From 39b204eaa51154ab31b92cd9c1d8fa699ea58c0e Mon Sep 17 00:00:00 2001
From: Radwan Parvez <radwanparvez@users.noreply.github.com>
Date: Sat, 25 Jul 2026 12:04:57 -0400
Subject: [PATCH] Harden release validation

---
 .github/workflows/release.yml | 9 +++++++++
 scripts/test.sh               | 8 +++++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8846ace..19e106f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -71,10 +71,19 @@ jobs:
           print "SIGN_IDENTITY=$identity" >> "$GITHUB_ENV"
 
       - name: Build and verify signed application
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
           ./build.sh
           codesign --verify --deep --strict --verbose=2 \
             build/JLabTextQuickLook.app
+          signed_team=$(codesign -dv --verbose=4 \
+            build/JLabTextQuickLook.app 2>&1 |
+            sed -n 's/^TeamIdentifier=//p')
+          [[ "$signed_team" == "$APPLE_TEAM_ID" ]] || {
+            echo "Signed TeamIdentifier $signed_team does not match APPLE_TEAM_ID" >&2
+            exit 1
+          }
           ./scripts/test.sh
 
       - name: Notarize and staple application
diff --git a/scripts/test.sh b/scripts/test.sh
index 75072c6..2885788 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -32,10 +32,12 @@ for version in "${min_versions[@]}"; do
         fail "expected macOS 13.0 deployment target, found $version"
 done
 
-bundle_version=$(/usr/libexec/PlistBuddy \
+source_bundle_version=$(/usr/libexec/PlistBuddy \
+    -c 'Print :CFBundleShortVersionString' "$project_dir/App-Info.plist")
+built_bundle_version=$(/usr/libexec/PlistBuddy \
     -c 'Print :CFBundleShortVersionString' "$plist")
-[[ "$bundle_version" == "1.3.0" ]] ||
-    fail "expected bundle version 1.3.0, found $bundle_version"
+[[ "$built_bundle_version" == "$source_bundle_version" ]] ||
+    fail "source version $source_bundle_version does not match built version $built_bundle_version"
 
 for extension in "${expected_extensions[@]}"; do
     fixture="$project_dir/fixtures/example.$extension"