release.py publish: tag_exists is a TOCTOU guard, so two branches publishing the same version race

[pbean]

Found by CodeRabbit on #430; verified against the code before filing.

What

scripts/release.py's cmd_publish guards on tag_exists(tag) and then calls
gh release create under check=True:

version = sync_version.read_canonical()
tag = f"v{version}"
if tag_exists(tag):
    print(f"{tag} already exists — nothing to publish")
    return 0
...
subprocess.run(["gh", "release", "create", tag, ...], check=True)

tag_exists is git rev-parse -q --verify refs/tags/<tag> against the local clone.
There is no fetch between checkout and the check, so the guard reflects the tag state at
checkout time, not the live remote. Two runs that both check out before either creates the
tag will both pass the guard, both call gh release create, and the loser exits non-zero →
CalledProcessError → red job.

The concurrency group does not serialize them:

concurrency:
  group: release-${{ github.ref }}

Two branches are two refs, so they are two groups.

Why it is newly reachable

Before #429/#430, release.yml fired only on push: branches: [main] — one ref, one
group, cancel-in-progress: false, so publish runs serialized. Adding release/* makes a
second ref able to publish, which is what opens the cross-branch window. The trigger change
is still correct; this is the sharp edge it exposes.

Severity

Low. The release that wins is correct — the failure mode is a spuriously red workflow run
on the losing branch, not a bad or duplicate release. It also needs the same canonical
version to land on two branches close together, which the 0.9.x flow avoids by design (the
forward-port to main does not bump versions, so main's publish no-ops on the existing
tag).

Fix shapes

Either would do; not ranking them without looking at how the 0.10 line will branch.

1. Make the concurrency group version-scoped or ref-independent (e.g.
   group: release-${{ github.workflow }}) so all publish runs serialize repo-wide. The
   second run then re-checks out after the first has pushed the tag — but note that only
   helps if the checkout genuinely post-dates the tag push, so pair it with (2).
2. Make cmd_publish tolerate the conflict: drop check=True and treat an
   "already exists" failure from gh release create as success, or re-verify against the
   remote (git ls-remote --tags) rather than the local clone. This is the one that
   actually closes the window, since it does not depend on scheduling.

Deliberately not fixed in #429/#430 — those were scoped to the trigger change alone, and
#429 is already merged and published.

[coderabbitai]

🔗 Related PRs

#152 - fix(worktree): detach kept worktree so branch_per=run survives a kept failure (#138) [merged]
#182 - fix(worktree): degrade post-merge teardown failures instead of crashing the run (#139) [merged]
#353 - fix(recovery): probe for a free attempt-preserve-dirty ref name [open]
#430 - chore(ci): run CI and auto-publish on release/* maintenance branches [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[pbean]

Fix PRs open on both branches:

• chore(ci): run CI and auto-publish on release/* maintenance branches #430 → main
• fix(release): a lost publish race is not a failed publish #432 → release/0.9.x

Both carry the same change; #432 is a cherry-pick of #430's commit (the two branches'
scripts/release.py and tests/test_release.py were byte-identical, so it applied
cleanly). release/0.9.x needs its own PR because #429 has already merged, and because
neither bot reviews that base — CodeRabbit's config does not cover it and reported
pass/"Review skipped" on #429, so nothing found on a main PR reaches it automatically.

Both halves from the "fix shapes" list landed, since neither is sufficient alone:

1. concurrency.group drops github.ref → release-publish, serializing publish runs
   repo-wide so the second checks out after the first pushed its tag.
2. gh release create runs with check=False; a stderr naming a duplicate tag returns 0,
   anything else prints stderr and dies. This is the half that closes the window
   independent of scheduling.

_already_exists matches the phrase, not the HTTP status, so a 422 raised for a different
validation failure stays loud. Both directions ablated — removing the guard reddens the
lost-race test, and making it swallow everything reddens the genuine-failure test.