From f7ae4c042f2649bbf4cb1bc7f9d10bb06f390fd4 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Fri, 25 Sep 2026 19:35:52 +0100
Subject: [PATCH] ci(release): move the v1 tag onto the image pin commit

The release job moves the rolling v1 tag to the release commit. The
update-action-version job then pins action.yml to the new image in a
later commit. So v1 always pointed at a commit that pinned the
previous image, and "@v1" users ran the previous release.

The job now checks out the released commit, pushes the pin commit with
"git push origin HEAD:main", and moves v1 onto it after that push
succeeds. If main moved during the release, the push fails and v1
stays where it is. The job runs only for main, and a concurrency group
queues overlapping release runs.

Claude-Session: https://claude.ai/code/session_01Qq1gbqQek1Zjtofo4VDRdW
---
 .github/workflows/release.yaml | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fb43539..de8354b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,6 +14,10 @@ permissions:
   contents: write
   packages: write
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   release:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
@@ -27,11 +31,11 @@ jobs:
   update-action-version:
     needs: release
     runs-on: ubuntu-latest
-    if: needs.release.outputs.version != ''
+    if: github.ref == 'refs/heads/main' && needs.release.outputs.version != ''
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: main
+          ref: ${{ github.sha }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Update action.yml with release version
@@ -52,5 +56,17 @@ jobs:
             echo "No changes to commit"
           else
             git commit -m "chore: pin action.yml Docker image to v${{ needs.release.outputs.version }}"
-            git push
+            # Push the pin commit onto main explicitly (not just "git push"):
+            # this checkout started from the released commit (github.sha), not
+            # main's tip, so if main moved in the meantime this push is a
+            # non-fast-forward and fails safely instead of overwriting it.
+            git push origin HEAD:main
+            # Only move the rolling tag once the pin commit is confirmed on
+            # main. The "release" job above already moved it to the release
+            # commit, but this job then commits action.yml's image pin on top
+            # of that, so without this the rolling tag would always be one
+            # commit behind, pinning the PREVIOUS image.
+            # "v1" must match the release job's rolling-release-tag input.
+            git tag -f v1 HEAD
+            git push -f origin refs/tags/v1
           fi