fix(release): reject lightweight tags before publication resume

[seonghobae]

Change

Contributes the annotated-tag acceptance repair explicitly requested on #1030 at head b0e3d62. The release workflow previously accepted a lightweight tag and resumed publication despite its annotated-release identity contract. The commit-object branch now rejects that tag without moving or replacing it.

The existing executable bash tests now model a genuine annotated tag ref and its commit dereference. A lightweight-tag regression verifies rejection, while existing fresh confirmed-404, valid resume, ancestry and failure cases retain their behavior. No artifact is published by this change.

This is a narrow stacked contribution to the existing release PR; remaining release integration, mandatory SBOM/provenance, hosted validation and consumer adoption still belong to #1030.

Validation: the new lightweight-tag test failed before the workflow repair; all 33 tests in tests/test_release_workflow_idempotency_contract.py then passed in 2.20 seconds using the existing project environment. git diff --check passed. The tests execute the workflow shell block against a local gh stub; no live release APIs or credentials are used. Local Graphify AST extraction was run; its known virtual-workspace Cargo warning remains tracked in #1144.

Expanded exact-head validation: all 119 tests/test_release*.py contract tests passed in 14.89 seconds at 7a37d59. A fresh Graphify extraction/report at that head contains the new test and expected helper connections; the stale incremental artifact was retained and tracked separately in #1148 rather than treated as successful indexing.

[coderabbitai]

Warning

Review limit reached

Next included review available in 54 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9d35f1ea-c234-45dc-b312-d8bd681bbfb7

📥 Commits

Reviewing files that changed from the base of the PR and between b0e3d62 and 7a37d59.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• tests/test_release_workflow_idempotency_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review head 7a37d59 against its stacked base. Automatic review was explicitly skipped for the non-default target; no review exists for this head.

[coderabbitai]

@seonghobae I will review head 7a37d595ff3d39d7eb05d6030790c0c05d312741 against its stacked base.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.