From cd3cbc76820c14ac694dcbffaee2a5e2c8b06585 Mon Sep 17 00:00:00 2001
From: Zachary Lyon <zachary@lyonfamily.org>
Date: Mon, 31 Aug 2026 11:40:17 -0700
Subject: [PATCH] ci(hermes): tag hermes-v<version> on merge to main (PF-3818)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MuBZaWAagoiTbcZzzCcq5K
---
 .github/workflows/hermes-release.yml | 43 ++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .github/workflows/hermes-release.yml

diff --git a/.github/workflows/hermes-release.yml b/.github/workflows/hermes-release.yml
new file mode 100644
index 0000000..412d3e2
--- /dev/null
+++ b/.github/workflows/hermes-release.yml
@@ -0,0 +1,43 @@
+---
+name: Hermes CD - Tag release
+
+# Renovate reads these tags to bump the ux-labs plugin pin.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/hermes-release.yml"
+      - "hermes/**"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: hermes-release
+  cancel-in-progress: false
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Tag hermes-v<version> unless it already exists
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          version=$(sed -n 's/^version = "\(.*\)"$/\1/p' hermes/pyproject.toml | head -1)
+          [ -n "$version" ] || { echo "::error file=hermes/pyproject.toml::no version found"; exit 1; }
+          tag="hermes-v${version}"
+          if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${tag}" >/dev/null 2>&1; then
+            echo "${tag} already exists; nothing to do"
+            exit 0
+          fi
+          gh api --method POST "repos/${GITHUB_REPOSITORY}/git/refs" \
+            -f "ref=refs/tags/${tag}" -f "sha=${GITHUB_SHA}"
+          echo "tagged ${tag} at ${GITHUB_SHA}"