refactor(ci): move tag creation from bump.sh to release.yml

Tags are now created by the release workflow after a PR merges,
instead of locally by bump.sh. This enforces CI checks as a gate
before releases land on main.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: abueide

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
           MSG=$(git log -1 --format=%s)
           if echo "$MSG" | grep -qE '^chore\(release\):'; then
             echo "is_release=true" >> "$GITHUB_OUTPUT"
-            TAG=$(git describe --tags --exact-match HEAD 2>/dev/null || echo "")
+            TAG=$(echo "$MSG" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+')
             echo "tag=$TAG" >> "$GITHUB_OUTPUT"
             BODY=$(git log -1 --format=%b)
             echo "body<<EOF" >> "$GITHUB_OUTPUT"
@@ -48,6 +48,12 @@ jobs:
             echo "devbox-mcp not changed in this release"
           fi
 
+      - name: Create git tag
+        if: steps.check.outputs.is_release == 'true' && steps.check.outputs.tag != ''
+        run: |
+          git tag "${{ steps.check.outputs.tag }}"
+          git push origin "${{ steps.check.outputs.tag }}"
+
       - name: Create GitHub Release
         if: steps.check.outputs.is_release == 'true' && steps.check.outputs.tag != ''
         env:

scripts/bump.sh

@@ -227,9 +227,11 @@ EOF
 )"
 
 TAG="v${NEW_VERSION}"
-git tag "$TAG"
 
-echo "Committed and tagged: $TAG"
+echo "Committed: $TAG"
 echo ""
 echo "To publish this release:"
-echo "  git push origin main --tags"
+echo "  1. Push your branch and open a PR:"
+echo "     git push -u origin HEAD"
+echo "     gh pr create --title 'chore(release): bump ${PLUGIN_NAMES} to ${TAG}'"
+echo "  2. After CI passes and the PR is merged, release.yml will create the tag and GitHub Release."