From baef070e7141d65dee93bc091dc258e978c94f86 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sun, 10 May 2026 22:53:52 +0300
Subject: ci: bring update-version-tags.yml to sagitta
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This workflow exists on rolling but was never present on sagitta, so
push events to sagitta do not trigger the tag-move job and tag 1.4 has
been drifting from sagitta HEAD. Add the workflow verbatim from rolling
plus a cross-branch sync reminder comment.

Prerequisite for the Context7 GitHub Actions integration. See spec
~/.claude/specs/2026-05-10-context7-github-actions-integration-design.md.

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/update-version-tags.yml | 46 +++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/update-version-tags.yml

diff --git a/.github/workflows/update-version-tags.yml b/.github/workflows/update-version-tags.yml
new file mode 100644
index 00000000..9cefef61
--- /dev/null
+++ b/.github/workflows/update-version-tags.yml
@@ -0,0 +1,46 @@
+name: Update version tags
+
+# This workflow exists on rolling, circinus, and sagitta.
+# Keep all three copies in sync — backport edits via Mergify
+# (`@Mergifyio backport circinus sagitta`) or cherry-pick.
+
+on:
+  push:
+    branches:
+      - rolling
+      - circinus
+      - sagitta
+
+permissions:
+  contents: write
+
+concurrency:
+  group: version-tag-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  retag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Move version tag to pushed SHA
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          case "$BRANCH" in
+            rolling)  TAG=rolling ;;
+            circinus) TAG=1.5 ;;
+            sagitta)  TAG=1.4 ;;
+            *) echo "Unexpected branch: $BRANCH" >&2; exit 1 ;;
+          esac
+          echo "Pointing tag '$TAG' at $SHA (branch $BRANCH)"
+          if gh api "repos/$REPO/git/ref/tags/$TAG" >/dev/null 2>&1; then
+            gh api -X PATCH "repos/$REPO/git/refs/tags/$TAG" \
+              -f sha="$SHA" -F force=true
+          else
+            gh api -X POST "repos/$REPO/git/refs" \
+              -f ref="refs/tags/$TAG" -f sha="$SHA"
+          fi
-- 
cgit v1.2.3