Release jobs can race

[winterqt]

Despite the check that tries to prevent this, we still can blow up during release due to concurrent tag creation:

• https://github.com/hegeldev/hegel-rust/actions/runs/23505886841/job/68413938573
• https://github.com/hegeldev/hegel-rust/actions/runs/23506008902/job/68414431706

We should add a concurrency group so that only a single release job can run on this repo at any given moment, to prevent this in the future.

[winterqt]

OK, no, 0.2.1 just wasn't published for any of the crates.

[Liam-DeVoe]

I don't think this happened because of concurrent tag creation. I think this happened because this job started and cloned the repo before the PR after it was merged, then pushed after the PR was merged, so the push (and all subsequent steps like tag creation and release) was rejected https://github.com/hegeldev/hegel-rust/actions/runs/23505886841/job/68413938573.

I don't think this will be fixed by concurrency control. Hypothesis has never had this problem and I'm not sure why.

[winterqt]

I think this happened because this job started and cloned the repo before the PR after it was merged, then pushed after the PR was merged, so the push (and all subsequent steps like tag creation and release) was rejected...

Ah, sure. (The v0.2.1 tag does exist, though.)

I don't think this will be fixed by concurrency control.

Right, sigh. I'm sure there's some weird bit of magic (maybe abusing merge queues?) that could get us there, but I don't know off the top of my head.

[winterqt]

Hypothesis has never had this problem and I'm not sure why.

To clarify: have you ever done quick successive merges (like you did here earlier today) in Hypothesis?

[Liam-DeVoe]

Yes, but I'm now realizing that I don't think I've ever merged two PRs in quick succession where the first has a release note. I think that's always been blocked by our similar check in Hypothesis.

So the question is, why didn't that protect us here?

[winterqt]

I think that's always been blocked by our similar check in Hypothesis.

I did a quick scan through Hypothesis' tooling, and I don't see a similar check. Am I missing it?

So the question is, why didn't that protect us here?

That check only runs during the PR CI run (in check-release); it isn't actively run when you hit merge (so stale results will be persisted).