From a75496142832f0ad4cd2beee248dbd19eec2288a Mon Sep 17 00:00:00 2001
From: vjgit96 <vijay.katuri@ibm.com>
Date: Wed, 22 Apr 2026 17:52:07 -0400
Subject: [PATCH] fix(ci): prevent duplicate tags and validate tag format in
 release workflow (#12847)

- Add tag format validation (must start with 'v')
- Check for duplicate tags without 'v' prefix
- Prevent release notes from using wrong base comparison
- Add validate-tag-format job dependency to create_release

Fixes tag duplication issue that caused v1.9.0 release notes to miss 58 commits.

Root cause: Duplicate tags (1.8.3 vs v1.8.3) caused GitHub's generateReleaseNotes
to pick the wrong base tag due to alphabetical sorting.

This ensures future releases will:
1. Only accept tags with 'v' prefix (v1.2.3 format)
2. Detect and reject releases if duplicate tags exist
3. Generate correct release notes with proper commit history
---
 .github/workflows/release.yml | 45 +++++++++++++++++++++++++++++++++--
 1 file changed, 43 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cb18e8c7f7..f75424154d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -98,6 +98,46 @@ jobs:
 
           echo "Validated: '${{ inputs.release_tag }}' is a valid tag."
 
+  validate-tag-format:
+    name: Validate Tag Format and Check for Duplicates
+    runs-on: ubuntu-latest
+    needs: [validate-tag]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      
+      - name: Validate Tag Has v Prefix
+        run: |
+          TAG="${{ inputs.release_tag }}"
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ Error: Tag must start with 'v' and follow semver format (v1.2.3)"
+            echo "   Got: $TAG"
+            echo ""
+            echo "This is required to ensure GitHub's generateReleaseNotes uses the correct base comparison."
+            exit 1
+          fi
+          echo "✅ Tag format is valid: $TAG"
+      
+      - name: Check for Duplicate Tag Without v Prefix
+        run: |
+          TAG="${{ inputs.release_tag }}"
+          TAG_WITHOUT_V="${TAG#v}"
+          
+          if git rev-parse "$TAG_WITHOUT_V" >/dev/null 2>&1; then
+            echo "❌ Error: Duplicate tag without 'v' prefix exists: $TAG_WITHOUT_V"
+            echo "   This will cause release notes to use the wrong base comparison."
+            echo ""
+            echo "   The tag '$TAG_WITHOUT_V' points to commit: $(git rev-parse --short $TAG_WITHOUT_V)"
+            echo "   The tag '$TAG' points to commit: $(git rev-parse --short $TAG)"
+            echo ""
+            echo "   To fix this, delete the duplicate tag:"
+            echo "   git push origin :refs/tags/$TAG_WITHOUT_V"
+            exit 1
+          fi
+          echo "✅ No duplicate tag found"
+
   validate-dependencies:
     name: Validate Release Dependencies
     runs-on: ubuntu-latest
@@ -1000,14 +1040,15 @@ jobs:
   create_release:
     name: Create Release
     runs-on: ubuntu-latest
-    needs: [determine-main-version, build-main, publish-main]
+    needs: [determine-main-version, build-main, publish-main, validate-tag-format]
     if: |
       always() &&
       !cancelled() &&
       !inputs.dry_run &&
       inputs.create_release &&
       needs.build-main.result == 'success' &&
-      needs.publish-main.result == 'success'
+      needs.publish-main.result == 'success' &&
+      needs.validate-tag-format.result == 'success'
     steps:
       - uses: actions/download-artifact@v4
         with: