From 3c66ab958ad30911135bc84242afd310dcbbab41 Mon Sep 17 00:00:00 2001
From: CJACK <tetr20071102@gmail.com>
Date: Mon, 23 Feb 2026 01:57:52 +0800
Subject: [PATCH] ci: fix GHCR probe and require explicit release tag upload

---
 .github/workflows/release-artifacts.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 403323e..d9e4dbe 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -156,9 +156,19 @@ jobs:
           set -euo pipefail
           (cd dist && sha256sum *.tar.gz *.zip > sha256sums.txt)
 
+      - name: Validate release tag
+        run: |
+          set -euo pipefail
+          TAG="${{ github.event.release.tag_name }}"
+          if [ -z "${TAG}" ]; then
+            echo "release.tag_name is empty; this workflow must run from a published GitHub Release." >&2
+            exit 1
+          fi
+
       - name: Upload Release Assets
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ github.event.release.tag_name }}
           files: |
             dist/*.tar.gz
             dist/*.zip