From 88c8e4b877b5e0ebe8cb5bb8d1a93f0fd9399fd6 Mon Sep 17 00:00:00 2001
From: Warren Gifford <warren@sourcegraph.com>
Date: Thu, 22 Oct 2026 17:54:54 +0000
Subject: [PATCH] release: Run promote finalize once, and make tag creation
 retry-safe

Creating the promote branch builds its first commit, the internal config
commit "release: vX". `--config-from-commit` accepts that config, so the
build runs the promote test and finalize jobs too, and its finalize tags
the promote branch head. The build the release worker monitors, for the
"promote-release: vX" commit, then fails finalize with "tag already
exists", and the promote workflow fails. v8.1.1335 hit this in the k8s and
Helm repos; docker only avoided it because the extra build was cancelled
by a newer push.

Run the promote jobs only when the commit message starts with
"promote-release:", the message both the release worker and release.yaml's
manual flow use for the promote config commit. Make git:tag skip creating
the tag when it already points at the promote branch head, and fail only
when it points elsewhere, so a retried finalize succeeds. The release
registry already treats re-promoting a release as a no-op.

Same change as sourcegraph/deploy-sourcegraph-helm#979.

Amp-Thread-ID: https://ampcode.com/threads/T-01a13c8e-c52e-7584-ab27-1a7fb05bc3b7
---
 .buildkite/pipeline.yaml |  7 +++++--
 release.yaml             | 11 ++++++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index ed717ef6..655e1fe2 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -33,8 +33,11 @@ steps:
     command: |
       sg release run test --workdir=. --config-from-commit
 
+  # Promote jobs run only for the promote config commit. Creating the promote
+  # branch also builds its first commit, the internal config commit, which
+  # --config-from-commit would otherwise accept, running finalize twice.
   - label: "(promote) Release: test"
-    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/
+    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ && build.message =~ /^promote-release:/
     plugins:
       - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~
     command: |
@@ -57,7 +60,7 @@ steps:
       sg release run internal finalize --workdir=. --config-from-commit
 
   - label: "(promote) Release: finalize"
-    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/
+    if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ && build.message =~ /^promote-release:/
     plugins:
       - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~
     command: |
diff --git a/release.yaml b/release.yaml
index 8aebbbb8..ded54771 100644
--- a/release.yaml
+++ b/release.yaml
@@ -349,7 +349,16 @@ promoteToPublic:
           # Create the final branch holding the tagged commit
           git checkout "${promote_branch}"
           git switch -c "${release_branch}"
-          git tag {{version}}
+          # A retried finalize finds its own tag; only a tag elsewhere is an error
+          if tagged=$(git rev-parse -q --verify "refs/tags/{{version}}^{commit}"); then
+            if [ "${tagged}" != "$(git rev-parse HEAD)" ]; then
+              echo "Tag {{version}} already exists at ${tagged}, not at ${promote_branch} ($(git rev-parse HEAD))" >&2
+              exit 1
+            fi
+            echo "Tag {{version}} already points at ${promote_branch}, not recreating it"
+          else
+            git tag {{version}}
+          fi
           git push origin ${release_branch} --tags
 
           # Web URL to the tag