kata-release-publish

Publishing a GitHub release with a signed annotated tag involves creating the tag, pushing it to the remote, and orchestrating GitHub Actions validation to ensure the release is created safely without race conditions.

To prevent race conditions during GitHub release creation, the system detects whether a tag-triggered workflow will create the release automatically or if a manual fallback is needed, polling runs to avoid registration races.

GitHub Actions validates a tag by running a workflow like validate-tag.yml, where the publishing process waits for the validation to complete successfully and aborts strictly on any validation issues.

You should replace auto-generated GitHub release notes with a prepared changelog only when the changelog is substantially more informative, otherwise preserving the auto-generated release to maintain notes correctness.

The best way to handle manual release creation when a tag-triggered workflow is absent is using a fallback like gh release create, ensuring preconditions are revalidated and the annotated signed tag is pushed first.

Release publishing fails after pushing a signed tag when strict validation checks identify issues, aborting the process to prevent broken releases if the validate-tag.yml workflow does not complete successfully.