Problem
bumpx --push --tag currently creates the release commit and annotated tag, then runs git pull before git push --follow-tags.
If the upstream branch advances in that interval and the pull rebases the release commit, the annotated tag remains attached to the pre-rebase commit. Because that commit is no longer reachable from the pushed branch, --follow-tags may omit the tag entirely. If the tag is pushed separately, it can instead identify a different commit from the release branch.
This occurred during a Pantry release and left the local release tag on an orphaned pre-rebase commit.
Required contract
- synchronize with the configured upstream before modifying release files
- require a clean working tree before synchronization
- use a fast-forward-only synchronization
- publish the current branch and the exact newly-created release tag in one atomic push
- reject a late upstream race without publishing the branch or tag
- integration-test both an upstream update before synchronization and a late update before publication
- verify the remote tag dereferences to the same commit as the remote release branch