fix: workflow updated

Author: hosseinkarami-dev

.github/workflows/ci-cd.yml

@@ -118,32 +118,61 @@ jobs:
         if: steps.commit.outputs.pr_required != 'true'
         run: echo "No regenerated changes — nothing to create a PR for."
 
-      # Sync main after merge
+      # Sync main after merge (force fetch tags + main)
       - name: Sync main after merge
         if: steps.commit.outputs.pr_required == 'true'
         run: |
           set -euo pipefail
+          echo "Waiting for GitHub to update merge state..."
+          # give GitHub a moment
           sleep 10
-          git fetch origin main --tags
+          # force fetch main and tags from remote to ensure runner sees latest
+          git fetch origin main --force
+          git fetch origin --tags --force
           git checkout main
           git reset --hard origin/main
+          echo "Main branch and tags synced successfully."
 
-      # Determine new tag (SemVer Patch)
+      # Determine new tag (SemVer Patch) — robust: read remote tags, sort, and ensure uniqueness
       - name: Determine new tag version
         if: steps.commit.outputs.pr_required == 'true'
         id: tag
         run: |
           set -euo pipefail
-          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v1.0.0")
+          # Make sure we have up-to-date tags
+          git fetch origin --tags --force
+
+          # List remote tags that match semver vMAJOR.MINOR.PATCH
+          # Use ls-remote to be sure we check remote state
+          TAGS=$(git ls-remote --tags origin | awk '{print $2}' | sed 's|refs/tags/||' | sed 's/\^{}//g' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' || true)
+
+          if [ -z "${TAGS:-}" ]; then
+            LAST_TAG="v1.0.0"
+          else
+            # pick highest semantic version (sort -V works on ubuntu)
+            LAST_TAG=$(echo "$TAGS" | sort -V | tail -n1)
+          fi
+
+          echo "Last tag detected: ${LAST_TAG}"
+
+          # Parse components safely
           IFS='.' read -r MAJOR MINOR PATCH <<<"${LAST_TAG#v}"
           MAJOR=${MAJOR:-1}
           MINOR=${MINOR:-0}
           PATCH=${PATCH:-0}
 
+          # increment patch
           PATCH=$((PATCH+1))
           NEW_TAG="v${MAJOR}.${MINOR}.${PATCH}"
+
+          # ensure uniqueness in remote (race protection) - bump patch until unique
+          while git ls-remote --tags origin | awk '{print $2}' | sed 's|refs/tags/||' | sed 's/\^{}//g' | grep -qx "${NEW_TAG}"; do
+            PATCH=$((PATCH+1))
+            NEW_TAG="v${MAJOR}.${MINOR}.${PATCH}"
+          done
+
+          echo "Determined new tag: ${NEW_TAG}"
           echo "new_tag=${NEW_TAG}" >> $GITHUB_OUTPUT
-          echo "Next tag determined: ${NEW_TAG}"
 
       # Create and push tag
       - name: Create and push tag
@@ -154,16 +183,17 @@ jobs:
         run: |
           set -euo pipefail
           NEW_TAG="${{ steps.tag.outputs.new_tag }}"
-          git fetch --tags
 
-          if git rev-parse "refs/tags/${NEW_TAG}" >/dev/null 2>&1; then
-            echo "Tag ${NEW_TAG} already exists. Skipping."
+          # final safety check: if tag already exists remotely, skip
+          if git ls-remote --tags origin | awk '{print $2}' | sed 's|refs/tags/||' | sed 's/\^{}//g' | grep -qx "${NEW_TAG}"; then
+            echo "Tag ${NEW_TAG} already exists on remote. Skipping."
             echo "tag_created=false" >> $GITHUB_OUTPUT
             exit 0
           fi
 
           git tag -a "${NEW_TAG}" -m "Release ${NEW_TAG} (automated)"
-          git push "https://x-access-token:${PAT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "${NEW_TAG}"
+          git push "https://x-access-token:${PAT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "refs/tags/${NEW_TAG}"
+
           echo "tag_created=true" >> $GITHUB_OUTPUT
           echo "Created tag ${NEW_TAG}"