From f5bb24b45c5bab0bb9ae360497446d27c2cf68b8 Mon Sep 17 00:00:00 2001
From: Ritwik G <ritwik@zipstack.com>
Date: Thu, 25 Jun 2026 18:47:18 +0530
Subject: [PATCH 1/2] [MISC] Reject no-op OSS releases when there are no new
 commits

create-release.yaml computed and published a new tag even when the branch had
no commits beyond the last release, producing empty releases (e.g. v0.177.1
points at the exact same commit as v0.177.0).

Add a guard after "Fetch base release version": use the compare API's ahead_by
(the workflow has no local checkout) to count commits on the branch beyond the
latest release tag. If zero, abort with a clear error (dry-run only warns).
Works for main and hotfix branches alike.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/create-release.yaml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
index cf7a178759..a082fdfc33 100644
--- a/.github/workflows/create-release.yaml
+++ b/.github/workflows/create-release.yaml
@@ -126,6 +126,30 @@ jobs:
           echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
           echo "Base release: $LATEST_TAG"
 
+      - name: Ensure there are new commits to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          LATEST_TAG: ${{ steps.get-latest.outputs.latest_tag }}
+          BRANCH: ${{ github.ref_name }}
+          DRY_RUN: ${{ github.event.inputs.dry_run }}
+        run: |
+          # Reject a no-op release: if the branch has no commits beyond the last release
+          # tag (e.g. main is already at v0.177.0), there is nothing to release. This
+          # prevents empty releases such as v0.177.1 pointing at the same commit as
+          # v0.177.0. The workflow has no local checkout, so use the compare API's
+          # `ahead_by` (commits on BRANCH not in LATEST_TAG).
+          AHEAD=$(gh api "repos/${{ github.repository }}/compare/${LATEST_TAG}...${BRANCH}" --jq '.ahead_by')
+          if [[ "$AHEAD" -eq 0 ]]; then
+            if [[ "$DRY_RUN" == "true" ]]; then
+              echo "::warning::No new commits on '$BRANCH' since $LATEST_TAG — a real run would be rejected (nothing to release)."
+            else
+              echo "::error::No new commits on '$BRANCH' since $LATEST_TAG — nothing to release. Aborting to avoid an empty release."
+              exit 1
+            fi
+          else
+            echo "✅ $AHEAD new commit(s) on '$BRANCH' since $LATEST_TAG"
+          fi
+
       - name: Compute next version
         id: compute-version
         env:

From c7206bbc17033826bd49fe1890e90617fb7fa611 Mon Sep 17 00:00:00 2001
From: Ritwik G <ritwik@zipstack.com>
Date: Thu, 25 Jun 2026 19:09:38 +0530
Subject: [PATCH 2/2] [MISC] Harden no-op guard: validate ahead_by, fail loudly
 on unexpected value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR review (Greptile + internal): `[[ "$AHEAD" -eq 0 ]]` mishandled a non-integer
ahead_by — an empty value evaluated true ([[ "" -eq 0 ]]) and would wrongly
reject a legitimate release, and a literal "null" aborted with a cryptic
"integer expression expected" / unbound-variable error.

Use `--jq '.ahead_by // empty'`, fail loudly if the compare API call fails, and
require ahead_by to match ^[0-9]+$ (error out otherwise) before a string compare
against "0". A transient/auth/shape error now fails the step with a clear
message instead of being mistaken for "no new commits".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/create-release.yaml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
index a082fdfc33..f9725ee0f4 100644
--- a/.github/workflows/create-release.yaml
+++ b/.github/workflows/create-release.yaml
@@ -137,9 +137,17 @@ jobs:
           # tag (e.g. main is already at v0.177.0), there is nothing to release. This
           # prevents empty releases such as v0.177.1 pointing at the same commit as
           # v0.177.0. The workflow has no local checkout, so use the compare API's
-          # `ahead_by` (commits on BRANCH not in LATEST_TAG).
-          AHEAD=$(gh api "repos/${{ github.repository }}/compare/${LATEST_TAG}...${BRANCH}" --jq '.ahead_by')
-          if [[ "$AHEAD" -eq 0 ]]; then
+          # `ahead_by` (commits on BRANCH not in LATEST_TAG). `// empty` stops a null/
+          # absent value from reaching the comparison as the literal "null"; we then
+          # require a non-negative integer and fail loudly on anything unexpected, so a
+          # transient API error is never mistaken for "no new commits".
+          AHEAD=$(gh api "repos/${{ github.repository }}/compare/${LATEST_TAG}...${BRANCH}" --jq '.ahead_by // empty') \
+            || { echo "::error::Could not query commits since $LATEST_TAG (compare API failed)."; exit 1; }
+          if ! [[ "$AHEAD" =~ ^[0-9]+$ ]]; then
+            echo "::error::Unexpected ahead_by='${AHEAD:-<empty>}' from compare ${LATEST_TAG}...${BRANCH}; refusing to guess."
+            exit 1
+          fi
+          if [[ "$AHEAD" == "0" ]]; then
             if [[ "$DRY_RUN" == "true" ]]; then
               echo "::warning::No new commits on '$BRANCH' since $LATEST_TAG — a real run would be rejected (nothing to release)."
             else
