Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

.github/workflows/release.yml (1)

44-53: ⚠️ Potential issue | 🟠 Major

Make tag creation atomic to avoid flaky release failures.

Line 46–53 still uses check-then-create; concurrent runs can pass the check and then fail on POST when the ref is created by another run. Treat “already exists” create errors as success.

Suggested fix

-          # Idempotent: check if exact tag already exists.
-          # GitHub refs API uses prefix matching, so we must verify the exact ref.
-          if gh api "repos/$GITHUB_REPOSITORY/git/refs/tags/$TAG_NAME" --jq '.[].ref, .ref' 2>/dev/null \
-              | grep -qxF "refs/tags/$TAG_NAME"; then
-            echo "Tag $TAG_NAME already exists — skipping."
-          else
-            gh api "repos/$GITHUB_REPOSITORY/git/refs" \
-              --method POST \
-              --field "ref=refs/tags/$TAG_NAME" \
-              --field "sha=$TAG_SHA"
-            echo "Tag $TAG_NAME created successfully."
-          fi
+          # Idempotent + race-safe: create first, treat "already exists" as success.
+          create_err="$(
+            gh api "repos/$GITHUB_REPOSITORY/git/refs" \
+              --method POST \
+              --field "ref=refs/tags/$TAG_NAME" \
+              --field "sha=$TAG_SHA" 2>&1
+          )" || {
+            if grep -qiE 'already exists|HTTP 409|HTTP 422' <<<"$create_err"; then
+              echo "Tag $TAG_NAME already exists — skipping."
+              exit 0
+            fi
+            echo "$create_err"
+            exit 1
+          }
+          echo "Tag $TAG_NAME created successfully."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 44 - 53, Replace the current
check-then-create pattern for tag creation (the gh api GET of refs for TAG_NAME
followed by the gh api POST to "repos/$GITHUB_REPOSITORY/git/refs" with
ref=refs/tags/$TAG_NAME and sha=$TAG_SHA) with an atomic create-and-handle
approach: attempt the POST unconditionally and consider the operation successful
if it returns success or fails with an error indicating the ref already exists
(treat the "already exists"/HTTP 422 conflict style response from the POST as
success), otherwise fail the job; ensure your handling inspects the POST
response/error and only treats genuine errors as failures.

.github/workflows/release.yml (1)

47-60: ⚠️ Potential issue | 🟠 Major

Tighten create-ref status handling to avoid false “already exists” success.

Treating every 422 as idempotent success can hide real validation failures (bad ref/sha), and conflict-style responses may also appear as 409. Handle 409 explicitly and only treat 422 as success when the error body clearly indicates an existing ref.

Suggested patch

-          HTTP_CODE=$(gh api "repos/$GITHUB_REPOSITORY/git/refs" \
+          RESPONSE="$(gh api "repos/$GITHUB_REPOSITORY/git/refs" \
             --method POST \
             --field "ref=refs/tags/$TAG_NAME" \
             --field "sha=$TAG_SHA" \
-            --silent --include 2>&1 | head -1 | grep -oE '[0-9]{3}' || echo "000")
+            --silent --include 2>&1 || true)"
+          HTTP_CODE="$(printf '%s\n' "$RESPONSE" | head -1 | grep -oE '[0-9]{3}' || echo "000")"

           case "$HTTP_CODE" in
             201) echo "Tag $TAG_NAME created successfully." ;;
-            422) echo "Tag $TAG_NAME already exists — skipping." ;;
+            409) echo "Tag $TAG_NAME already exists — skipping." ;;
+            422)
+              if printf '%s\n' "$RESPONSE" | grep -qiE 'already exists|Reference already exists'; then
+                echo "Tag $TAG_NAME already exists — skipping."
+              else
+                echo "::error::Validation failed creating tag $TAG_NAME (HTTP 422)"
+                printf '%s\n' "$RESPONSE"
+                exit 1
+              fi
+              ;;
             *)
               echo "::error::Failed to create tag $TAG_NAME (HTTP $HTTP_CODE)"
               exit 1
               ;;
           esac

For GitHub REST API "Create a reference" (POST /repos/{owner}/{repo}/git/refs), which status codes are documented for "reference already exists", and what non-"already exists" 422 validation failures are documented?

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 47 - 60, Capture both the full gh
api response body and the HTTP status instead of only the status (variables
HTTP_CODE and RESPONSE_BODY), then update the case logic in the create-ref block
to: treat 201 as success; treat 409 explicitly as "Tag already exists —
skipping"; for 422, inspect RESPONSE_BODY for the specific "Reference already
exists" (or equivalent GitHub error message) and only skip when that exact
message is present, otherwise treat 422 as a real validation error and fail;
ensure you reference the existing variables TAG_NAME and TAG_SHA and the gh api
POST that creates refs when making these changes.