Fix release workflow: tag regex, artifact validation, and token usage by Thedarkmatter10 · Pull Request #187 · apple/container
🔧 Summary
This PR improves the release.yml GitHub Actions workflow by addressing several critical issues to ensure consistent and reliable behavior during tag-based releases.
✅ Changes Included
1. Fixed tag trigger regex
- Escaped dots in the tag regex ([0-9]+\.[0-9]+\.[0-9]+) to ensure only semantic version tags like 1.2.3 trigger the workflow.
Explanation
- Old Regex is incorrect because . matches any character, so it matched:
1-2-3, 1_2_3, even 1a2b3, which is invalid for versioning.
- Fixed Regex is strict — matches only 1.2.3.
Find attached tested SCREEN SHOT BELOW .
Proper Match with Fixed Regex:

💬 Note: If you're planning to adopt alternate version tag formats in the future — such as:
-
v1.0.2 (semantic with prefix)
-
release-1.0.2 or rel-1.0.2
-
1.0.2-beta, 1.0.2-rc.1 (prereleases with suffixes)
-
x1.0.2x (custom wrapping formats)
…feel free to reach out. I'm happy to help extend the workflow to support those formats reliably and safely.
2. Added strict release job guard
- Prevented accidental release runs on non-tag events using if: startsWith(github.ref, 'refs/tags/').
3. Explicit artifact validation
- Introduced a shell check using ls and test to ensure .zip and .pkg files exist before attempting release. This gives early, clear failure instead of a vague error from
action-gh-release.
4. Clarified GitHub token usage
- Switched from ${{ secrets.GITHUB_TOKEN }} to ${{ github.token }} for better readability and consistency with GitHub Actions best practices.