reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/win-dev-skills/.github/workflows/release-post-merge.yml

@@ -0,0 +1,88 @@
+name: Release post-merge
+
+# On every push to main: if the catalog version changed, tag main HEAD as
+# vX.Y.Z. The catalog version is metadata.version in
+# .github/plugin/marketplace.json (the Catalog check keeps the Claude catalog
+# in sync). Pushes that don't change it are skipped.
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write       # push tags
+
+# Serialize tag-creation across overlapping pushes to main so two workflow runs
+# can't race on the same tag.
+concurrency:
+  group: release-post-merge-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+
+  auto-tag:
+    name: Tag main HEAD as vX.Y.Z
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Read catalog version
+        id: ver
+        env:
+          BEFORE: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          CATALOG=.github/plugin/marketplace.json
+          VERSION=$(jq -r '.metadata.version' "$CATALOG")
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::$CATALOG metadata.version '$VERSION' is not valid semver. Refusing to tag."
+            exit 1
+          fi
+          PREVIOUS=""
+          if [[ -n "$BEFORE" && ! "$BEFORE" =~ ^0+$ ]] && git cat-file -e "$BEFORE:$CATALOG" 2>/dev/null; then
+            PREVIOUS=$(git show "$BEFORE:$CATALOG" | jq -r '.metadata.version // empty')
+          elif git cat-file -e "HEAD^1:$CATALOG" 2>/dev/null; then
+            PREVIOUS=$(git show "HEAD^1:$CATALOG" | jq -r '.metadata.version // empty')
+          fi
+          if [[ "$PREVIOUS" == "$VERSION" ]]; then
+            echo "::notice::Catalog version unchanged ($VERSION) — no tag."
+            echo "tag=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Create and push tag (idempotent, SHA-checked)
+        if: steps.ver.outputs.tag != ''
+        env:
+          TAG: ${{ steps.ver.outputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch --tags origin --quiet
+
+          # Same SHA = idempotent success. A tag on an earlier main commit (e.g.
+          # after reverting a bump) is left alone. Anything else fails loudly;
+          # never overwrite or accept a misplaced tag.
+          if git rev-parse --verify --quiet "refs/tags/$TAG^{}" >/dev/null; then
+            EXISTING_SHA=$(git rev-parse "refs/tags/$TAG^{}")
+            if [[ "$EXISTING_SHA" == "$GITHUB_SHA" ]]; then
+              echo "::notice::Tag $TAG already points at $GITHUB_SHA — nothing to do."
+              exit 0
+            fi
+            if git merge-base --is-ancestor "$EXISTING_SHA" "$GITHUB_SHA"; then
+              echo "::notice::Tag $TAG already exists at earlier commit $EXISTING_SHA — not moving it."
+              exit 0
+            fi
+            echo "::error::Tag $TAG already exists at $EXISTING_SHA but main HEAD is $GITHUB_SHA. Bump the catalog version instead of reusing one."
+            exit 1
+          fi
+
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$TAG" -m "Release $TAG"
+          git push origin "$TAG"
+          echo "::notice::Tagged $GITHUB_SHA as $TAG."