Skip the GitHub release when it already exists (fixes 422 on every merge to main)

[basi]

Summary

The Bump version workflow (.github/workflows/bump-version.yml) fails on every push to main that does not raise custom_tag. The latest failure is run 36558608331, from the merge of #27. The release step fails with:

Error 422: Validation Failed: {"resource":"Release","code":"already_exists","field":"tag_name"}

custom_tag is pinned to 1.2.0, and the v1.2.0 tag and release already exist. The merge of #22 created them on 2026-09-03.

1. mathieudutour/github-tag-action sets its outputs (new_tag: v1.2.0, changelog). It then skips creating the existing tag and exits 0.
2. ncipollo/release-action then tries to create the v1.2.0 release again and fails with the 422 above.

Every merge since #18 has failed this way (#18, #23, #21, #24, #25, #29, #27), except #22, which raised custom_tag to 1.2.0. #29 listed this as out of scope for a separate PR.

This PR sets skipIfReleaseExists: true. The release step now skips an existing release, just as the tag step already skips an existing tag. Raising custom_tag still creates the new tag and release, so the manual release process does not change.

Changes

.github/workflows/bump-version.yml only (+1 line):

           body: ${{ steps.tag_version.outputs.changelog }}
+          skipIfReleaseExists: true

Checked against the source of the pinned actions:

• ncipollo/release-action@339a818 (v1.21.0)
  • action.yml:110 defines the input: "When skipIfReleaseExists is enabled the action will be skipped if a non-draft release already exists for the provided tag."
  • src/ActionSkipper.ts:14-27 looks up the release by tag and skips only when one is returned. Any error, including a 404, means "don't skip". The check therefore cannot fail the step by itself; at worst the run fails the same way it does today.
  • src/Action.ts:45-47 emits the notice Skipping action, release already exists and skipIfReleaseExists is enabled. and returns, so the step succeeds.
  • src/Inputs.ts:187-189 reads the input with core.getBooleanInput, so the value is the YAML boolean true.
• mathieudutour/github-tag-action@af99e60 (v7.0.0)
  • src/action.ts:213-243 sets the outputs first and skips createTag when the tag already exists.
  • The release step therefore still receives tag: v1.2.0, and the new flag decides whether it creates a release.

Impact

• The release step behaves differently only when a published release already exists for new_tag. In that case it now skips instead of failing.
• Trade-off: if custom_tag is ever set by mistake to a version that already has a release, the run no longer fails loudly with 422. It succeeds, and only the notice above appears.
• Triggers, permissions, the tag step and tests.yml are unchanged.

Verification

• actionlint v1.7.12 on .github/workflows/bump-version.yml: no findings (exit 0).
• Parsed the workflow YAML with Ruby YAML.load_file: the release step's with contains "skipIfReleaseExists" => true (TrueClass).
• git diff origin/main is the one added line and nothing else.
• v1.2.0 is a published release (draft: false, published 2026-09-03), so the next run will take the skip path.
• Not verified by running it: the Bump version workflow only runs on push to main, so it cannot run on this PR, and the Tests checks here do not exercise it.

Post-merge QA

On the Bump version run for this PR's merge commit:

• Bump version and push tag succeeds without creating a new tag (custom_tag is still 1.2.0)
• Create a GitHub release succeeds with the notice Skipping action, release already exists and skipIfReleaseExists is enabled.
• The run concludes with success
• gh release list shows no new release (the latest is still v1.2.0)
• The next time custom_tag is raised, the new release is actually created

Out of scope

• Changing how custom_tag is maintained, or going back to automatic version bumps
• An explicit permissions: contents: write for this workflow
• Pinning the actions in tests.yml
• The failing composer in /app Dependabot security update job (Drop cakephp/cakephp from the app skeleton to stop recurring Dependabot failures #31)

🤖 Generated with Claude Code