From 20ec8a3dc97294ebc8c06b2cd32809f86e5e6f2c Mon Sep 17 00:00:00 2001
From: Yeela <yeela@linearb.io>
Date: Thu, 13 Aug 2026 12:30:47 +0300
Subject: [PATCH] fix: select the release tag by version instead of by tagged
 commit

The release job computed an already-released tag and failed with
"tag_name was used by an immutable release".

tag-version.sh read the latest version with
`git describe --tags $(git rev-list --tags --max-count=1)`, which names
whichever tag git happens to find on the newest tagged commit. Several
tags share that commit - 2.0.256, 2.0.257 and v2 all point at f6ecd22,
and update-v2-tag force-moves v2 onto every release commit, so a
collision is structural rather than a one-off. describe returned
2.0.256, the bump produced 2.0.257, and that release already existed.

Select the highest version tag with `sort -V` instead. The glob also
keeps the legacy v-prefixed tags out of the running, which removes the
v-stripping branch that would have turned v1.111 into 1.111.1.

Add `set -eo pipefail` so this fails at the point it breaks: without it
the rejected `git tag`/`git push` still exited 0 and exported the unused
tag, surfacing two steps later as a confusing 422.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/tag-version.sh | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/scripts/tag-version.sh b/scripts/tag-version.sh
index 82ee95f4..be45614c 100755
--- a/scripts/tag-version.sh
+++ b/scripts/tag-version.sh
@@ -1,13 +1,19 @@
 #!/bin/bash
 
-git fetch --tags
+# Fail the step if the tag cannot be created or pushed. Without this, a rejected
+# `git push` still exits 0 and the release step goes on to use a tag that was
+# never created.
+set -eo pipefail
 
-# Get the latest tag
-latest_tag=$(git describe --tags `git rev-list --tags --max-count=1`)
+git fetch --tags --force
 
-# Check if the latest tag starts with 'v' and remove it
-if [[ $latest_tag == v* ]]; then
-  latest_tag=${latest_tag:1}
+# Highest released version, chosen by version order rather than by "whichever tag
+# git describe finds on the newest tagged commit".
+latest_tag=$(git tag -l '[0-9]*.[0-9]*.[0-9]*' | sort -V | tail -1)
+
+if [[ -z $latest_tag ]]; then
+  echo "No version tag found; refusing to guess the next version" >&2
+  exit 1
 fi
 
 # Split the latest tag into an array
@@ -17,9 +23,9 @@ IFS='.' read -r -a version_parts <<< "$latest_tag"
 new_tag="${version_parts[0]}.${version_parts[1]}.$((version_parts[2] + 1))"
 
 # Create and push the new tag
-git tag $new_tag
-git push origin $new_tag
+git tag "$new_tag"
+git push origin "$new_tag"
 echo "new_tag=$new_tag"
 
-echo "new_tag=$new_tag" >> $GITHUB_OUTPUT
-echo "NEW_TAG=$new_tag" >> $GITHUB_ENV
\ No newline at end of file
+echo "new_tag=$new_tag" >> "$GITHUB_OUTPUT"
+echo "NEW_TAG=$new_tag" >> "$GITHUB_ENV"