Merge pull request #18 from nutthead/fix/tainted-tag-deletion

fix(ci): Delete tainted tags when cleaning up broken releases

Author: behrangsa

.github/workflows/release.yml

@@ -531,6 +531,9 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
 
       - name: Download all artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
@@ -590,21 +593,47 @@ jobs:
             echo "   Assets: ${ASSET_COUNT}"
 
             if [ "$IS_DRAFT" = "false" ] && [ "$ASSET_COUNT" -eq 0 ]; then
-              echo "❌ ERROR: Published release exists with no assets (likely from previous failed run)"
-              echo "   Deleting broken release to allow recreation..."
-              gh release delete "v${VERSION}" --repo "${{ github.repository }}" --yes
-              echo "✅ Broken release deleted"
+              echo "❌ ERROR: Published release v${VERSION} exists with no assets (broken release)"
+              echo ""
+              echo "This version is now PERMANENTLY UNUSABLE due to GitHub's immutable release protection."
+              echo "Once a non-draft release is published, that tag name is permanently reserved."
+              echo ""
+              echo "You MUST use a different version number. Options:"
+              echo "  1. Bump patch version: v0.1.3 (recommended)"
+              echo "  2. Use patch suffix: v0.1.2.1 or v0.1.2-retry"
+              echo ""
+              echo "To proceed:"
+              echo "  1. Update version in Cargo.toml to 0.1.3 (or chosen version)"
+              echo "  2. Commit the change"
+              echo "  3. Let release-plz create the new tag, OR"
+              echo "  4. Re-run this workflow with the new version"
+              echo ""
+              echo "Note: Deleting the broken release will not help - the tag is tainted forever."
+              exit 1
             elif [ "$IS_DRAFT" = "false" ]; then
               echo "❌ ERROR: Published release already exists with ${ASSET_COUNT} assets"
               echo "   Cannot overwrite published releases. Please:"
               echo "   1. Delete the release manually: gh release delete v${VERSION}"
-              echo "   2. Or create a new version"
+              echo "   2. Delete the tag: git push origin --delete v${VERSION}"
+              echo "   3. Or create a new version"
               exit 1
             else
               echo "✅ Draft release exists - will be updated"
             fi
           else
-            echo "✅ No existing release found - will create new one"
+            echo "✅ No existing release found"
+
+            # Check if tag exists when using workflow_dispatch
+            if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+              if git ls-remote --tags origin | grep -q "refs/tags/v${VERSION}$"; then
+                echo "⚠️  WARNING: Tag v${VERSION} already exists"
+                echo "   Using existing tag for release creation"
+              else
+                echo "✅ Tag v${VERSION} does not exist - will create it in next step"
+              fi
+            else
+              echo "✅ Tag v${VERSION} exists (triggered by tag push)"
+            fi
           fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -691,6 +720,23 @@ jobs:
           *Released with ❤️ using GitHub Actions, release-plz, and Sigstore*
           EOF
 
+      - name: Create release tag
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          VERSION="${{ needs.prepare-release.outputs.version }}"
+
+          echo "Creating tag v${VERSION} for manual release..."
+
+          # Configure git for the workflow
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Create and push the tag
+          git tag -a "v${VERSION}" -m "Release v${VERSION}"
+          git push origin "v${VERSION}"
+
+          echo "✅ Tag v${VERSION} created and pushed"
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836 # v2.3.3
         with:

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "ruloc"
-version = "0.1.2"
+version = "0.1.3"
 authors = ["Behrang Saeedzadeh <hello@behrang.org>"]
 edition = "2024"
 rust-version = "1.90.0"