From ee4337574359be217a9ea74342752663b443c684 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sun, 10 May 2026 13:51:39 +0300
Subject: ci: add workflow to keep version tags pointing at branch heads
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Maps branches to floating version tags so RTD can build canonical
versioned URLs from a single ref name regardless of branch renames:

- current  -> rolling
- circinus -> 1.5
- sagitta  -> 1.4

The workflow force-moves the matching tag to the pushed SHA on every
push to one of the three branches. Initial seed tags were created
manually; subsequent updates are automatic.

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/update-version-tags.yml | 38 +++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 .github/workflows/update-version-tags.yml

(limited to '.github/workflows')

diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml
new file mode 100644
index 00000000..4a781c4f
--- /dev/null
+++ b/.github/workflows/update-version-tags.yml
@@ -0,0 +1,38 @@
+name: Update version tags
+
+on:
+  push:
+    branches:
+      - current
+      - circinus
+      - sagitta
+
+permissions:
+  contents: write
+
+jobs:
+  retag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Move version tag to pushed SHA
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          case "$BRANCH" in
+            current)  TAG=rolling ;;
+            circinus) TAG=1.5 ;;
+            sagitta)  TAG=1.4 ;;
+            *) echo "Unexpected branch: $BRANCH" >&2; exit 1 ;;
+          esac
+          echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)"
+          if gh api "repos/$REPO/git/refs/tags/$TAG" >/dev/null 2>&1; then
+            gh api -X PATCH "repos/$REPO/git/refs/tags/$TAG" \
+              -f sha="$SHA" -F force=true
+          else
+            gh api -X POST "repos/$REPO/git/refs" \
+              -f ref="refs/tags/$TAG" -f sha="$SHA"
+          fi
-- 
cgit v1.2.3


From dd444cacec2fd91c83fd4e9912af69d806750da7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 10 May 2026 10:54:34 +0000
Subject: ci: add concurrency group to prevent tag race on rapid pushes

Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/49d35e98-ac39-4556-824a-e129c23f768e

Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>
---
 .github/workflows/update-version-tags.yml | 4 ++++
 1 file changed, 4 insertions(+)

(limited to '.github/workflows')

diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml
index 4a781c4f..450ea95e 100644
--- a/.github/workflows/update-version-tags.yml
+++ b/.github/workflows/update-version-tags.yml
@@ -10,6 +10,10 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: version-tag-${{ github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   retag:
     runs-on: ubuntu-latest
-- 
cgit v1.2.3


From ff68a33d5200533277e16c4a287c6f248d4bfbe6 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sun, 10 May 2026 14:02:48 +0300
Subject: ci(version-tags): switch to github.token and singular ref endpoint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Use ${{ github.token }} for GH_TOKEN to match the convention in
  ai-validation.yml.
- Existence check now uses the singular `git/ref/tags/$TAG` endpoint,
  which 404s when the tag is missing. The plural `git/refs/tags/$TAG`
  returns 200 with an array even when no exact match exists, which
  would route every run through the PATCH path and fail with 404 on
  any tag that has been deleted.

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/update-version-tags.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml
index 450ea95e..eb87f801 100644
--- a/.github/workflows/update-version-tags.yml
+++ b/.github/workflows/update-version-tags.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Move version tag to pushed SHA
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           SHA: ${{ github.sha }}
           BRANCH: ${{ github.ref_name }}
@@ -33,7 +33,7 @@ jobs:
             *) echo "Unexpected branch: $BRANCH" >&2; exit 1 ;;
           esac
           echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)"
-          if gh api "repos/$REPO/git/refs/tags/$TAG" >/dev/null 2>&1; then
+          if gh api "repos/$REPO/git/ref/tags/$TAG" >/dev/null 2>&1; then
             gh api -X PATCH "repos/$REPO/git/refs/tags/$TAG" \
               -f sha="$SHA" -F force=true
           else
-- 
cgit v1.2.3