From 19bd6ebac0a601ee0ce89fbf2b98f47c92fd7cd7 Mon Sep 17 00:00:00 2001 From: "InstaWP Engineer (bot)" Date: Wed, 9 Sep 2026 07:16:42 +0000 Subject: [PATCH] ci: only release tags publish to WordPress.org The release trigger was 'on: push: tags: [*]', matching any tag name, so a tag created for a non-release purpose would publish its commit to WordPress.org. That is the exact mechanism that caused the 2026-09-07 incident in InstaWP/instawp-connect, where a tag created only to pin a commit for reference deployed a malicious commit to SVN trunk. This repo was NOT affected by that incident - verified clean on every branch and tag - but it carried the same configuration and the same SVN credentials. Verified against all 13 existing tags: all 13 still match, pre-releases 2.6.0-beta1/beta2 included. 'incident-14ypaj0acdw', 'evidence' and 'wip' do not. Co-Authored-By: Claude Opus 5 --- .github/workflows/trunk-release-tag.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/trunk-release-tag.yml b/.github/workflows/trunk-release-tag.yml index 9f25a3b..d4aea08 100644 --- a/.github/workflows/trunk-release-tag.yml +++ b/.github/workflows/trunk-release-tag.yml @@ -4,7 +4,20 @@ name: Create release on: push: tags: - - '*' + # Release tags only. This was '*', which matched ANY tag name, so a tag + # created for something other than a release — pinning a commit for + # reference, for instance — would publish that commit to WordPress.org. + # That is not hypothetical: it happened to InstaWP/instawp-connect on + # 2026-09-07, where a tag named 'incident-14ypaj0acdw' deployed its + # commit to SVN trunk and the public download served it. + # + # Every release tag here is a bare version (2.6.7, 2.6.0-beta1, ...), so + # requiring a digit-led "N.N" prefix covers all 13 existing tags, + # pre-releases included, and excludes names like that one. + # + # To pin a commit without publishing it, use a ref outside refs/tags — + # e.g. refs/incident/ — which no workflow watches. + - '[0-9]+.[0-9]+*' jobs: build: