feat: tag release action

.github/workflows/tag-release.yml

@@ -0,0 +1,42 @@
+name: Tag Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version to tag (e.g. v1.0.1)
+        required: true
+      major:
+        description: Floating major tag to move (derived from version when empty)
+        required: false
+        default: ""
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create version tag and move major tag
+        env:
+          VERSION: ${{ inputs.version }}
+          MAJOR: ${{ inputs.major }}
+        run: |
+          case "$VERSION" in
+            v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) echo "::error::version must look like v1.0.1, got '$VERSION'"; exit 1 ;;
+          esac
+          [ -n "$MAJOR" ] || MAJOR="${VERSION%%.*}"
+          if git ls-remote --exit-code --tags origin "refs/tags/$VERSION" >/dev/null; then
+            echo "::error::tag $VERSION already exists"; exit 1
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$VERSION" -m "Release $VERSION"
+          git tag -fa "$MAJOR" -m "Release $VERSION"
+          git push origin "$VERSION"
+          git push --force origin "$MAJOR"