From d9b322a1c5a2ecdf47fd1e401ac655e23e7975c6 Mon Sep 17 00:00:00 2001
From: MatMoul <matmoul@gmail.com>
Date: Mon, 27 Apr 2026 20:40:46 +0200
Subject: [PATCH] docs: document release confirmation step

---
 .continue/rules/project.md |  7 +++++--
 README.md                  | 15 +++++++++------
 makerelease.sh             | 11 +++++++++++
 3 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/.continue/rules/project.md b/.continue/rules/project.md
index f79e808..cf27b12 100644
--- a/.continue/rules/project.md
+++ b/.continue/rules/project.md
@@ -40,6 +40,8 @@ Current behavior:
 - checks that the current branch is `dev`
 - verifies the working tree is clean
 - checks that the target tag does not already exist
+- displays the computed release tag before proceeding
+- asks for confirmation before any Git action
 - checks out `main`
 - merges `dev` into `main`
 - pushes the branch
@@ -49,9 +51,10 @@ Current behavior:
 
 Notes:
 - the script uses `set -euo pipefail`
-- the release tag message is now generated automatically as `Release <version>`
+- the release tag message is automatically generated as `Release <version>`
 - the script no longer requires a separate release message argument
 - the current increment logic assumes simple dotted numeric tags
+- normal releases now require an interactive confirmation after the tag is displayed
 
 Recommendations:
 - consider validating the version format more strictly if release rules grow
@@ -60,7 +63,7 @@ Recommendations:
 ### 3) `README.md`
 Current status:
 - the README documents both scripts in English
-- it now includes release increments and dry-run usage for `makerelease.sh`
+- it includes release increments, dry-run usage, and the confirmation step for `makerelease.sh`
 
 Recommendations:
 - keep it aligned with the actual script behavior
diff --git a/README.md b/README.md
index b6da91c..841e430 100644
--- a/README.md
+++ b/README.md
@@ -47,12 +47,14 @@ sudo ./fullupgrade
 1. checks that the current branch is `dev` for real releases
 2. verifies the working tree is clean
 3. optionally computes a new version from an increment shortcut
-4. switches to `main`
-5. merges `dev` into `main`
-6. pushes `main`
-7. creates an annotated tag
-8. pushes tags
-9. switches back to the original branch on exit
+4. displays the chosen release tag
+5. asks for confirmation before any Git action
+6. switches to `main`
+7. merges `dev` into `main`
+8. pushes `main`
+9. creates an annotated tag
+10. pushes tags
+11. switches back to the original branch on exit
 
 ### Usage
 
@@ -81,6 +83,7 @@ sudo ./fullupgrade
 - `VERSION` is used directly as the tag name.
 - If `VERSION` starts with `+`, it is treated as an increment based on the latest existing tag.
 - `--dry-run` can be used from any branch and only prints the computed tag.
+- In normal mode, the computed tag is shown and a confirmation is required before Git actions run.
 - The script may fail if Git state is unexpected or if a tag already exists.
 - The tag message is automatically generated as `Release <version>`.
 
diff --git a/makerelease.sh b/makerelease.sh
index 18cabbb..5ac16d3 100755
--- a/makerelease.sh
+++ b/makerelease.sh
@@ -114,6 +114,17 @@ if [ "${is_dry_run}" = true ]; then
 	exit 0
 fi
 
+echo "Release tag selected: ${release_tag}"
+read -r -p "Proceed with release? [y/N] " confirm
+case "${confirm}" in
+	y|Y)
+		;;
+	*)
+		echo "Release cancelled."
+		exit 1
+		;;
+esac
+
 git checkout "${TAGBRANCH}"
 CURRENTBRANCH="${TAGBRANCH}"
 git merge "${ORIGBRANCH}"