fix(ci): tag releases after updating lockfiles

.github/workflows/make-release-commit.yml

@@ -1,7 +1,8 @@
 name: Create release commit
 
-# This workflow increments the version, tags it, and pushes it. All SDKs share
-# a single version, so one tag releases all of them.
+# This workflow increments the version, updates lockfiles, tags the final
+# commit, and pushes it. All SDKs share a single version, so one tag releases
+# all of them.
 # When a tag is pushed, another workflow is triggered that creates a GH release
 # and uploads the binaries. This workflow is only for creating the tag.
 
@@ -63,6 +64,7 @@ jobs:
           pip install bump-my-version PyGithub packaging
           bash ci/bump_version.sh ${{ inputs.type }} ${{ inputs.bump-minor }}
           bash ci/update_lockfiles.sh --amend
+          bash ci/create_release_tag.sh
       - name: Push new version tag
         if: ${{ !inputs.dry_run }}
         uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0

ci/bump_version.sh

@@ -6,16 +6,11 @@ HEAD_SHA=$(git rev-parse HEAD)
 
 readonly TAG_PREFIX="v"
 readonly SELF_DIR=$(cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+readonly BUMP_ARGS="--no-tag"
 
 PREV_TAG=$(git tag --sort='version:refname' | grep ^$TAG_PREFIX | python $SELF_DIR/semver_sort.py $TAG_PREFIX | tail -n 1)
 echo "Found previous tag $PREV_TAG"
 
-# Initially, we don't want to tag if we are doing stable, because we will bump
-# again later. See comment at end for why.
-if [[ "$RELEASE_TYPE" == 'stable' ]]; then
-  BUMP_ARGS="--no-tag"
-fi
-
 # If last is stable and not bumping minor
 if [[ $PREV_TAG != *beta* ]]; then
     if [[ "$BUMP_MINOR" != "false" ]]; then
@@ -39,12 +34,12 @@ fi
 # a stable version, bump the pre-release level ("pre_l") to make it stable.
 if [[ $RELEASE_TYPE == 'stable' ]]; then
   # X.Y.Z-beta.N -> X.Y.Z
-  bump-my-version bump -vv pre_l
+  bump-my-version bump -vv $BUMP_ARGS pre_l
 fi
 
 # Validate that we have incremented version appropriately for breaking changes
-NEW_TAG=$(git describe --tags --exact-match HEAD)
-NEW_VERSION=$(echo $NEW_TAG | sed "s/^$TAG_PREFIX//")
+NEW_VERSION=$(python -c 'import tomllib; print(tomllib.load(open(".bumpversion.toml", "rb"))["tool"]["bumpversion"]["current_version"])')
+NEW_TAG="$TAG_PREFIX$NEW_VERSION"
 LAST_STABLE_RELEASE=$(git tag --sort='version:refname' | grep ^$TAG_PREFIX | grep -v beta | grep -vF "$NEW_TAG" | python $SELF_DIR/semver_sort.py $TAG_PREFIX | tail -n 1)
 LAST_STABLE_VERSION=$(echo $LAST_STABLE_RELEASE | sed "s/^$TAG_PREFIX//")
 

ci/create_release_tag.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RELEASE_VERSION=$(python -c 'import tomllib; print(tomllib.load(open(".bumpversion.toml", "rb"))["tool"]["bumpversion"]["current_version"])')
+RELEASE_TAG="v${RELEASE_VERSION}"
+
+if git rev-parse --quiet --verify "refs/tags/${RELEASE_TAG}" >/dev/null; then
+  echo "Release tag ${RELEASE_TAG} already exists" >&2
+  exit 1
+fi
+
+git tag --annotate "$RELEASE_TAG" --message "Release ${RELEASE_TAG}"
+
+HEAD_SHA=$(git rev-parse HEAD)
+TAG_SHA=$(git rev-parse "refs/tags/${RELEASE_TAG}^{}")
+if [[ "$TAG_SHA" != "$HEAD_SHA" ]]; then
+  echo "Release tag ${RELEASE_TAG} points to ${TAG_SHA}, expected ${HEAD_SHA}" >&2
+  exit 1
+fi
+
+echo "Created ${RELEASE_TAG} at ${HEAD_SHA}"