What the developer wrote
Authored by ziggie
release: validate version in release CI
The release workflow runs from pushed version tags, but the build step
was setting SKIP_VERSION_CHECK=1. That made scripts/release.sh exit
before running check-tag, so CI did not compare the pushed tag with
the version reported from build/version.go.
Run the normal release target instead. This keeps release CI from
producing artifacts when the tag and embedded lnd version drift apart.
What changed, and why it matters
This change tightens a release safety check. Previously, the automated release pipeline skipped a version comparison between the Git tag and the software's internal version number, so a release could accidentally be built and published with mismatched version labels. Now the check runs normally, preventing that mismatch. It is a supply-chain/process fix, not a fix for an exploitable code bug in running LND nodes.
No immediate action required by node operators. This is a CI hardening change. Operators who build from source or verify release signatures should continue normal practices. The project should ensure the check-tag logic itself is correct and that release managers are aware the version check is now enforced.
Security signals we found
Supply-chain/release-process hardening
Version-integrity check now enforced in CI
Prevents publication of mismatched release artifacts
No runtime vulnerability in LND node code
Evidence from the diff
The commit removes SKIP_VERSION_CHECK=1 from the GitHub Actions release workflow. With the skip removed, make release runs its default target, which invokes scripts/release.sh’s check-tag logic to compare the pushed Git tag (RELEASE_VERSION) against the version embedded in build/version.go. If they differ, the build fails instead of producing artifacts. This prevents tag/version drift in published release binaries.
Changed components
.github/workflows/release.yamlscripts/release.sh (check-tag target)build/version.goInspect captured patch +1 / −1
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 012a716..0ec7218 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -40,7 +40,7 @@ jobs:
run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
- name: build release for all architectures
- run: SKIP_VERSION_CHECK=1 make release tag=${{ env.RELEASE_VERSION }}
+ run: make release tag=${{ env.RELEASE_VERSION }}
- name: Create Release
uses: lightninglabs/gh-actions/action-gh-release@c7149b6a7818d1c39b36b69e727569897b6f2c5a
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.