feat: auto-tag on version bump

[qwrobins]

Summary

Adds a workflow that automatically creates a git tag when package.json version changes on main.

Flow

1. Bump version in package.json as part of a PR
2. Merge the PR
3. Auto-tag workflow detects the version change, creates v{version} tag
4. Tag push triggers the existing release workflow (builds binaries, creates GitHub Release)

Safety

• Only runs when package.json is modified on main
• Compares current version to previous commit's version
• Skips if version didn't change (e.g. other fields in package.json changed)
• Skips if tag already exists
• Version comes from the repo file, not user input

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added an automated workflow that detects version changes on the main branch and creates/pushes matching release tags, streamlining release/version management.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c5fac159-d33e-4662-be64-cdfd6b6c81d9

📥 Commits

Reviewing files that changed from the base of the PR and between e15473b and 1ab0b3a.

📒 Files selected for processing (1)

• .github/workflows/auto-tag.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/auto-tag.yml

---

📝 Walkthrough

Walkthrough

A GitHub Actions workflow was added that detects version changes in package.json on main and, when the version differs from the previous commit, creates and pushes a v<version> tag if it doesn't already exist (skipping tag creation when present).

Changes

Cohort / File(s)	Summary
Auto-tag Workflow \.github/workflows/auto-tag.yml	New workflow "Auto-tag on version bump": checks out repo, reads current and previous package.json versions, sets changed output when versions differ, and creates/pushes v<version> tag only when changed is true and tag absent.

Sequence Diagram(s)

sequenceDiagram
    participant Workflow as GitHub Action
    participant Repo as Repository (code)
    participant Remote as Git Remote (origin)
    Workflow->>Repo: checkout (fetch-depth:2)
    Workflow->>Repo: read current `package.json` version
    Workflow->>Repo: git show previous `package.json` version
    Workflow->>Workflow: compare current vs previous -> changed?
    alt changed = true
        Workflow->>Remote: check if tag v<version> exists
        alt exists
            Remote-->>Workflow: tag exists -> exit 0
        else not exists
            Workflow->>Repo: create tag v<version>
            Workflow->>Remote: push tag v<version>
            Remote-->>Workflow: ack pushed
        end
    else changed = false
        Workflow-->>Workflow: skip tagging
    end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• feat: CI/CD with semver releases and curl installer #16: Release workflow that consumes v* tags produced by this auto-tag workflow.
• chore: add release-please workflow aether#6: Release-please bumps that would trigger this auto-tag workflow.
• Add GitHub release workflow aether#4: Tag-triggered release workflow that validates/builds releases from vMAJOR.MINOR.PATCH tags.

Poem

🐰 I nibbled code beneath the moon,

A version bumped — a tiny tune.
With whisker twitch and joyful zag,
I made a tag: v1...v2...vtag!
Hooray, the repo hops with me. 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: auto-tag on version bump' accurately summarizes the main change: a new GitHub Actions workflow that automatically creates git tags when package.json version changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/auto-tag

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/auto-tag.yml (1)

17-17: Pin actions/checkout to a full commit SHA for supply-chain security.

Using @v4 is functional, but GitHub's security guidance recommends pinning to a full-length commit SHA to prevent supply-chain attacks. The v4 tag currently points to 11bd71901bbe5b1630ceea73d27597364c9af683. Change to - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 to lock to this immutable release.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/auto-tag.yml at line 17, Replace the floating tag
"actions/checkout@v4" with the immutable commit SHA suggested in the comment so
the workflow pins the action; locate the step that uses "actions/checkout@v4"
and change it to use "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
to hard-pin the exact release for supply-chain security.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/auto-tag.yml:
- Around line 17-20: The workflow currently uses a shallow checkout
(actions/checkout@v4 with fetch-depth: 2) and later uses git rev-parse "$tag"
which only checks local refs and can miss remote tags; replace the local-only
check (git rev-parse "$tag") with a remote lookup using git ls-remote
--exit-code --tags origin "refs/tags/$tag" to verify if the tag already exists
on the remote before attempting to push, and keep the shallow checkout
configuration as-is.

---

Nitpick comments:
In @.github/workflows/auto-tag.yml:
- Line 17: Replace the floating tag "actions/checkout@v4" with the immutable
commit SHA suggested in the comment so the workflow pins the action; locate the
step that uses "actions/checkout@v4" and change it to use
"actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683" to hard-pin the
exact release for supply-chain security.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8d9c8fb0-c667-4bf8-9392-f4945f9e21cf

📥 Commits

Reviewing files that changed from the base of the PR and between 337b79f and e15473b.

📒 Files selected for processing (1)

• .github/workflows/auto-tag.yml