- name: Report disk space-  if: always()+  if: always() && secrets.SLACK_WEBHOOK_URL != '' && steps.disk.outputs.avail != ''   uses: rtCamp/action-slack-notify@v2   env:     SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}     SLACK_CHANNEL: ci-disk-alerts     SLACK_USERNAME: Disk Monitor     SLACK_TITLE: "${{ steps.disk.outputs.avail }}GB remaining"     SLACK_MESSAGE: "${{ inputs.name }} on ${{ inputs.os }}"     SLACK_COLOR: ${{ steps.disk.outputs.avail < 10 && 'danger' || (steps.disk.outputs.avail < 30 && 'warning' || 'good') }}     SLACK_ICON_EMOJI: ":floppy_disk:"

 - name: Check last commit author   id: check+  shell: bash   run: |-    LAST_AUTHOR=$(git log -1 --format='%an')-    if [ "$LAST_AUTHOR" = "Selenium CI Bot" ]; then+    set -euo pipefail++    LAST_AUTHOR_EMAIL="$(git log -1 --format='%ae' | tr -d '\r' | xargs || true)"+    if [ -z "$LAST_AUTHOR_EMAIL" ]; then+      echo "::warning::Could not determine last commit author email; skipping auto-commit to avoid loops"+      echo "should-commit=false" >> "$GITHUB_OUTPUT"+    elif [ "$LAST_AUTHOR_EMAIL" = "selenium-ci-bot@example.com" ]; then       echo "::notice::Last commit was from Selenium CI Bot - skipping commit-fixes"       echo "should-commit=false" >> "$GITHUB_OUTPUT"     else       echo "should-commit=true" >> "$GITHUB_OUTPUT"     fi

 # Find the workspace root WORKSPACE_ROOT="${{BUILD_WORKSPACE_DIRECTORY:-$RUNFILES_DIR/_main}}" DOTNET_DIR="$WORKSPACE_ROOT/dotnet"+if [[ ! -d "$DOTNET_DIR" ]]; then+    echo "ERROR: Could not find dotnet directory at $DOTNET_DIR" >&2+    exit 1+fi+ cd "$DOTNET_DIR"  echo "Running dotnet format on all projects..."-find "$DOTNET_DIR/src" "$DOTNET_DIR/test" -name "*.csproj" 2>/dev/null | while read -r proj; do+mapfile -t projects < <(find "$DOTNET_DIR/src" "$DOTNET_DIR/test" -name "*.csproj" 2>/dev/null)+if [[ "${#projects[@]}" -eq 0 ]]; then+    echo "ERROR: No .csproj files found under $DOTNET_DIR/src or $DOTNET_DIR/test" >&2+    exit 1+fi+for proj in "${projects[@]}"; do     echo "  Formatting $proj..."     "$DOTNET" format "$proj" || exit 1-done || exit 1+done

-version = choose_version(versions, args.allow_prerelease, args.version)+explicit_version = args.version.strip() if args.version else None+if explicit_version:+    try:+        Version(explicit_version)+    except InvalidVersion as e:+        raise ValueError(f"Invalid --version: {explicit_version}") from e++version = choose_version(versions, args.allow_prerelease, explicit_version) nupkg_url = NUGET_NUPKG_URL.format(version=version) sha256 = sha256_of_url(nupkg_url)-output_path = Path(args.output)+output_arg = (args.output or "").strip()+if not output_arg:+    raise ValueError("--output must be a non-empty path")+output_path = Path(output_arg) if not output_path.is_absolute():-    workspace_dir = os.environ.get("BUILD_WORKSPACE_DIRECTORY")-    if workspace_dir:-        output_path = Path(workspace_dir) / output_path+    workspace_dir = (os.environ.get("BUILD_WORKSPACE_DIRECTORY") or "").strip()+    if not workspace_dir:+        raise EnvironmentError("BUILD_WORKSPACE_DIRECTORY is required when --output is a relative path")+    output_path = Path(workspace_dir) / output_path output_path.write_text(render_docfx_repo(version, sha256))

 - name: Apply and commit   id: commit   run: |+    set -euo pipefail+     if [ -f changes.patch ] && [ -s changes.patch ]; then+      if [ -z "${COMMIT_MESSAGE//[[:space:]]/}" ]; then+        echo "::error::Commit message is required"+        echo "committed=false" >> "$GITHUB_OUTPUT"+        exit 1+      fi+       if ! git apply --index changes.patch; then         echo "::error::Failed to apply patch"         echo "committed=false" >> "$GITHUB_OUTPUT"         exit 1       fi       git config --local user.email "selenium-ci@users.noreply.github.com"       git config --local user.name "Selenium CI Bot"       if ! git commit -m "$COMMIT_MESSAGE"; then         echo "::error::Failed to commit changes"         echo "committed=false" >> "$GITHUB_OUTPUT"         exit 1       fi-      if [ -n "$PUSH_BRANCH" ]; then+      if [ -n "${PUSH_BRANCH:-}" ]; then         if ! git push origin HEAD:"$PUSH_BRANCH" --force; then           echo "::error::Failed to push to $PUSH_BRANCH"           echo "committed=false" >> "$GITHUB_OUTPUT"           exit 1         fi       else         if ! git push; then           echo "::error::Failed to push"           echo "committed=false" >> "$GITHUB_OUTPUT"           exit 1         fi       fi       echo "::notice::Changes committed and pushed"       echo "committed=true" >> "$GITHUB_OUTPUT"     else       echo "::notice::No changes to commit"       echo "committed=false" >> "$GITHUB_OUTPUT"     fi

 - name: Apply and commit   id: commit   run: |+    set -euo pipefail++    COMMIT_MESSAGE="${COMMIT_MESSAGE#"${COMMIT_MESSAGE%%[![:space:]]*}"}"+    COMMIT_MESSAGE="${COMMIT_MESSAGE%"${COMMIT_MESSAGE##*[![:space:]]}"}"+    if [ -z "$COMMIT_MESSAGE" ]; then+      echo "::error::commit-message must be non-empty"+      exit 1+    fi++    if [ -n "${PUSH_BRANCH:-}" ] && ! [[ "$PUSH_BRANCH" =~ ^[A-Za-z0-9._/-]+$ ]]; then+      echo "::error::push-branch contains invalid characters"+      exit 1+    fi+     if [ -f changes.patch ] && [ -s changes.patch ]; then       git apply --index changes.patch       git config --local user.email "selenium-ci@users.noreply.github.com"       git config --local user.name "Selenium CI Bot"       git commit -m "$COMMIT_MESSAGE"-      if [ -n "$PUSH_BRANCH" ]; then+      if [ -n "${PUSH_BRANCH:-}" ]; then         git push origin HEAD:"$PUSH_BRANCH" --force       else         git push       fi       echo "::notice::Changes committed and pushed"       echo "committed=true" >> "$GITHUB_OUTPUT"     else       echo "::notice::No changes to commit"       echo "committed=false" >> "$GITHUB_OUTPUT"     fi   env:     COMMIT_MESSAGE: ${{ inputs.commit-message }}     PUSH_BRANCH: ${{ inputs.push-branch }}

 - name: Normalize version   id: version   run: |     VERSION="${{ github.event.inputs.version }}"+    if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then+      echo "Error: version '${VERSION}' is not in X.Y or X.Y.Z format." >&2+      exit 1+    fi     if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then       VERSION="${VERSION}.0"     fi     echo "value=$VERSION" >> "$GITHUB_OUTPUT"

 - name: Parse tag   id: parse   env:     TAG: ${{ inputs.tag }}     INPUT_LANG: ${{ inputs.language }}   run: |-    echo "version=$(echo "$TAG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')" >> "$GITHUB_OUTPUT"+    set -euo pipefail-    # Check for language suffix and map to internal names+    TAG="$(echo "${TAG:-}" | xargs)"+    if [ -z "$TAG" ]; then+      echo "inputs.tag is required" >&2+      exit 1+    fi++    VERSION="$(echo "$TAG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)"+    if [ -z "$VERSION" ]; then+      echo "Invalid tag (no version found): $TAG" >&2+      exit 1+    fi+    echo "version=$VERSION" >> "$GITHUB_OUTPUT"+     case "$TAG" in       *-javascript) LANG="node" ;;       *-python) LANG="py" ;;       *-ruby) LANG="rb" ;;       *-java) LANG="java" ;;       *-dotnet) LANG="dotnet" ;;       *) LANG="all" ;;     esac-    if [ "$INPUT_LANG" != "all" ]; then-      LANG="$INPUT_LANG"+    if [ -n "${INPUT_LANG:-}" ] && [ "$INPUT_LANG" != "all" ]; then+      case "$INPUT_LANG" in+        java|rb|py|dotnet|node|all) LANG="$INPUT_LANG" ;;+        *) echo "Invalid language: $INPUT_LANG" >&2; exit 1 ;;+      esac     fi+     echo "language=$LANG" >> "$GITHUB_OUTPUT"

 - name: Check disk space   if: always()   shell: bash   id: disk   run: |-    avail=$(df -k / | awk 'NR==2 {printf "%.0f", $4/1024/1024}')++    avail=$(df -k "$target" | awk 'NR==2 {printf "%.0f", $4/1024/1024}')     echo "Remaining disk space: ${avail}GB"     echo "avail=$avail" >> "$GITHUB_OUTPUT"

 # Find the workspace root-WORKSPACE_ROOT="${{BUILD_WORKSPACE_DIRECTORY:-$(cd "$(dirname "$0")/../.." && pwd)}}"+WORKSPACE_ROOT="${BUILD_WORKSPACE_DIRECTORY:-$RUNFILES_DIR/{workspace}}" DOTNET_DIR="$WORKSPACE_ROOT/dotnet"+if [[ ! -d "$DOTNET_DIR" ]]; then+    echo "ERROR: Could not find dotnet/ directory at $DOTNET_DIR" >&2+    exit 1+fi+

 # Find the workspace root (where dotnet/.config/dotnet-tools.json lives)-WORKSPACE_ROOT="${{BUILD_WORKSPACE_DIRECTORY:-$(cd "$(dirname "$0")/../.." && pwd)}}"+WORKSPACE_ROOT="${BUILD_WORKSPACE_DIRECTORY:-$RUNFILES_DIR/{workspace}}" DOTNET_DIR="$WORKSPACE_ROOT/dotnet"+if [[ ! -d "$DOTNET_DIR" ]]; then+    echo "ERROR: Could not find dotnet/ directory at $DOTNET_DIR" >&2+    exit 1+fi+

-# Resolve execution root from bazel-bin symlink (bin -> config -> bazel-out -> exec_root)-EXEC_ROOT=$(cd "$BUILD_WORKSPACE_DIRECTORY/bazel-bin/../../.." && pwd -P)+# Resolve Bazel execution root from the real bazel-bin path.+BIN_REAL="$(cd "$BUILD_WORKSPACE_DIRECTORY/bazel-bin" && pwd -P)"+OUTPUT_BASE="${BIN_REAL%%/bazel-out/*}"+WS_NAME="$(basename "$BUILD_WORKSPACE_DIRECTORY")"+EXEC_ROOT="${OUTPUT_BASE}/execroot/${WS_NAME}" exec "$EXEC_ROOT/{dotnet}" exec \      "$EXEC_ROOT/{docfx}" {config} "$@"

 _UNIX_TEMPLATE = """#!/usr/bin/env bash set -euo pipefail cd "$BUILD_WORKSPACE_DIRECTORY"+if [ ! -e "$BUILD_WORKSPACE_DIRECTORY/bazel-bin" ]; then+  echo "bazel-bin not found; run a Bazel build first." >&2+  exit 1+fi # Resolve execution root from bazel-bin symlink (bin -> config -> bazel-out -> exec_root) EXEC_ROOT=$(cd "$BUILD_WORKSPACE_DIRECTORY/bazel-bin/../../.." && pwd -P)+if [ -z "${EXEC_ROOT}" ] || [ ! -d "${EXEC_ROOT}" ]; then+  echo "Failed to resolve Bazel execution root." >&2+  exit 1+fi exec "$EXEC_ROOT/{dotnet}" exec \      "$EXEC_ROOT/{docfx}" {config} "$@" """  _WINDOWS_TEMPLATE = """@echo off setlocal cd /d "%BUILD_WORKSPACE_DIRECTORY%"+if not exist "%BUILD_WORKSPACE_DIRECTORY%\\bazel-bin" (+  echo bazel-bin not found; run a Bazel build first. 1>&2+  exit /b 1+) rem Resolve execution root from bazel-bin junction (bin -> config -> bazel-out -> exec_root) cd /d "%BUILD_WORKSPACE_DIRECTORY%\\bazel-bin\\..\\..\\.." set EXEC_ROOT=%CD%+if not exist "%EXEC_ROOT%" (+  echo Failed to resolve Bazel execution root. 1>&2+  exit /b 1+) cd /d "%BUILD_WORKSPACE_DIRECTORY%" "%EXEC_ROOT%\\{dotnet}" exec ^     "%EXEC_ROOT%\\{docfx}" {config} %* """

 - name: Download documentation   uses: actions/download-artifact@v4   with:     name: documentation-    path: docs/api+    path: .

 - name: Download grid packages   uses: actions/download-artifact@v4   with:     name: nightly-grid-    path: build/dist+    path: .

 - name: Download release packages   uses: actions/download-artifact@v4   with:     name: release-packages-    path: build/dist+    path: .

Examples:

      -name:Report disk spaceif:always()uses:rtCamp/action-slack-notify@v2env:SLACK_WEBHOOK:${{ secrets.SLACK_WEBHOOK_URL }}SLACK_CHANNEL:ci-disk-alertsSLACK_USERNAME:Disk MonitorSLACK_TITLE:"${{ steps.disk.outputs.avail }}GB remaining"SLACK_MESSAGE:"${{ inputs.name }} on ${{ inputs.os }}"SLACK_COLOR:${{ steps.disk.outputs.avail < 10 && 'danger' || (steps.disk.outputs.avail < 30 && 'warning' || 'good') }}... (clipped 1 lines)

Solution Walkthrough:

Before:

-name:Report disk spaceif:always()uses:rtCamp/action-slack-notify@v2env:SLACK_WEBHOOK:${{ secrets.SLACK_WEBHOOK_URL }}SLACK_CHANNEL:ci-disk-alertsSLACK_TITLE:"${{ steps.disk.outputs.avail }}GB remaining"SLACK_MESSAGE:"${{ inputs.name }} on ${{ inputs.os }}"SLACK_COLOR:${{ steps.disk.outputs.avail < 10 && 'danger' || (steps.disk.outputs.avail < 30 && 'warning' || 'good') }}...

After:

-name:Report disk spaceif:always() && steps.disk.outputs.avail < 30uses:rtCamp/action-slack-notify@v2env:SLACK_WEBHOOK:${{ secrets.SLACK_WEBHOOK_URL }}SLACK_CHANNEL:ci-disk-alertsSLACK_TITLE:"${{ steps.disk.outputs.avail }}GB remaining"SLACK_MESSAGE:"${{ inputs.name }} on ${{ inputs.os }}"SLACK_COLOR:${{ steps.disk.outputs.avail < 10 && 'danger' || 'warning' }}...

-allowUpdates: ${{ github.run_attempt > 1 }}+allowUpdates: true

 - name: Create GitHub release   uses: ncipollo/release-action@v1   with:     artifacts: "build/dist/*.*"     bodyFile: "scripts/github-actions/release_header.md"     generateReleaseNotes: true     name: "Selenium ${{ needs.prepare.outputs.version }}"     tag: "${{ needs.prepare.outputs.tag }}"     commit: "${{ github.sha }}"+    allowUpdates: true+    omitBodyDuringUpdate: true+    omitNameDuringUpdate: true

 - name: Save git diff-  if: inputs.artifact-name != '' && inputs.artifact-path == ''+  if: always() && inputs.artifact-name != '' && inputs.artifact-path == ''   run: git diff > changes.patch - name: Upload artifact-  if: inputs.artifact-name != ''+  if: always() && inputs.artifact-name != ''   uses: actions/upload-artifact@v4   with:     name: ${{ inputs.artifact-name }}     path: ${{ inputs.artifact-path || 'changes.patch' }}     retention-days: 6     if-no-files-found: ${{ inputs.artifact-path != '' && 'error' || 'warn' }}

 push-rust-version:   name: Push Rust Version   needs: generate-rust-version   runs-on: ubuntu-latest   steps:     - name: Checkout repo       uses: actions/checkout@v4       with:         token: ${{ secrets.SELENIUM_CI_TOKEN }}         fetch-depth: 0     - name: Download rust version patch       uses: actions/download-artifact@v4       with:         name: rust-version     - name: Apply patch-      run: git apply --index changes.patch+      run: |+        if [ -s changes.patch ]; then+          git apply --index changes.patch+          echo "CHANGES_APPLIED=true" >> "$GITHUB_ENV"+        fi     - name: Prep git+      if: env.CHANGES_APPLIED == 'true'       run: |         git config --local user.email "selenium-ci@users.noreply.github.com"         git config --local user.name "Selenium CI Bot"     - name: Push changes+      if: env.CHANGES_APPLIED == 'true'       run: |         git commit -m "update selenium manager version and rust changelog"         git push origin HEAD:rust-release-${{ inputs.version }} --force

 - name: Apply patch-  run: git apply --index changes.patch || echo "No changes to apply"+  shell: bash+  run: |+    if [ ! -f changes.patch ] || [ ! -s changes.patch ]; then+      echo "No changes to apply"+      exit 0+    fi+    git apply --index changes.patch

 FileUtils.copy('bazel-bin/dotnet/release.zip', "build/dist/selenium-dotnet-#{dotnet_version}.zip")-FileUtils.chmod(0o666, "build/dist/selenium-dotnet-#{dotnet_version}.zip")+FileUtils.chmod(0o644, "build/dist/selenium-dotnet-#{dotnet_version}.zip") FileUtils.copy('bazel-bin/dotnet/strongnamed.zip', "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")-FileUtils.chmod(0o666, "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")+FileUtils.chmod(0o644, "build/dist/selenium-dotnet-strongnamed-#{dotnet_version}.zip")

 permissions:   contents: write+  actions: read

 with:   token: ${{ secrets.SELENIUM_CI_TOKEN }}-  persist-credentials: true+  persist-credentials: false

 if File.exist?(npmrc)   File.open(npmrc, 'a') { |f| f.puts(auth_line) } else   File.write(npmrc, "#{auth_line}\n") end+File.chmod(0o600, npmrc)

 def credential_valid?(cred)   has_env = cred[:env]&.all? { |vars| vars.any? { |v| ENV.fetch(v, nil) } }   has_file = cred[:file]&.call-  has_cmd = cred[:cmd].nil? || system("which #{cred[:cmd]} > /dev/null 2>&1") || system("where #{cred[:cmd]} > nul 2>&1")+  has_cmd = cred[:cmd].nil? || system('which', cred[:cmd], out: File::NULL, err: File::NULL) || system('where', cred[:cmd], out: File::NULL, err: File::NULL)   has_env || has_file || has_cmd end

Examples:

run:|          TAG="${{ inputs.tag }}"          TAG="${TAG//[[:space:]]/}"          # Validate tag format: selenium-X.Y.Z or selenium-X.Y.Z-lang          if [[ ! "$TAG" =~ ^selenium-[0-9]+\.[0-9]+\.[0-9]+(-[a-z]+)?$ ]]; then            echo "::error::Invalid tag format: '$TAG'. Expected selenium-X.Y.Z or selenium-X.Y.Z-lang"            exit 1          fi... (clipped 40 lines)

run:|          if [ "$EVENT_NAME" == "workflow_dispatch" ]; then            TAG="$INPUT_TAG"          else            # Extract tag from branch name: release-preparation-selenium-4.28.1-ruby -> selenium-4.28.1-ruby            TAG=$(echo "$PR_HEAD_REF" | sed 's/^release-preparation-//')          fi          # Extract version          VERSION=$(echo "$TAG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')... (clipped 32 lines)

Solution Walkthrough:

Before:

# In .github/workflows/pre-release.ymljobs:parse-tag:steps:      -name:Parse tagrun:|          TAG="${{ inputs.tag }}"          # ... complex parsing and validation logic ...          if [[ "$PATCH" -gt 0 && -z "$LANG_SUFFIX" ]]; then            echo "::error::Patch releases must specify a language"            exit 1          fi          # ... more validation ...# In .github/workflows/release.ymljobs:prepare:steps:      -name:Extract and parse tagrun:|          # ... logic to get TAG from branch or input ...          # ... complex parsing and validation logic (duplicated) ...          if [[ "$PATCH" -gt 0 && -z "$LANG_SUFFIX" ]]; then            echo "::error::Patch releases must specify a language"            exit 1          fi          # ... more validation (duplicated) ...

After:

# In .github/workflows/parse-release-tag.yml (new file)on:workflow_call:inputs:tag_string:type:stringoutputs:tag:version:language:jobs:parse:steps:      -name:Parse tagrun:|          # ... single source of truth for parsing and validation ...          echo "tag=$TAG" >> "$GITHUB_OUTPUT"          echo "version=$VERSION" >> "$GITHUB_OUTPUT"          echo "language=$LANGUAGE" >> "$GITHUB_OUTPUT"# In .github/workflows/pre-release.yml and release.ymljobs:parse-tag:# or 'prepare' jobuses:./.github/workflows/parse-release-tag.ymlwith:tag_string:${{ inputs.tag }}# or ${{ github.event.pull_request.head.ref }}

 - name: Parse tag   id: parse   shell: bash   run: |-    TAG="${{ inputs.tag }}"-    TAG="${TAG//[[:space:]]/}"+    ./scripts/parse-release-tag.sh "${{ inputs.tag }}" >> "$GITHUB_OUTPUT"-    # Validate tag format: selenium-X.Y.Z or selenium-X.Y.Z-lang-    if [[ ! "$TAG" =~ ^selenium-[0-9]+\.[0-9]+\.[0-9]+(-[a-z]+)?$ ]]; then-      echo "::error::Invalid tag format: '$TAG'. Expected selenium-X.Y.Z or selenium-X.Y.Z-lang"-      exit 1-    fi--    # Extract version (strip 'selenium-' prefix and optional language suffix)-    VERSION=$(echo "$TAG" | sed -E 's/^selenium-([0-9]+\.[0-9]+\.[0-9]+)(-[a-z]+)?$/\1/')-    PATCH=$(echo "$VERSION" | cut -d. -f3)--    # Extract language suffix (default to 'all' if no suffix)-    if [[ "$TAG" =~ -([a-z]+)$ ]]; then-      LANG_SUFFIX="${BASH_REMATCH[1]}"-    else-      LANG_SUFFIX=""-    fi--    # Patch releases must have a language suffix-    if [[ "$PATCH" -gt 0 && -z "$LANG_SUFFIX" ]]; then-      echo "::error::Patch releases must specify a language (e.g., selenium-${VERSION}-ruby)"-      exit 1-    fi--    # Full releases (X.Y.0) must not have a language suffix-    if [[ "$PATCH" -eq 0 && -n "$LANG_SUFFIX" ]]; then-      echo "::error::Full releases (X.Y.0) cannot have a language suffix"-      exit 1-    fi--    # Validate language suffix (rake namespace aliases allow full names)-    case "$LANG_SUFFIX" in-      ruby|python|javascript|java|dotnet)-        LANGUAGE="$LANG_SUFFIX"-        ;;-      "")-        LANGUAGE="all"-        ;;-      *)-        echo "::error::Invalid language suffix: '$LANG_SUFFIX'. Expected ruby, python, javascript, java, or dotnet"-        exit 1-        ;;-    esac--    echo "tag=$TAG" >> "$GITHUB_OUTPUT"-    echo "version=$VERSION" >> "$GITHUB_OUTPUT"-    echo "language=$LANGUAGE" >> "$GITHUB_OUTPUT"-

 - name: Extract and parse tag   id: parse   env:     EVENT_NAME: ${{ github.event_name }}     INPUT_TAG: ${{ inputs.tag }}     PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}   run: |     if [ "$EVENT_NAME" == "workflow_dispatch" ]; then       TAG="$INPUT_TAG"     else       # Extract tag from branch name: release-preparation-selenium-4.28.1-ruby -> selenium-4.28.1-ruby       TAG=$(echo "$PR_HEAD_REF" | sed 's/^release-preparation-//')     fi      # Extract version     VERSION=$(echo "$TAG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')     PATCH=$(echo "$VERSION" | cut -d. -f3)      # Extract language suffix     if [[ "$TAG" =~ -([a-z]+)$ ]]; then       LANG_SUFFIX="${BASH_REMATCH[1]}"     else       LANG_SUFFIX=""     fi      # Patch releases must have a language suffix     if [[ "$PATCH" -gt 0 && -z "$LANG_SUFFIX" ]]; then       echo "::error::Patch releases must specify a language (e.g., selenium-${VERSION}-ruby)"       exit 1     fi+    # Full releases (X.Y.0) must not have a language suffix+    if [[ "$PATCH" -eq 0 && -n "$LANG_SUFFIX" ]]; then+      echo "::error::Full releases (X.Y.0) cannot have a language suffix"+      exit 1+    fi+     # Validate language suffix (rake namespace aliases allow full names)     case "$LANG_SUFFIX" in       ruby|python|javascript|java|dotnet)         LANGUAGE="$LANG_SUFFIX"         ;;       "")         LANGUAGE="all"         ;;       *)         echo "::error::Invalid language suffix: '$LANG_SUFFIX'. Expected ruby, python, javascript, java, or dotnet"         exit 1         ;;     esac      echo "tag=$TAG" >> "$GITHUB_OUTPUT"     echo "version=$VERSION" >> "$GITHUB_OUTPUT"     echo "language=$LANGUAGE" >> "$GITHUB_OUTPUT"