai-release.yml
+++ b/.github/workflows/sdk-ai-release.yml
@@ -1,11 +1,9 @@
 name: SDK AI Release
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'sdk/ai/**'
+  # Auto-release on merge to main is disabled — releasing SDK AI is manual-only
+  # to prevent an unintended version bump/tag on every merge that touches sdk/ai/**.
+  # Trigger a release via Actions → "Run workflow" with an explicit version.
   workflow_dispatch:
     inputs:
       version:
@@ -27,12 +25,18 @@ jobs:
 
       - name: Determine version
         id: version
+        env:
+          # Pass the untrusted input via env — never interpolate it into the shell script body.
+          INPUT_VERSION: ${{ inputs.version }}
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            # Manual trigger - use provided version
-            VERSION="${{ inputs.version }}"
-            # Remove leading 'v' if present
-            VERSION="${VERSION#v}"
+            # Manual trigger - use provided version (read from env, remove leading 'v' if present)
+            VERSION="${INPUT_VERSION#v}"
+            # Validate strict semantic version (MAJOR.MINOR.PATCH) before it reaches any tag/push command
+            if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+              echo "Error: provided version is not a valid semantic version (expected MAJOR.MINOR.PATCH, e.g. 0.3.10)"
+              exit 1
+            fi
             echo "Using manually provided version: ${VERSION}"
           else
             # Push trigger (PR merge) - auto-increment patch version
diff --git a/.github/workflows/sdk-core-release.yml b/.github/workflows/sdk-core-release.yml
index 11ec8bd93d..162fcb5b93 100644
--- a/.github/workflows/sdk-core-release.yml
+++ b/.github/workflows/sdk-core-release.yml
@@ -1,11 +1,9 @@
 name: SDK Core Release
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'sdk/core/**'
+  # Auto-release on merge to main is disabled — releasing SDK Core is manual-only
+  # to prevent an unintended version bump/tag on every merge that touches sdk/core/**.
+  # Trigger a release via Actions → "Run workflow" with an explicit version.
   workflow_dispatch:
     inputs:
       version:
@@ -27,12 +25,18 @@ jobs:
 
       - name: Determine version
         id: version
+        env:
+          # Pass the untrusted input via env — never interpolate it into the shell script body.
+          INPUT_VERSION: ${{ inputs.version }}
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            # Manual trigger - use provided version
-            VERSION="${{ inputs.version }}"
-            # Remove leading 'v' if present
-            VERSION="${VERSION#v}"
+            # Manual trigger - use provided version (read from env, remove leading 'v' if present)
+            VERSION="${INPUT_VERSION#v}"
+            # Validate strict semantic version (MAJOR.MINOR.PATCH) before it reaches any tag/push command
+            if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+              echo "Error: provided version is not a valid semantic version (expected MAJOR.MINOR.PATCH, e.g. 0.3.10)"
+              exit 1
+            fi
             echo "Using manually provided version: ${VERSION}"
           else
             # Push trigger (PR merge) - auto-increment patch version
diff --git a/.github/workflows/sdk-release.yml b/.github/workflows/sdk-release.yml
index b1f82c7cae..74d52fa831 100644
--- a/.github/workflows/sdk-release.yml
+++ b/.github/workflows/sdk-release.yml
@@ -1,11 +1,9 @@
 name: SDK Release
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'sdk/**'
+  # Auto-release on merge to main is disabled — releasing the SDK is manual-only
+  # to prevent an unintended version bump/tag on every merge that touches sdk/**.
+  # Trigger a release via Actions → "Run workflow" with an explicit version.
   workflow_dispatch:
     inputs:
       version:
@@ -27,12 +25,18 @@ jobs:
 
       - name: Determine version
         id: version
+        env:
+          # Pass the untrusted input via env — never interpolate it into the shell script body.
+          INPUT_VERSION: ${{ inputs.version }}
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            # Manual trigger - use provided version
-            VERSION="${{ inputs.version }}"
-            # Remove leading 'v' if present
-            VERSION="${VERSION#v}"
+            # Manual trigger - use provided version (read from env, remove leading 'v' if present)
+            VERSION="${INPUT_VERSION#v}"
+            # Validate strict semantic version (MAJOR.MINOR.PATCH) before it reaches any tag/push command
+            if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+              echo "Error: provided version is not a valid semantic version (expected MAJOR.MINOR.PATCH, e.g. 0.3.10)"
+              exit 1
+            fi
             echo "Using manually provided version: ${VERSION}"
           else
             # Push trigger (PR merge) - auto-increment patch version