From a7fb95c9cbf785d6b238e90f718bdc20b07b6286 Mon Sep 17 00:00:00 2001
From: SASAGAWA Kiyoshi <sasapiyo@love-rox.cc>
Date: Wed, 14 Oct 2026 08:59:47 +0900
Subject: [PATCH] fix: mark auto-tag tags explicitly for the release guard
 (refs #282)

auto-tag now adds an "[auto-tag]" marker to the tag message and the
release.yml guard checks for it, so the two workflows no longer depend
on the git user.name string alone. The tagger check remains as a
fallback for tags created before the marker.

Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
---
 .github/workflows/auto-tag.yml |  4 +++-
 .github/workflows/release.yml  | 11 +++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/auto-tag.yml b/.github/workflows/auto-tag.yml
index b79beacf..036d5adc 100644
--- a/.github/workflows/auto-tag.yml
+++ b/.github/workflows/auto-tag.yml
@@ -55,7 +55,9 @@ jobs:
           echo "Creating tag: $TAG"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "$TAG" -m "Release $TAG"
+          # The "[auto-tag]" marker in the tag message tells release.yml to skip
+          # this tag (#278, #282). Keep it in sync with the guard job there.
+          git tag -a "$TAG" -m "Release $TAG [auto-tag]"
           git push origin "$TAG"
           echo "Successfully created and pushed tag: $TAG"
           echo "created=true" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ea3930f..8b2693b2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,8 +32,9 @@ jobs:
   # 0. Skip tags pushed by auto-tag.yml. auto-tag pushes with RELEASE_PAT, which
   #    (unlike GITHUB_TOKEN) fires this workflow too; without this guard both
   #    workflows create the same release and race on the SBOM upload (#278).
-  #    auto-tag creates annotated tags as github-actions[bot], so the tagger
-  #    tells them apart from tags pushed by hand.
+  #    auto-tag puts an explicit "[auto-tag]" marker in the tag message (#282).
+  #    The github-actions[bot] tagger check covers tags created before the
+  #    marker was introduced.
   guard:
     runs-on: ubuntu-latest
     outputs:
@@ -51,11 +52,13 @@ jobs:
           fi
           read -r TYPE SHA < <(gh api "repos/${{ github.repository }}/git/ref/tags/${TAG}" --jq '.object.type + " " + .object.sha')
           TAGGER=""
+          MESSAGE=""
           if [ "$TYPE" = "tag" ]; then
             TAGGER=$(gh api "repos/${{ github.repository }}/git/tags/${SHA}" --jq '.tagger.name')
+            MESSAGE=$(gh api "repos/${{ github.repository }}/git/tags/${SHA}" --jq '.message')
           fi
-          echo "Tag ${TAG}: type=${TYPE}, tagger=${TAGGER:-<none>}"
-          if [ "$TAGGER" = "github-actions[bot]" ]; then
+          echo "Tag ${TAG}: type=${TYPE}, tagger=${TAGGER:-<none>}, message=${MESSAGE:-<none>}"
+          if [[ "$MESSAGE" == *"[auto-tag]"* ]] || [ "$TAGGER" = "github-actions[bot]" ]; then
             echo "Tag was created by auto-tag.yml, which handles the release. Skipping."
             echo "skip=true" >> "$GITHUB_OUTPUT"
           else