From 3184260bded348694aa7ada4921de56efd858a45 Mon Sep 17 00:00:00 2001
From: Mehdi ABAAKOUK <sileht@sileht.net>
Date: Wed, 4 Nov 2026 02:19:45 +0100
Subject: [PATCH] ci: move the major tag to the release its own run just cut

The push run of https://github.com/Mergifyio/setup-cli/pull/25 released
v1.4.0 and then left v1 on v1.3.0: the major-tag step listed the
releases right after creating v1.4.0, the list did not show it yet, and
the step logged "v1 already points at v1.3.0". Every
`Mergifyio/setup-cli@v1` user stayed on the old default mergify-cli.

This is not a rare race. On a throwaway repository, the releases list
missed a release created just before in 24 of 25 tries, and took 0.6 to
1.8 s to show it, while refs/tags/<tag> resolved to the right commit
25 times out of 25.

The step now counts the release its run cut, or the published release
that triggered it, on its own before picking the newest, whatever the
list returns. A patch on an older minor still never moves the tag
backwards, and a dispatched tag still only picks the major. The commit
is resolved from refs/tags/<tag>, so a branch with the same name cannot
be picked.

Merging this is a push to main, so its run points v1 at v1.4.0 if v1 is
still on v1.3.0 by then.

Fixes MRGFY-11553

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Change-Id: Icf242be7761ae1385adc264082c2ce19cb4f2d16
---
 .github/workflows/release.yaml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f409f5d..e84468c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -121,6 +121,8 @@ jobs:
       - name: Point the major tag at the latest release of that major
         env:
           TAG: ${{ steps.release.outputs.tag || inputs.tag || github.event.release.tag_name }}
+          # Empty on a dispatch with a tag: that one only picks the major.
+          RELEASED: ${{ steps.release.outputs.tag || github.event.release.tag_name }}
         run: |
           set -euo pipefail
           if [[ ! "$TAG" =~ ^(v[0-9]+)\.[0-9]+\.[0-9]+$ ]]; then
@@ -131,17 +133,21 @@ jobs:
 
           # Use the newest published release of the major rather than $TAG, so
           # a patch release on an older minor never moves the tag backwards.
+          # $RELEASED is counted on its own: the releases list can take a
+          # second or two to show a release created moments ago.
           latest=$(
-            gh api --paginate "repos/$REPO/releases" \
-              --jq '.[] | select((.draft or .prerelease) | not) | .tag_name' \
-              | { grep -E "^${major}\.[0-9]+\.[0-9]+$" || true; } \
+            {
+              echo "$RELEASED"
+              gh api --paginate "repos/$REPO/releases" \
+                --jq '.[] | select((.draft or .prerelease) | not) | .tag_name'
+            } | { grep -E "^${major}\.[0-9]+\.[0-9]+$" || true; } \
               | sort -V | tail -n 1
           )
           if [ -z "$latest" ]; then
             echo "::error::No published $major.x.y release found"
             exit 1
           fi
-          sha=$(gh api "repos/$REPO/commits/$latest" --jq .sha)
+          sha=$(gh api "repos/$REPO/commits/refs/tags/$latest" --jq .sha)
 
           # gh prints the error body on stdout, so a missing ref must reset it.
           current=$(gh api "repos/$REPO/git/ref/tags/$major" --jq .object.sha 2> /dev/null) || current=""