From 3adfa34dd3d7f8dba864c0fb90c4d1537fef9e41 Mon Sep 17 00:00:00 2001
From: Lucas Bedatty <lucas.bedatty@lerian.studio>
Date: Fri, 17 Apr 2026 17:22:44 -0300
Subject: [PATCH] fix(update-major-tag): use --force-with-lease to guard
 against concurrent tag rewinds

---
 src/config/update-major-tag/action.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/config/update-major-tag/action.yml b/src/config/update-major-tag/action.yml
index c384062..e9477d3 100644
--- a/src/config/update-major-tag/action.yml
+++ b/src/config/update-major-tag/action.yml
@@ -64,7 +64,13 @@ runs:
 
         echo "Moving $MAJOR → $LATEST ($SHA)"
         git tag -f -a "$MAJOR" "$SHA" -m "Release $MAJOR ($LATEST)"
-        git push origin "refs/tags/$MAJOR:refs/tags/$MAJOR" --force
+
+        # Use --force-with-lease to avoid rewinding $MAJOR if a concurrent
+        # release already advanced it between our fetch and our push.
+        REMOTE_MAJOR_SHA=$(git ls-remote --refs --tags origin "refs/tags/$MAJOR" | awk '{print $1}')
+        LEASE_SHA="${REMOTE_MAJOR_SHA:-0000000000000000000000000000000000000000}"
+        git push origin "refs/tags/$MAJOR:refs/tags/$MAJOR" \
+          --force-with-lease="refs/tags/$MAJOR:$LEASE_SHA"
 
         {
           echo "skip=false"