From e2d850c2e95a3a941f5b33987cd508f115068ee2 Mon Sep 17 00:00:00 2001
From: john <cynell@139.com>
Date: Wed, 15 Jul 2026 11:31:43 +0800
Subject: [PATCH] fix: require exact main release branch for imgproxy

---
 scripts/imgproxy-runtime-package.test.mjs | 2 ++
 scripts/release-imgproxy-runtime-prod.sh  | 5 +++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/imgproxy-runtime-package.test.mjs b/scripts/imgproxy-runtime-package.test.mjs
index 2da36f9..a576790 100644
--- a/scripts/imgproxy-runtime-package.test.mjs
+++ b/scripts/imgproxy-runtime-package.test.mjs
@@ -25,4 +25,6 @@ test('release verifies checksums before loading the image and backs up launch st
   assert.match(release, /docker load/);
   assert.match(release, /imgproxy-compat-\$RELEASE_ID\.plist/);
   assert.match(release, /img\.tkmind\.cn\/health/);
+  assert.match(release, /release\/\*/);
+  assert.match(release, /rev-parse origin\/main/);
 });
diff --git a/scripts/release-imgproxy-runtime-prod.sh b/scripts/release-imgproxy-runtime-prod.sh
index 356b5cb..488205e 100644
--- a/scripts/release-imgproxy-runtime-prod.sh
+++ b/scripts/release-imgproxy-runtime-prod.sh
@@ -13,9 +13,10 @@ TMP="$(mktemp -d "${TMPDIR:-/tmp}/imgproxy-runtime-release.XXXXXX")"
 cleanup() { rm -rf "$TMP"; }
 trap cleanup EXIT
 
-[[ "$(git -C "$ROOT" branch --show-current)" == "main" ]] || { echo 'imgproxy production release must run from main' >&2; exit 1; }
-[[ -z "$(git -C "$ROOT" status --porcelain)" ]] || { echo 'worktree must be clean' >&2; exit 1; }
 git -C "$ROOT" fetch origin main --quiet
+branch="$(git -C "$ROOT" branch --show-current)"
+[[ "$branch" == release/* ]] || { echo 'imgproxy production release must run from a release/* branch' >&2; exit 1; }
+[[ -z "$(git -C "$ROOT" status --porcelain)" ]] || { echo 'worktree must be clean' >&2; exit 1; }
 [[ "$(git -C "$ROOT" rev-parse HEAD)" == "$(git -C "$ROOT" rev-parse origin/main)" ]] || { echo 'main must match origin/main' >&2; exit 1; }
 bash "$ROOT/scripts/check-release-ready.sh"