From 5eb41bc803df520a8f1f3246026e5dea34e56450 Mon Sep 17 00:00:00 2001
From: iexos <hritter@posteo.de>
Date: Sat, 7 Feb 2026 00:18:28 +0100
Subject: [PATCH] feat!: require clean working copy for recipe release cmd

---
 cli/recipe/release.go                 |  9 +++++++
 tests/integration/recipe_release.bats | 37 +++++++++++++++++----------
 2 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/cli/recipe/release.go b/cli/recipe/release.go
index 7876424e0..d96178b10 100644
--- a/cli/recipe/release.go
+++ b/cli/recipe/release.go
@@ -97,6 +97,15 @@ your private key and enter your passphrase beforehand.
 			log.Fatal(i18n.G("main app service version for %s is empty?", recipe.Name))
 		}
 
+		isClean, err := gitPkg.IsClean(recipe.Dir)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if !isClean {
+			log.Fatal(i18n.G("working directory not clean in %s, aborting", recipe.Dir))
+		}
+
 		tags, err := recipe.Tags()
 		if err != nil {
 			log.Fatal(err)
diff --git a/tests/integration/recipe_release.bats b/tests/integration/recipe_release.bats
index 03d7da594..f3e2955ce 100644
--- a/tests/integration/recipe_release.bats
+++ b/tests/integration/recipe_release.bats
@@ -103,25 +103,31 @@ teardown() {
   assert_output --regexp '0\.4\.0\+1\.2.*'
 }
 
-@test "unknown files not committed" {
-  # test will fail, rework with recipe upgrade
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch
+@test "release with unstaged changes" {
+  run bash -c 'echo "# unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"'
   assert_success
 
-  run bash -c 'echo "unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/foo"'
-  assert_success
-  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff --quiet
+  assert_failure
 
   run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
-  assert_success
-  assert_output --partial 'INFO new release published:'
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rm foo
   assert_failure
-  assert_output --partial "fatal: pathspec 'foo' did not match any files"
+  assert_output --partial "working directory not clean"
+}
+
+@test "release with staged changes" {
+  run bash -c 'echo "# staged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"'
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" add compose.yml
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff --quiet --cached
+  assert_failure
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+  assert_output --partial "working directory not clean"
 }
 
 @test "release with next release note" {
@@ -222,6 +228,9 @@ teardown() {
     "$ABRA_DIR/recipes/foobar/compose.yml"
   assert_success
 
+  run git -C "$ABRA_DIR/recipes/foobar" commit -am "updated nginx"
+  assert_success
+
   run bash -c "echo 0.1.0 | $ABRA recipe release foobar --patch"
   assert_failure
   assert_output --partial "automagic insertion not supported yet"