Rebase and atomically push commit with tag in publish workflow (#48)

Author: Thejus-Paul

.github/workflows/publish.yml

@@ -20,17 +20,18 @@ jobs:
       contains(github.event.pull_request.labels.*.name, 'major') ) }}
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           token: ${{ secrets.RELEASE_PAT }}
+          fetch-depth: 0
 
       - name: Setup git user
         run: |
           git config user.name "neetobot"
           git config user.email "neetobot.github@neeto.com"
 
       - name: Setup NodeJS LTS version
-        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version-file: ".nvmrc"
 
@@ -63,15 +64,19 @@ jobs:
         id: package-version
 
       - name: Create a new version release commit
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # v10
         with:
           message: "New version release"
+          push: false
 
-      - name: Push the commit to main
-        uses: ad-m/github-push-action@master
-        with:
-          github_token: ${{ secrets.RELEASE_PAT }}
-          branch: main
+      - name: Rebase on latest main and push commit and tag
+        working-directory: ${{ github.workspace }}
+        run: |
+          VERSION=$(node -p "require('./js/package.json').version")
+          git fetch origin main
+          git rebase origin/main
+          git tag -f "v${VERSION}"
+          git push --atomic origin HEAD:main "refs/tags/v${VERSION}"
 
       - name: Publish the package on NPM
         run: |