From 9fa4db01e1a6ffa3a3da997b6e5c859f1c745841 Mon Sep 17 00:00:00 2001
From: Phillip Cloud <417981+cpcloud@users.noreply.github.com>
Date: Thu, 15 Jan 2026 12:00:53 -0500
Subject: [PATCH] ci: gate release on successful doc build and validate
 build-ctk-ver input

---
 .github/workflows/build-docs.yml | 6 ++++++
 .github/workflows/release.yml    | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index f2d8d4135e..356431e8e4 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -47,6 +47,12 @@ jobs:
       run:
         shell: bash -el {0}
     steps:
+      - name: validate build-ctk
+        run: |
+          if [ ! "${{ inputs.build-ctk-ver }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]; then
+            echo "error: `build-ctk-ver` ${{ inputs.build-ctk-ver }} version does not match MAJOR.MINOR.MICRO" >&2
+            exit 1
+          fi
       - name: Checkout ${{ github.event.repository.name }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 530372240a..715d4e0bd0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -135,6 +135,7 @@ jobs:
     needs:
       - check-tag
       - determine-run-id
+      - doc
     secrets: inherit
     uses: ./.github/workflows/release-upload.yml
     with:
@@ -148,6 +149,7 @@ jobs:
     needs:
       - check-tag
       - determine-run-id
+      - doc
     environment:
       name: ${{ inputs.wheel-dst }}
       url: https://${{ (inputs.wheel-dst == 'testpypi' && 'test.') || '' }}pypi.org/p/${{ inputs.component }}/