From 05f1f8213498f943e80648ac19443c31b3287d78 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 8 Sep 2026 13:40:55 +0000 Subject: [PATCH] Create release tag on the released commit Beta releases on next tag the wrong commit: the GitHub release ends up on the newest main commit instead of the commit that was actually released. v10.0.0-beta.0 is tagged on 0e9bb5fc4, a main commit. The package tags created by `changeset publish` are correct, which is why only the aggregated vX.Y.Z tag is affected. dotansimha/changesets-action calls the create-release API without passing target_commitish, so GitHub creates the tag on the repository's default branch. Creating the tag ourselves before the action runs fixes this, because GitHub ignores target_commitish when the tag already exists. A second step asserts the result so a broken guard turns into a red job instead of another wrong tag. release.yml is not affected today because main is the default branch, but it gets the same steps: it is the template the vN.x.x branches are cut from, and it should not break silently if the default branch ever changes. Same change as on v8.x.x, where it is confirmed working: v8.32.0 is tagged on cf9fc0cf2, the release commit on v8.x.x. DEX-2597 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EgLEUzTiJX7Jn3WQJBWhok --- .github/workflows/release-beta.yml | 27 +++++++++++++++++++++++++++ .github/workflows/release.yml | 27 +++++++++++++++++++++++++++ 2 files changed, 54 insertions(+) diff --git a/.github/workflows/release-beta.yml b/.github/workflows/release-beta.yml index eccd6e686e4..26956e58f45 100644 --- a/.github/workflows/release-beta.yml +++ b/.github/workflows/release-beta.yml @@ -41,6 +41,21 @@ jobs: cd packages/admin/admin echo "PUBLISHED_VERSION=$(pnpm pkg get version | sed -r 's/"//g')" >> $GITHUB_ENV + # dotansimha/changesets-action creates the GitHub release without passing + # target_commitish, so GitHub places the tag on the default branch (main) instead of + # the released commit. That's wrong for every release that doesn't run on main. + # Creating the tag upfront fixes it: GitHub ignores target_commitish when the tag + # already exists. + - name: Create tag on released commit + if: ${{ contains(github.event.head_commit.message, 'Version Packages') }} + run: | + if git ls-remote --exit-code --tags origin "v$PUBLISHED_VERSION" > /dev/null; then + echo "Tag v$PUBLISHED_VERSION already exists" + else + git tag "v$PUBLISHED_VERSION" "$GITHUB_SHA" + git push origin "v$PUBLISHED_VERSION" + fi + - name: Create Release Pull Request or Publish to npm id: changesets uses: dotansimha/changesets-action@v1.5.2 @@ -54,3 +69,15 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} HUSKY: 0 # https://typicode.github.io/husky/#/?id=with-env-variables + + # Catches a silently broken guard on the tag step above: without this, a wrong tag + # would go unnoticed again. + - name: Verify the release tag + if: ${{ steps.changesets.outputs.published == 'true' }} + run: | + git fetch --force origin "refs/tags/v$PUBLISHED_VERSION:refs/tags/v$PUBLISHED_VERSION" + TAGGED_SHA=$(git rev-parse "v$PUBLISHED_VERSION^{commit}") + if [ "$TAGGED_SHA" != "$GITHUB_SHA" ]; then + echo "::error::Publishing succeeded, but tag v$PUBLISHED_VERSION points at $TAGGED_SHA instead of the released commit $GITHUB_SHA. Move the tag, then check the condition of the \"Create tag on released commit\" step." + exit 1 + fi diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e930b2dc363..4089d5d6805 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,6 +25,21 @@ jobs: cd packages/admin/admin echo "PUBLISHED_VERSION=$(pnpm pkg get version | sed -r 's/"//g')" >> $GITHUB_ENV + # dotansimha/changesets-action creates the GitHub release without passing + # target_commitish, so GitHub places the tag on the default branch (main) instead of + # the released commit. That's wrong for every release that doesn't run on main. + # Creating the tag upfront fixes it: GitHub ignores target_commitish when the tag + # already exists. + - name: Create tag on released commit + if: ${{ contains(github.event.head_commit.message, 'Version Packages') }} + run: | + if git ls-remote --exit-code --tags origin "v$PUBLISHED_VERSION" > /dev/null; then + echo "Tag v$PUBLISHED_VERSION already exists" + else + git tag "v$PUBLISHED_VERSION" "$GITHUB_SHA" + git push origin "v$PUBLISHED_VERSION" + fi + - name: Create Release Pull Request or Publish to npm id: changesets uses: dotansimha/changesets-action@v1.5.2 @@ -38,3 +53,15 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} HUSKY: 0 # https://typicode.github.io/husky/#/?id=with-env-variables + + # Catches a silently broken guard on the tag step above: without this, a wrong tag + # would go unnoticed again. + - name: Verify the release tag + if: ${{ steps.changesets.outputs.published == 'true' }} + run: | + git fetch --force origin "refs/tags/v$PUBLISHED_VERSION:refs/tags/v$PUBLISHED_VERSION" + TAGGED_SHA=$(git rev-parse "v$PUBLISHED_VERSION^{commit}") + if [ "$TAGGED_SHA" != "$GITHUB_SHA" ]; then + echo "::error::Publishing succeeded, but tag v$PUBLISHED_VERSION points at $TAGGED_SHA instead of the released commit $GITHUB_SHA. Move the tag, then check the condition of the \"Create tag on released commit\" step." + exit 1 + fi