fix(promote): git-tag existence check misread 422 as an existing tag

[bdimitrov-netzine]

Fix

Use the refs API (git/ref/tags/$TAG) for a clean existence check (real 404 when missing), and only resolve the commit when the tag actually exists. Create-only / never-move / idempotent semantics are unchanged.

[github-actions]

Claude finished @bdimitrov-netzine's task in 1m 0s —— View job

---

PR Review

• Gather context and read changed files
• Review the workflow fix
• Post final review

---

Verdict: LGTM — the fix is correct and well-reasoned.

Root cause diagnosis

The PR description is accurate. gh api repos/$REPO/commits/$TAG returns HTTP 422 (not 404) when the ref doesn't resolve, and gh api prints the error JSON body to stdout even on non-2xx responses while silently skipping --jq. The 2>/dev/null || true pattern only suppressed stderr and exit-code errors, not the JSON body printed to stdout, so CUR was set to a non-empty string that didn't match $COMMIT, tripping the never-move guard.

The fix

-          # Idempotent + never-move: resolve any existing tag to its commit.
-          CUR=$(gh api "repos/$REPO/commits/$TAG" --jq '.sha' 2>/dev/null || true)
-          if [ -n "$CUR" ]; then
+          # Idempotent + never-move
+          if gh api "repos/$REPO/git/ref/tags/$TAG" >/dev/null 2>&1; then
+            CUR=$(gh api "repos/$REPO/commits/$TAG" --jq '.sha')
             if [ "$CUR" = "$COMMIT" ]; then

Why this works:

• git/ref/tags/$TAG returns a proper HTTP 404 (not 422) for a missing ref, which makes gh api exit non-zero — so the if condition cleanly fails without touching stdout.
• >/dev/null 2>&1 suppresses both the ref JSON body (not needed) and any error message, keeping only the exit code for the branch condition.
• Commit resolution via commits/$TAG is now only called when the tag is confirmed to exist, so it runs without || true and will hard-fail under set -euo pipefail if something unexpected happens — correct fail-fast behavior.

Design correctness for annotated tags:
git/ref/tags/$TAG returns the tag object SHA for annotated tags (not the commit SHA), so the separate commits/$TAG call to resolve the final commit SHA is still necessary and correct. The two-step split is the right design here, not an oversight.

No issues found

• The create-only / never-move / idempotent semantics are fully preserved.
• No race-condition risk beyond what already existed (the window between the two gh api calls is negligible and was also present in the original).
• No security concerns — all values are GitHub-controlled API responses or workflow-owned env vars.
• The change is minimal and scoped exactly to the bug.

---

[github-actions]

Security Scan - Code

Severity: HIGH, CRITICAL

No vulnerabilities found

View scan results

Report Summary

┌─────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┐
│                   Target                    │    Type    │ Vulnerabilities │ Misconfigurations │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ Cargo.lock                                  │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ crates/testing/fuzz-targets/Cargo.lock      │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ crates/testing/fuzz-targets/fuzz/Cargo.lock │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/state-sum/Cargo.lock                    │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/tps/package-lock.json                   │    npm     │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ rayls-contracts/package-lock.json           │    npm     │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/chaos-network/Dockerfile                │ dockerfile │        -        │         0         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/docker-network/Dockerfile               │ dockerfile │        -        │         0         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/docker-replay/Dockerfile                │ dockerfile │        -        │         0         │
└─────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)