Push release tags atomically

Author: CharGrnmn

docs/npm-publishing.md

@@ -73,12 +73,12 @@ Infrastructure-only PRs can add an empty changeset: `bunx changeset add --empty`
    ```bash
    TAG_CORE="core-v$(bun -e 'console.log(require("./packages/core/package.json").version)')"
    TAG_SDK="sdk-v$(bun -e 'console.log(require("./packages/sdk/package.json").version)')"
-   git tag "$TAG_CORE"
-   git tag "$TAG_SDK"
-   git push origin "$TAG_CORE" "$TAG_SDK"
+   git tag -a "$TAG_CORE" -m "Release $TAG_CORE (@razroo/ray-core)"
+   git tag -a "$TAG_SDK" -m "Release $TAG_SDK (@razroo/ray-sdk)"
+   git push --atomic origin "$TAG_CORE" "$TAG_SDK"
    ```
 
-   Only push the tag(s) you are releasing in this pass.
+   Push linked package tags atomically so a failed push cannot publish only one side of the release pair.
 
 3. Create GitHub Releases (fires the npm workflows):
 
@@ -101,7 +101,7 @@ After **`bun run version`** is committed on **`main`** and pushed (`git push ori
 
 ```bash
 bun run release:github -- --dry-run   # plan only
-bun run release:github -- --yes     # tag, git push tags, gh release create ×2
+bun run release:github -- --yes     # tag, git push --atomic tags, gh release create ×2
 ```
 
 Requires [**GitHub CLI**](https://cli.github.com/) (`gh`) authenticated (`gh auth login`). NPM publish still runs in Actions when each release is **published**.

scripts/release/gh-release.sh

@@ -129,7 +129,7 @@ Usage: bash scripts/release/gh-release.sh [--dry-run | --yes]
 
   Reads versions from packages/core and packages/sdk (must match), then:
   1) creates annotated tags  core-v<ver>  and  sdk-v<ver>  on HEAD
-  2) git push origin <tags>
+  2) git push --atomic origin <tags>
   3) gh release create for each tag (triggers npm publish Actions)
 
   Prereqs: gh auth, clean working tree, main is what you intend to release.
@@ -217,7 +217,7 @@ done
 
 git tag -a "$TAG_CORE" -m "Release $TAG_CORE (@razroo/ray-core v$VER)"
 git tag -a "$TAG_SDK" -m "Release $TAG_SDK (@razroo/ray-sdk v$VER)"
-run_required_bounded "pushing release tags" 120 git push origin "$TAG_CORE" "$TAG_SDK"
+run_required_bounded "pushing release tags atomically" 120 git push --atomic origin "$TAG_CORE" "$TAG_SDK"
 run_required_bounded \
   "creating GitHub release $TAG_CORE" \
   120 \

scripts/release/gh-release.test.ts

@@ -105,6 +105,10 @@ async function createReleaseHelperFixture(
       'if [ "${1:-}" = "ls-remote" ]; then',
       "  exit 2",
       "fi",
+      'if [ "${1:-}" = "push" ] && [ "${2:-}" != "--atomic" ]; then',
+      '  echo "release tag push must be atomic" >&2',
+      "  exit 97",
+      "fi",
       'if [ "${1:-}" = "tag" ] || [ "${1:-}" = "push" ]; then',
       "  exit 0",
       "fi",
@@ -224,7 +228,10 @@ test("gh release helper bounds network release operations", async () => {
     contents,
     /run_required_bounded "checking GitHub CLI authentication" 60 gh auth status/,
   );
-  assert.match(contents, /run_required_bounded "pushing release tags" 120 git push origin/);
+  assert.match(
+    contents,
+    /run_required_bounded "pushing release tags atomically" 120 git push --atomic origin/,
+  );
   assert.match(contents, /"creating GitHub release \$TAG_CORE"/);
   assert.match(contents, /"creating GitHub release \$TAG_SDK"/);
 });
@@ -267,7 +274,7 @@ test("gh release helper continues when GitHub reports releases are missing", asy
   assert.match(commandLog, /^gh auth status$/m);
   assert.match(commandLog, /^git tag -a core-v1\.2\.3 /m);
   assert.match(commandLog, /^git tag -a sdk-v1\.2\.3 /m);
-  assert.match(commandLog, /^git push origin core-v1\.2\.3 sdk-v1\.2\.3$/m);
+  assert.match(commandLog, /^git push --atomic origin core-v1\.2\.3 sdk-v1\.2\.3$/m);
   assert.match(
     commandLog,
     /^gh release create core-v1\.2\.3 --generate-notes --title core-v1\.2\.3$/m,