From dd4836c0abb2aed3b02146b051d425a41843504a Mon Sep 17 00:00:00 2001
From: Warren Gifford <warren@sourcegraph.com>
Date: Thu, 22 Oct 2026 08:17:23 +0000
Subject: [PATCH] release: Run promote finalize once, and make tag creation
 retry-safe

Creating the promote branch builds its first commit, the internal config
commit "release: vX". `--config-from-commit` accepts that config, so the
build runs the promote test and finalize jobs too. For v8.1.1335, that
build's finalize tagged the promote branch head and promoted the release.
Five minutes later, the build the release worker monitors, for the
"promote-release: vX" commit, failed finalize with "tag already exists",
and the promote workflow failed. v8.0.0 had the same race; nothing
monitored the promote build until the worker started doing so.

Run the promote jobs only when the commit message starts with
"promote-release:", the message both the release worker and release.yaml's
manual flow use for the promote config commit. Make git:tag skip creating
the tag when it already points at the promote branch head, and fail only
when it points elsewhere, so a retried finalize succeeds. The release
registry already treats re-promoting a release as a no-op.

Amp-Thread-ID: https://ampcode.com/threads/T-01a13c8e-c52e-7584-ab27-1a7fb05bc3b7
---
 .buildkite/pipeline.yaml |  7 +++++--
 release.yaml             | 11 ++++++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index ea77e63d..6429f1b0 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -47,8 +47,11 @@ steps:
 
       sg release run test --workdir=. --config-from-commit
 
+  # Promote jobs run only for the promote config commit. Creating the promote
+  # branch also builds its first commit, the internal config commit, which
+  # --config-from-commit would otherwise accept, running finalize twice.
   - label: "(promote) Release: test"
-    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/
+    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ && build.message =~ /^promote-release:/
     plugins:
       - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~
     command: |
@@ -71,7 +74,7 @@ steps:
 
       sg release run internal finalize --workdir=. --config-from-commit
   - label: "(promote) Release: finalize"
-    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/
+    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ && build.message =~ /^promote-release:/
     plugins:
       - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~
     command: |
diff --git a/release.yaml b/release.yaml
index f633417f..9d865097 100644
--- a/release.yaml
+++ b/release.yaml
@@ -476,7 +476,16 @@ promoteToPublic:
           # Create the final branch holding the tagged commit
           git checkout "${promote_branch}"
           git switch -c "${release_branch}"
-          git tag {{version}}
+          # A retried finalize finds its own tag; only a tag elsewhere is an error
+          if tagged=$(git rev-parse -q --verify "refs/tags/{{version}}^{commit}"); then
+            if [ "${tagged}" != "$(git rev-parse HEAD)" ]; then
+              echo "Tag {{version}} already exists at ${tagged}, not at ${promote_branch} ($(git rev-parse HEAD))" >&2
+              exit 1
+            fi
+            echo "Tag {{version}} already points at ${promote_branch}, not recreating it"
+          else
+            git tag {{version}}
+          fi
           git push origin ${release_branch} --tags
 
           # Web URL to the tag