Problem

The release workflow has been failing for v0.7.43 (and likely the two prior attempts on 2026-05-09) with:

Error: A branch or tag with the name 'v0.7.43' could not be found

…in the Build Release Package job's checkout step (run 25604887285).

Root cause

The real failure is in the upstream Prepare Release job. After the prepare job was moved to run inside the cypress/browsers container, stefanzweifel/git-auto-commit-action (a Docker action) fails silently. From the actual job log for step 11:

Started: bash /__w/_actions/stefanzweifel/git-auto-commit-action/.../entrypoint.sh
INPUT_REPOSITORY value: .
fatal: detected dubious ownership in repository at '/__w/blacktrigram/blacktrigram'
To add an exception for this directory, call:
    git config --global --add safe.directory /__w/blacktrigram/blacktrigram
...
Working tree clean. Nothing to commit.

The Docker action launches its own container and does not inherit the host job's safe.directory git config. git status errors out, and with the default skip_dirty_check: false the action interprets the failure as "no changes" and exits successfully without committing, tagging, or pushing. The version bump never lands on main and the tag is never created — so the downstream build job's actions/checkout with ref: ${{ github.event.inputs.version }} cannot find it.

This started failing once the prepare job adopted the cypress/browsers container (commit 8a1b52e9fa); prior runs on the bare ubuntu-latest runner did not hit this because file ownership matched the runner UID.

Fix

Replace stefanzweifel/git-auto-commit-action with an inline git commit + tag + push step that runs in the container's own shell, where we can set safe.directory for the actual UID running git. git is already installed in the container (line 80 of the workflow).

The new step:

• Adds safe.directory for $GITHUB_WORKSPACE
• Configures the same github-actions[bot] identity used previously
• Commits the version bump (idempotent — skips if git diff --cached --quiet)
• Creates the annotated tag (idempotent — skips if tag exists)
• Pushes HEAD to the dispatching branch (HEAD:${GITHUB_REF_NAME}) — needed because actions/checkout leaves the repo in a detached-HEAD state — and pushes the tag

A code comment explains why we bypass the Docker action so this isn't accidentally reverted.

Validation

• YAML validated with yaml.safe_load ✅
• parallel_validation (Code Review + CodeQL Security Scan) — no findings ✅

Notes / follow-ups

• The first push of v0.7.43 should now succeed via this fix on the next workflow_dispatch.
• The workflow already has permissions: contents: write on the prepare job, so the default GITHUB_TOKEN from actions/checkout can push the commit and tag.