From 147cec7c6b961bacc5fcfb93a6269e378704b3f6 Mon Sep 17 00:00:00 2001
From: Codex <codex@example.local>
Date: Mon, 6 Jul 2026 12:43:11 +0000
Subject: [PATCH] Restrict releases to version tags

---
 .github/workflows/android.yml | 22 ++--------------------
 README.md                     |  4 ++--
 docs/android-client-notes.md  |  8 ++++----
 3 files changed, 8 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index e6306c5..75e91d7 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -8,15 +8,6 @@ on:
       - "v*"
   pull_request:
   workflow_dispatch:
-    inputs:
-      publish_release:
-        description: "Create or update a GitHub Release"
-        required: true
-        default: "false"
-        type: choice
-        options:
-          - "false"
-          - "true"
 
 permissions:
   contents: write
@@ -25,7 +16,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     env:
-      PUBLISH_RELEASE: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') || inputs.publish_release == 'true' }}
+      PUBLISH_RELEASE: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
 
     steps:
       - name: Checkout
@@ -139,15 +130,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
-            TAG="${GITHUB_REF_NAME}"
-          else
-            TAG="v${VERSION_NAME}"
-            git config user.name "github-actions[bot]"
-            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            git tag -f "${TAG}"
-            git push -f origin "${TAG}"
-          fi
+          TAG="${GITHUB_REF_NAME}"
 
           if gh release view "${TAG}" >/dev/null 2>&1; then
             gh release upload "${TAG}" release/tmux-android.apk release/latest.json --clobber
@@ -157,4 +140,3 @@ jobs:
               --title "tmux Android ${VERSION_NAME}" \
               --notes "Android APK for tmux-ui remote testing."
           fi
-
diff --git a/README.md b/README.md
index 1aab546..a85e547 100644
--- a/README.md
+++ b/README.md
@@ -78,8 +78,8 @@ Create the base64 value from your release keystore:
 base64 -w 0 tmux-android-release.jks
 ```
 
-Branch builds create Actions artifacts only. Use them to verify grouped changes
-before publishing.
+Branch builds and manual workflow runs create Actions artifacts only. Use them
+to verify grouped changes before publishing.
 
 Publish a release build by pushing a `v*` tag. A tag should be reserved for a
 coherent feature/test batch, not every small UI or text change. Tag publishing
diff --git a/docs/android-client-notes.md b/docs/android-client-notes.md
index 6d43e25..3190bf4 100644
--- a/docs/android-client-notes.md
+++ b/docs/android-client-notes.md
@@ -110,10 +110,10 @@ install settings before the installer can run. After the user grants that
 permission and returns to the app, the app resumes installation of the pending
 APK instead of asking the user to run update again.
 
-Only `v*` tags publish GitHub Releases. Main branch builds are for CI artifacts
-and should be used to validate grouped changes. Do not publish a new tag for
-every small UI copy or layout change; publish when there is a useful feature or
-test batch for phone-side validation.
+Only `v*` tags publish GitHub Releases. Main branch builds and manual workflow
+runs are for CI artifacts and should be used to validate grouped changes. Do not
+publish a new tag for every small UI copy or layout change; publish when there
+is a useful feature or test batch for phone-side validation.
 
 ## Native Roadmap