Where
.github/workflows/build-release-task.yml, the "Verify public release version step" added in PR #184 (the main-only backstop that refuses a public release whose version carries a prerelease suffix):
if [[ "$SEMVER2"==*-* ]];thenecho"::error::Public (main) release version '$SEMVER2' carries a prerelease suffix; refusing to publish."exit 1
fi
Issue
*-* matches a -anywhere in the string. In SemVer 2.0 a - is the prerelease separator only in the prerelease segment; build metadata (everything after +) may also legitimately contain -. So a version like 1.7.0+gabc-def (build metadata containing a hyphen) would be wrongly rejected as a prerelease.
In the current NBGV configuration this is latent: NBGV emits build metadata of the form +...g<sha> (no -), and the only - it produces is the genuine prerelease separator (the -g<sha> git-height suffix the guard's own comment names). So today the guard is correct. It's fragile, though - any change to the versioning scheme or build-metadata format could turn it into a false failure on a legitimate public release.
Suggested fix
Strip build metadata before the check, or match the prerelease separator specifically after the numeric core, e.g.:
core_and_pre="${SEMVER2%%+*}"# drop +buildmetadataif [[ "$core_and_pre"==*-* ]];then ...Credit / provenance
Surfaced by the GitHub Copilot reviewer on ptr727/ESPHome-NonRoot PR #77 (promotion of the PR #184 re-sync). Reported upstream rather than patched locally because this is verbatim-carried template code - filing here so the fix lands for every derived repo and flows back via re-sync.
Where
.github/workflows/build-release-task.yml, the "Verify public release version step" added in PR #184 (themain-only backstop that refuses a public release whose version carries a prerelease suffix):Issue
*-*matches a-anywhere in the string. In SemVer 2.0 a-is the prerelease separator only in the prerelease segment; build metadata (everything after+) may also legitimately contain-. So a version like1.7.0+gabc-def(build metadata containing a hyphen) would be wrongly rejected as a prerelease.In the current NBGV configuration this is latent: NBGV emits build metadata of the form
+...g<sha>(no-), and the only-it produces is the genuine prerelease separator (the-g<sha>git-height suffix the guard's own comment names). So today the guard is correct. It's fragile, though - any change to the versioning scheme or build-metadata format could turn it into a false failure on a legitimate public release.Suggested fix
Strip build metadata before the check, or match the prerelease separator specifically after the numeric core, e.g.:
Credit / provenance
Surfaced by the GitHub Copilot reviewer on
ptr727/ESPHome-NonRootPR #77 (promotion of the PR #184 re-sync). Reported upstream rather than patched locally because this is verbatim-carried template code - filing here so the fix lands for every derived repo and flows back via re-sync.