refactor(ci): atomic release and tag creation using gh cli target

Made-with: Cursor

Author: Hongwei-MB

.github/workflows/ci.yml

@@ -819,41 +819,13 @@ jobs:
           subject-path: ${{ steps.attest-subjects.outputs.subjects }}
           sbom-path: sbom-spdx.json
 
-      - name: Create and push tag
-        shell: bash
-        run: |
-          TAG="${{ needs.version.outputs.tag }}"
-          SHA="${{ needs.version.outputs.sha }}"
-
-          git fetch --tags --force
-          if git ls-remote --tags origin "refs/tags/$TAG" | grep -q "$TAG"; then
-            REMOTE_SHA=$(git ls-remote --tags origin "refs/tags/$TAG^{}" | awk '{print $1}')
-            if [ -z "$REMOTE_SHA" ]; then
-              REMOTE_SHA=$(git ls-remote --tags origin "refs/tags/$TAG" | awk '{print $1}')
-            fi
-            
-            if [ "$REMOTE_SHA" == "$SHA" ]; then
-              echo "Tag $TAG already exists and points to current SHA. Skipping tag push."
-            else
-              echo "::error::Tag $TAG already exists on remote but points to a different SHA ($REMOTE_SHA != $SHA)"
-              exit 1
-            fi
-          else
-            if git rev-parse "$TAG" >/dev/null 2>&1; then
-              echo "::error::Tag $TAG already exists locally but not on remote"
-              exit 1
-            fi
-            git tag "$TAG" "$SHA"
-            git push origin "$TAG"
-            echo "Created and pushed tag $TAG at $SHA"
-          fi
-
-      - name: Create GitHub Release
+      - name: Create Tag and GitHub Release
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           TAG="${{ needs.version.outputs.tag }}"
+          SHA="${{ needs.version.outputs.sha }}"
           RELEASE_NAME="Agibuild.Fulora $TAG"
           VERSION_SUFFIX="${{ needs.version.outputs.version_suffix }}"
 
@@ -867,11 +839,14 @@ jobs:
             PRERELEASE_FLAG="--prerelease"
           fi
 
+          # The --target parameter instructs the GitHub API to create the tag
+          # at the specified SHA if it doesn't already exist.
           gh release create "$TAG" \
+            --target "$SHA" \
             --title "$RELEASE_NAME" \
             --generate-notes \
             $PRERELEASE_FLAG
-          echo "Created release $TAG"
+          echo "Created release and tag (if absent) $TAG at $SHA"
 
   deploy-docs:
     name: Deploy Documentation