UID2-7340: verify release tag exists; harden previous-tag resolution

Add a guard on the pre-release path that fails if the v<version> tag does
not already exist, instead of letting softprops auto-create it at the
checked-out commit and durably mis-tag the release. Every current consumer
pushes the tag via commit_pr_and_merge before publishing; this protects
future callers that don't.

Harden Resolve previous published tag: set -euo pipefail so a gh failure
(auth/5xx/rate-limit) aborts the step rather than silently falling back to
mikepenz over the wrong changelog window — a genuine empty result (first
cut) still falls back as intended. Note that .[0] is newest-by-creation,
not highest semver.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: BehnamMozafari

README.md

@@ -11,10 +11,10 @@ All shared publish workflows generate release notes via the `actions/shared_crea
 - The native format hardcodes `* TITLE by @AUTHOR in #NUMBER`. Authors are noise to the public consumers of these releases; mikepenz's `pr_template` lets us emit `- TITLE - ( PR: #NUMBER )` instead.
 - The composite embeds a per-platform install snippet (`docker pull`, `pip install`, `dotnet add package`, Maven `<dependency>`) above the changelog.
 
-`shared_create_releases` supports `publish_platform` values `Docker`, `Maven`, `PyPI`, `NuGet`, `iOS`. It runs four steps internally: Resolve previous published tag (gh) → Build Changelog (mikepenz) → Delete Draft Releases → Create Release (softprops). The `prerelease` input (default `'false'`) controls the release type:
+`shared_create_releases` supports `publish_platform` values `Docker`, `Maven`, `PyPI`, `NuGet`, `iOS`. Internally it builds the changelog (mikepenz), deletes stale drafts, and creates the release (softprops); on the pre-release path it additionally resolves the previous published tag (gh) and verifies the `v<version>` tag exists before publishing. The `prerelease` input (default `'false'`) controls the release type:
 
 - omitted / `prerelease: 'false'` (default) — creates a **draft** release (the original behaviour, still requires a manual "Publish" click). The Maven/PyPI/NuGet/iOS (registry/SDK) workflows keep this default for now.
-- `prerelease: 'true'` — publishes a **pre-release** immediately (durable + fetchable by tag, without claiming GA). The shared docker workflows set this for deployed-service builds. `Latest` is never set automatically — it stays a deliberate manual promotion.
+- `prerelease: 'true'` — publishes a **pre-release** immediately (durable + fetchable by tag, without claiming GA). The shared docker workflows set this for deployed-service builds. `Latest` is never set automatically — it stays a deliberate manual promotion. The `v<version>` tag must already exist (pushed earlier by `commit_pr_and_merge`); the action verifies this and fails rather than letting softprops auto-create the tag at the wrong commit.
 
 When `is_release` is `false` (Snapshot/pre-release build) the action is a no-op, so callers can invoke it unconditionally.
 

actions/shared_create_releases/action.yaml

@@ -203,9 +203,19 @@ runs:
       env:
         GH_TOKEN: ${{ inputs.github_token }}
       run: |
+        set -euo pipefail
         # No --paginate: gh applies --jq per page and concatenates, so map(...)
-        # would emit one line per page and corrupt the output. One page of 100 is
-        # plenty to find the newest published (draft==false) release at the top.
+        # would emit one line per page and corrupt the output. GitHub returns
+        # releases sorted by created_at descending, so the newest published
+        # (draft==false) release is always on page 1 — .[0] picks it without
+        # paging. Note .[0] is newest-by-CREATION, not highest semver: a
+        # backfilled or re-created release shifts it; use from_tag to override.
+        #
+        # set -euo pipefail so a gh failure (auth/5xx/rate-limit) aborts the
+        # step rather than silently yielding "" and falling back to mikepenz
+        # auto-detection over the wrong window. A genuine empty result (no prior
+        # published release, e.g. the first cut) still yields "" with a zero
+        # exit and falls back as intended — the failure and empty cases differ.
         tag=$(gh api "repos/${{ github.repository }}/releases?per_page=100" \
           --jq 'map(select(.draft==false)) | .[0].tag_name // ""')
         echo "tag=$tag" >> "$GITHUB_OUTPUT"
@@ -221,6 +231,30 @@ runs:
       env:
         GITHUB_TOKEN: ${{ inputs.github_token }}
 
+    # A published (pre-)release must attach to a tag that already exists.
+    # softprops/action-gh-release otherwise CREATES the tag at the checked-out
+    # SHA, durably mis-tagging the release at the wrong commit. The v<version>
+    # tag is pushed earlier by commit_pr_and_merge (via
+    # shared-increase-version-number, or the java docker workflow), so every
+    # current consumer satisfies this. The guard turns a silent mis-tag into a
+    # loud failure if a caller ever wires the publish without that preceding
+    # tag step. Drafts don't materialise tags, so this only applies to the
+    # pre-release (published) path. See UID2-7340.
+    - name: Verify release tag exists
+      if: ${{ inputs.is_release == 'true' && inputs.prerelease == 'true' }}
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github_token }}
+      run: |
+        set -uo pipefail
+        tag="v${{ inputs.new_version }}"
+        if gh api "repos/${{ github.repository }}/git/ref/tags/$tag" >/dev/null 2>&1; then
+          echo "Verified release tag $tag exists."
+        else
+          echo "::error::Release tag $tag does not exist (or could not be read). A pre-release must attach to a tag pushed before this step by commit_pr_and_merge. Refusing to publish and auto-create the tag at the wrong commit."
+          exit 1
+        fi
+
     - name: Delete Draft Releases
       if: ${{ inputs.is_release == 'true' }}
       uses: IABTechLab/uid2-shared-actions/actions/delete_draft_releases@v3