From e2fba62dfb58d8ff2d5c599c5a14b8cd0578919e Mon Sep 17 00:00:00 2001
From: Allison Thackston <73732028+althack@users.noreply.github.com>
Date: Wed, 29 Jul 2026 16:29:49 -0700
Subject: [PATCH] Protect unreleased manifests from release version drift

---
 .github/scripts/set-devcontainer-version.sh    | 13 +++++++++++++
 .github/workflows/release.yaml                 | 18 ++++++++++++++++++
 .../devcontainer-feature.json                  |  2 +-
 templates/src/gz/devcontainer-template.json    |  2 +-
 4 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/set-devcontainer-version.sh b/.github/scripts/set-devcontainer-version.sh
index 2f2b06d..4649025 100755
--- a/.github/scripts/set-devcontainer-version.sh
+++ b/.github/scripts/set-devcontainer-version.sh
@@ -16,6 +16,11 @@ if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?(\+[0-9A-Za-
     exit 1
 fi
 
+if [[ "${version}" == "0.0.0" ]]; then
+    echo "Version 0.0.0 is reserved for unreleased source manifests." >&2
+    exit 1
+fi
+
 mapfile -t manifest_files < <(
     find features/src templates/src -type f \
         \( -name 'devcontainer-feature.json' -o -name 'devcontainer-template.json' \) \
@@ -33,3 +38,11 @@ for manifest_file in "${manifest_files[@]}"; do
     mv "${tmp_file}" "${manifest_file}"
     echo "Updated ${manifest_file} to version ${version}"
 done
+
+for manifest_file in "${manifest_files[@]}"; do
+    manifest_version="$(jq -r '.version' "${manifest_file}")"
+    if [[ "${manifest_version}" != "${version}" ]]; then
+        echo "${manifest_file} has version ${manifest_version}; expected ${version}." >&2
+        exit 1
+    fi
+done
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5efb620..2ed8a0d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -81,6 +81,24 @@ jobs:
           base-path-to-features: "./features/src"
           generate-docs: "true"
 
+      - name: Verify release versions
+        env:
+          EXPECTED_VERSION: ${{ steps.settings.outputs.version }}
+        run: |
+          set -euo pipefail
+
+          while IFS= read -r manifest_file; do
+            manifest_version="$(jq -r '.version' "${manifest_file}")"
+            if [[ "${manifest_version}" != "${EXPECTED_VERSION}" ]]; then
+              echo "${manifest_file} has version ${manifest_version}; expected ${EXPECTED_VERSION}." >&2
+              exit 1
+            fi
+          done < <(
+            find features/src templates/src -type f \
+              \( -name 'devcontainer-feature.json' -o -name 'devcontainer-template.json' \) \
+              | sort
+          )
+
       - name: Package release source bundle
         if: ${{ github.event_name == 'release' }}
         id: package
diff --git a/features/src/linux-x11-forwarding/devcontainer-feature.json b/features/src/linux-x11-forwarding/devcontainer-feature.json
index 3375ae5..7b5cb8f 100644
--- a/features/src/linux-x11-forwarding/devcontainer-feature.json
+++ b/features/src/linux-x11-forwarding/devcontainer-feature.json
@@ -1,6 +1,6 @@
 {
   "id": "linux-x11-forwarding",
-  "version": "0.1.0",
+  "version": "0.0.0",
   "name": "Linux X11 Forwarding",
   "description": "Forward a local Linux host's X11 display into a development container.",
   "documentationURL": "https://github.com/althack/devcontainers/tree/main/features/src/linux-x11-forwarding",
diff --git a/templates/src/gz/devcontainer-template.json b/templates/src/gz/devcontainer-template.json
index 8451012..29660b5 100644
--- a/templates/src/gz/devcontainer-template.json
+++ b/templates/src/gz/devcontainer-template.json
@@ -1,6 +1,6 @@
 {
   "id": "gz",
-  "version": "0.1.0",
+  "version": "0.0.0",
   "name": "Gazebo",
   "description": "Gazebo development environment.",
   "documentationURL": "https://github.com/athackst/devcontainer-templates/tree/main/templates/src/gz",