From 1ec0986bbd9069beb648c03b914e8ac04d311987 Mon Sep 17 00:00:00 2001
From: "Wei (Jack) Sun" <weisun@google.com>
Date: Thu, 12 Feb 2026 18:08:01 -0800
Subject: [PATCH] feat: add release tag workflow

Adds a manually-triggered workflow that tags the version on the main
branch commit where the release was cut from. This ensures
release-please can correctly identify new commits in the next release.
---
 .github/workflows/release-tag.yml | 43 +++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .github/workflows/release-tag.yml

diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
new file mode 100644
index 0000000..5d9c05d
--- /dev/null
+++ b/.github/workflows/release-tag.yml
@@ -0,0 +1,43 @@
+# Tags the version on the main branch commit where the release was cut from.
+# Run this from the release/v* branch after the GitHub release is created.
+# This ensures release-please can correctly identify new commits in the next release.
+name: "Release: Tag"
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate branch
+        run: |
+          if [[ ! "${{ github.ref_name }}" =~ ^release/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Error: Must run from a release/v* branch (e.g., release/v0.3.0)"
+            exit 1
+          fi
+
+      - name: Extract version
+        id: version
+        run: |
+          VERSION="${{ github.ref_name }}"
+          VERSION="${VERSION#release/}"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Tagging version: $VERSION"
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref_name }}
+          fetch-depth: 0
+
+      - name: Tag version on main cut point
+        run: |
+          git fetch origin main
+          CUT_SHA=$(git merge-base origin/main HEAD)
+          echo "Release was cut from main at: $CUT_SHA"
+          git tag -f "${{ steps.version.outputs.version }}" "$CUT_SHA"
+          git push origin "${{ steps.version.outputs.version }}" --force
+          echo "Tagged ${{ steps.version.outputs.version }} at $CUT_SHA"