fix(#2420): automate v0 floating tag move in release workflow

[rh-hemartin]

Summary

• Add post-GoReleaser step in release.yml to force-move v0 tag, with ancestry check to prevent race conditions between concurrent releases
• Add git.ignore_tags in .goreleaser.yml so v0 doesn't confuse previous-tag detection (root cause of previous=<unknown> / 1,216-entry changelogs)
• Remove manual step 8 from cutting-releases skill, update post-flight docs

Closes #2420

Test plan

• Verify release.yml syntax is valid (actionlint / CI)
• Confirm .goreleaser.yml parses correctly (goreleaser check)
• On next release: changelog should show only commits since previous semver tag, not entire history
• On next release: v0 tag should move automatically without manual intervention
• Pre-release tags (e.g. v0.19.0-rc.1) should skip the v0 move step

🤖 Generated with Claude Code

[github-actions]

Site preview

Preview: https://ea8d4507-site.fullsend-ai.workers.dev

Commit: 4ee125abf09ce07393a2ed5115d9db3456f11243

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:40 PM UTC · Completed 1:52 PM UTC
Commit: 0c869d8 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/release.yml, skills/cutting-releases/SKILL.md, skills/cutting-releases/post-flight.md — Three of four changed files are under protected paths (.github/, skills/). The PR links to issue release: move v0 floating tag in CI after GoReleaser completes #2420 and explains the rationale for these changes. Human approval is always required for protected-path changes, regardless of context.

• [documentation-code-mismatch] skills/cutting-releases/post-flight.md:12 — The diff changes the Sandbox Images workflow trigger description to "triggered by release workflow", but sandbox-images.yml triggers on semver tag pushes matching v[0-9]+.[0-9]+* (lines 5–6). The Sandbox Images workflow is triggered independently by the same semver tag push, not by the release workflow. The old text ("triggered by the v0 tag move") was also inaccurate since v0 doesn't match the semver pattern.
  Remediation: Change the parenthetical to "(triggered by the semver tag push)".

Low

• [race-condition] .github/workflows/release.yml:48 — The --force-with-lease="v0:${CURRENT}" push is an atomic server-side check, so a concurrent release that moves v0 between the local git rev-parse and the push will cause the push to fail safely rather than silently overwriting. However, on failure there is no retry mechanism, so v0 would remain not updated for that release. Practical risk is very low since releases are cut manually and sequentially.

• [error-message-style] .github/workflows/release.yml:44 — The ::warning:: message could include the current v0 SHA (${CURRENT}) and ${GITHUB_SHA} for easier debugging when the ancestry check skips the v0 move.

• [documentation-code-mismatch] docs/ADRs/0048-automatic-updates.md:58 — ADR 0048 lists "v0 should be migrated to the new moving tag and deleted" as a future consequence. This PR automates v0 instead of deprecating it, which extends v0's operational lifespan but does not violate the ADR's decision. No immediate action required.

• [missing-authorization] .github/workflows/release.yml:36 — The automated v0 tag move removes a human confirmation checkpoint (AskUserQuestion) that was previously in SKILL.md step 8. The release itself still requires a human to push the semver tag, which implicitly authorizes the v0 move. The removed checkpoint was defense-in-depth, not a primary authorization gate.

---

Labels: PR modifies the release CI workflow and release skill documentation.

Previous run

Review

Findings

Medium

• [protected-path] .github/workflows/release.yml, skills/cutting-releases/SKILL.md, skills/cutting-releases/post-flight.md — Three of four changed files are under protected paths (.github/, skills/). The PR links to issue release: move v0 floating tag in CI after GoReleaser completes #2420 and explains the rationale for these changes. Human approval is always required for protected-path changes, regardless of context.

• [shell-error-handling] .github/workflows/release.yml:36 — The new shell script in the "Move v0 floating tag" step does not use set -euo pipefail. All other multi-line run: blocks across the repository's workflows consistently use it as the first line. Without set -e, a failed git tag -f would silently continue to git push origin v0 --force with stale state.
  Remediation: Add set -euo pipefail as the first line of the run: block.

• [documentation-accuracy] skills/cutting-releases/post-flight.md:12 — The diff changes the Sandbox Images trigger description to "triggered by release workflow", but sandbox-images.yml is triggered by a tag push matching v[0-9]+.[0-9]+* (the semver version tag), not by the release workflow (there is no workflow_call or workflow_run trigger linking them). The old text was also wrong — the bare v0 tag never matched that pattern either.
  Remediation: Change the parenthetical to "(triggered by the version tag push)".

Low

• [race-condition] .github/workflows/release.yml:40 — The ancestry guard checks v0's position with git rev-parse and git merge-base, then force-pushes in a separate step. A concurrent release could move v0 between the check and push. The practical risk is very low since releases are cut manually and sequentially. Consider using git push --force-with-lease=v0:<expected-sha> for atomic safety.

• [documentation-code-mismatch] docs/ADRs/0048-automatic-updates.md:58 — ADR 0048 lists "v0 should be migrated to the new moving tag and deleted" as a future consequence. This PR automates v0 instead of deprecating it, which extends v0's operational lifespan but does not violate the ADR's decision. No immediate action required.

---

Labels: PR modifies CI release workflow and release skill documentation

Previous run

Review

Findings

Medium

• [protected-path] .github/workflows/release.yml, skills/cutting-releases/SKILL.md, skills/cutting-releases/post-flight.md — Three of four changed files are under protected paths (.github/, skills/). The PR links to issue release: move v0 floating tag in CI after GoReleaser completes #2420 and explains the rationale for these changes. Human approval is always required for protected-path changes, regardless of context.

• [shell-error-handling] .github/workflows/release.yml:36 — The new shell script in the "Move v0 floating tag" step does not use set -euo pipefail. All other multi-line run: blocks across the repository's workflows consistently use it as the first line. Without set -e, a failed git tag -f would silently continue to git push origin v0 --force with stale state.
  Remediation: Add set -euo pipefail as the first line of the run: block.

• [documentation-accuracy] skills/cutting-releases/post-flight.md:12 — The diff changes the Sandbox Images trigger description to "triggered by release workflow", but sandbox-images.yml is triggered by a tag push matching v[0-9]+.[0-9]+* (the semver version tag), not by the release workflow (there is no workflow_call or workflow_run trigger linking them). The old text was also wrong — the bare v0 tag never matched that pattern either.
  Remediation: Change the parenthetical to "(triggered by the version tag push)".

Low

• [race-condition] .github/workflows/release.yml:40 — The ancestry guard checks v0's position with git rev-parse and git merge-base, then force-pushes in a separate step. A concurrent release could move v0 between the check and push. The practical risk is very low since releases are cut manually and sequentially. Consider using git push --force-with-lease=v0:<expected-sha> for atomic safety.

• [documentation-code-mismatch] docs/ADRs/0048-automatic-updates.md:58 — ADR 0048 lists "v0 should be migrated to the new moving tag and deleted" as a future consequence. This PR automates v0 instead of deprecating it, which extends v0's operational lifespan but does not violate the ADR's decision. No immediate action required.

---

Labels: PR modifies the release CI workflow and release skill documentation.

Previous run (2)

Review

Findings

Medium

• [protected-path] .github/workflows/release.yml, skills/cutting-releases/SKILL.md, skills/cutting-releases/post-flight.md — Three of four changed files are under protected paths (.github/, skills/). The PR links to issue release: move v0 floating tag in CI after GoReleaser completes #2420 and explains the rationale for these changes. Human approval is always required for protected-path changes, regardless of context.

Low

• [race-condition] .github/workflows/release.yml:40 — The ancestry guard checks v0's position locally then force-pushes later. A concurrent release could move v0 between the check and push, allowing the slower job to regress v0. The practical risk is very low since releases are cut manually and sequentially. Consider using git push --force-with-lease=v0:<expected-sha> for atomic safety.

• [github-actions-workflow-annotation] .github/workflows/release.yml:42 — The ::warning:: message could include commit SHAs (${CURRENT} and ${GITHUB_SHA}) for easier debugging when the ancestry check skips the v0 move.

• [architectural-tension] .github/workflows/release.yml:36 — ADR 0048 (accepted 2026-06-09) plans to migrate the v0 floating tag to a new scheme. This PR automates the existing manual process, which is pragmatic while migration is planned but extends v0's operational lifespan. Consider adding a comment noting this is interim automation.

• [documentation-internal-consistency] skills/cutting-releases/post-flight.md:12 — Section A references "the Sandbox Images workflow (triggered by the v0 tag move)" but the sandbox-images workflow trigger pattern (v[0-9]+.[0-9]+*) does not match the bare v0 tag. Pre-existing inaccuracy that could be corrected in this PR.

• [naming-alignment] .goreleaser.yml:3 — The git.ignore_tags list includes v1 and v2 which are not currently used. The existing comment explains the purpose adequately; this is a minor forward-compatibility measure.

Info

• [edge-case] .github/workflows/release.yml:34 — The pre-release filter !contains(github.ref_name, '-') correctly skips RC/alpha/beta tags. Under standard semver, hyphens always denote pre-release identifiers, so this is a non-issue.

[ralphbean]

A couple things to sort out before we merge. See inline comments.

[ralphbean]

Thanks for digging into this.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:09 AM UTC · Completed 6:20 AM UTC
Commit: 2eb1a21 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] shell-error-handling

The new shell script in the Move v0 floating tag step does not use set -euo pipefail. All other multi-line run: blocks across the repository workflows consistently use it. Without set -e, a failed git tag -f would silently continue to git push with stale state.

Suggested fix: Add set -euo pipefail as the first line of the run: block.

[fullsend-ai-review]

[medium] documentation-accuracy

The Sandbox Images trigger description says triggered by release workflow but sandbox-images.yml is triggered by a tag push matching v[0-9]+.[0-9]+* (the semver version tag), not by the release workflow.

Suggested fix: Change the parenthetical to (triggered by the version tag push).

[fullsend-ai-review]

[low] race-condition

The ancestry guard checks v0 position then force-pushes in a separate git operation. A concurrent release could move v0 between check and push. Practical risk is negligible since releases are manual and sequential.

Suggested fix: Replace git push origin v0 --force with git push --force-with-lease=v0: origin v0.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:17 AM UTC · Completed 7:29 AM UTC
Commit: 4ee125a · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] documentation-code-mismatch

The diff changes the Sandbox Images workflow trigger description to 'triggered by release workflow', but sandbox-images.yml triggers on semver tag pushes matching v[0-9]+.[0-9]+*, not by the release workflow. The old text was also inaccurate.

Suggested fix: Change the parenthetical to '(triggered by the semver tag push)'.

[fullsend-ai-review]

[low] race-condition

The --force-with-lease push is an atomic server-side check, so concurrent releases fail safely. However, there is no retry mechanism, so v0 would remain not updated on failure. Practical risk is very low.

[fullsend-ai-review]

[low] error-message-style

The ::warning:: message could include the current v0 SHA (${CURRENT}) and ${GITHUB_SHA} for easier debugging when the ancestry check skips the v0 move.

[fullsend-ai-review]

[low] missing-authorization

The automated v0 tag move removes a human confirmation checkpoint (AskUserQuestion) from SKILL.md step 8. The semver tag push itself serves as the authorization gate.

[ralphbean]

LGTM.