What happened
On 2026-08-02, two tags were pushed ten seconds apart. Both built, signed and notarized successfully, and both were discarded at the final step.
| Tag |
Run |
Failure |
v1.0.3 |
30764392414 |
tag=1.0.3 package.json=1.0.2 tauri.conf.json=1.0.2 |
slim-v1.0.1 |
30764397639 |
tag=1.0.1 package.json=1.0.0 tauri.conf.json=1.0.0 |
On the v1.0.3 run, release / macos succeeded, release / windows succeeded, and only release / publish failed. So a full signed and notarized macOS build plus a Windows build were produced and thrown away.
Root cause
The tag was cut before the bump commit existed.
- Tag
v1.0.3 points at adbd156 — 2026-08-02 15:32
- Bump commit
ee39b39 "bump Spiral Wallpaper to 1.0.3" — 2026-08-02 22:16
git merge-base --is-ancestor ee39b39 v1.0.3 → not an ancestor. At the tagged commit the version files genuinely still said 1.0.2, so the publish guard was correct to refuse.
This is the good failure mode. Without that guard, v1.0.3 would have published a release whose DMG reports 1.0.2 internally — an update users could install that claims the version they already had.
Why version.mjs check did not catch it
It proves the four version files agree with each other. It has never compared them against the tag being released, so it passed then and passes now.
Fixed in #42
scripts/release.mjs — makes the mistake unreachable by ordering. It writes the bump, commits it, and tags that commit. Preflight refuses a dirty tree, a non-main branch, a main behind origin, an existing tag, and a non-increasing version. Nothing is pushed without --push.
node scripts/release.mjs clean 0.1.0 # bump, commit, tag
node scripts/release.mjs clean 0.1.0 --push # ...and publish
version.mjs tag <tag> — the comparison that was missing, available locally.
versions.yml now runs on v*, slim-v* and clean-v* and makes that comparison in about ten seconds, so a mistagged release fails before a runner minute is spent on it. Verified against both historical failures:
$ node scripts/version.mjs tag slim-v1.0.1
version: tag slim-v1.0.1 says slim is 1.0.1, but all four files say 1.0.0.
The tag is on a commit that predates the bump. Cut releases with:
node scripts/release.mjs slim 1.0.1
Still open — two stale tags
Neither published anything; both are safe to discard.
v1.0.3 is now recoverable. main carries 1.0.3 in all four files, so re-pointing the tag would publish cleanly:
git tag -f v1.0.3 main && git push --force origin v1.0.3
slim-v1.0.1 is not recoverable as-is — the files still say 1.0.0, and Slim's published releases live in cococool13/Spiral-Slim (latest v1.0.0), not here. Either bump and re-cut, or delete the tag:
git push --delete origin slim-v1.0.1
Both are publishing actions, so they are left as a deliberate decision rather than done automatically.
What happened
On 2026-08-02, two tags were pushed ten seconds apart. Both built, signed and notarized successfully, and both were discarded at the final step.
v1.0.3tag=1.0.3 package.json=1.0.2 tauri.conf.json=1.0.2slim-v1.0.1tag=1.0.1 package.json=1.0.0 tauri.conf.json=1.0.0On the
v1.0.3run,release / macossucceeded,release / windowssucceeded, and onlyrelease / publishfailed. So a full signed and notarized macOS build plus a Windows build were produced and thrown away.Root cause
The tag was cut before the bump commit existed.
v1.0.3points atadbd156— 2026-08-02 15:32ee39b39"bump Spiral Wallpaper to 1.0.3" — 2026-08-02 22:16git merge-base --is-ancestor ee39b39 v1.0.3→ not an ancestor. At the tagged commit the version files genuinely still said 1.0.2, so the publish guard was correct to refuse.This is the good failure mode. Without that guard,
v1.0.3would have published a release whose DMG reports1.0.2internally — an update users could install that claims the version they already had.Why
version.mjs checkdid not catch itIt proves the four version files agree with each other. It has never compared them against the tag being released, so it passed then and passes now.
Fixed in #42
scripts/release.mjs— makes the mistake unreachable by ordering. It writes the bump, commits it, and tags that commit. Preflight refuses a dirty tree, a non-mainbranch, amainbehind origin, an existing tag, and a non-increasing version. Nothing is pushed without--push.version.mjs tag <tag>— the comparison that was missing, available locally.versions.ymlnow runs onv*,slim-v*andclean-v*and makes that comparison in about ten seconds, so a mistagged release fails before a runner minute is spent on it. Verified against both historical failures:Still open — two stale tags
Neither published anything; both are safe to discard.
v1.0.3is now recoverable.maincarries 1.0.3 in all four files, so re-pointing the tag would publish cleanly:git tag -f v1.0.3 main && git push --force origin v1.0.3slim-v1.0.1is not recoverable as-is — the files still say 1.0.0, and Slim's published releases live in cococool13/Spiral-Slim (latest v1.0.0), not here. Either bump and re-cut, or delete the tag:Both are publishing actions, so they are left as a deliberate decision rather than done automatically.