ci: enforce tag == umbrella version on tag push

Author: SERDUN

.github/workflows/tag-version-check.yaml

@@ -0,0 +1,30 @@
+name: tag-version-check
+
+# Enforces the release invariant: a version tag X.Y.Z must sit on a commit whose
+# umbrella webtrit_callkeep/pubspec.yaml version is X.Y.Z (see docs/release_process.md).
+
+on:
+  push:
+    tags:
+      - "*.*.*"
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify umbrella version matches the tag
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          VERSION_FIELD=$(grep -m1 '^version:' webtrit_callkeep/pubspec.yaml | awk '{print $2}')
+          VERSION="${VERSION_FIELD%%+*}"
+          echo "tag=$TAG  pubspec version=$VERSION_FIELD (base $VERSION)"
+          if [ "$VERSION" != "$TAG" ]; then
+            echo "::error::Tag '$TAG' does not match webtrit_callkeep version '$VERSION_FIELD'. The tag must sit on the version-bump commit (see docs/release_process.md)."
+            exit 1
+          fi
+          echo "OK: tag matches the umbrella version."

docs/release_process.md

@@ -39,9 +39,10 @@ where that version is already set. Tags are **immutable** - never move a publish
 
 ## Enforcement
 
-A CI check validates the invariant on tag push: it reads `webtrit_callkeep/pubspec.yaml` at the
-tagged commit and fails if the `X.Y.Z` part of `version:` does not equal the tag name. This makes
-every published tag a reliable, immutable pointer to its exact release.
+A CI check (`.github/workflows/tag-version-check.yaml`) validates the invariant on tag push: it
+reads `webtrit_callkeep/pubspec.yaml` at the tagged commit and fails if the `X.Y.Z` part of
+`version:` does not equal the tag name. This makes every published tag a reliable, immutable
+pointer to its exact release.
 
 ## Tag corrections