fix(ci): use git push --force to move latest-main tag to correct commit

Made-with: Cursor

.gitea/workflows/ci.yml

@@ -16,6 +16,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_TOKEN }}
 
       - name: Check toolchain versions
         run: |
@@ -136,20 +139,15 @@ jobs:
           API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
           AUTH="Authorization: token ${{ secrets.RELEASE_TOKEN }}"
 
-          # Force-move the git tag to the current commit.
-          # Delete the old tag ref first, then recreate it pointing at the new SHA.
-          echo "Deleting old tag ref ${TAG}..."
-          curl -s -X DELETE \
-            -H "$AUTH" \
-            "${API}/git/refs/tags/${TAG}" || true
-
-          sleep 1
-
-          echo "Creating tag ref ${TAG} at ${{ github.sha }}..."
-          curl -s -X POST \
-            -H "$AUTH" -H "Content-Type: application/json" \
-            "${API}/git/refs" \
-            -d "{\"ref\": \"refs/tags/${TAG}\", \"sha\": \"${{ github.sha }}\"}"
+          # Force-move the git tag using git directly.
+          # Set remote URL with token so we can push.
+          REPO_URL=$(git remote get-url origin | sed 's|https://|https://x-token:${{ secrets.RELEASE_TOKEN }}@|')
+          git remote set-url origin "${REPO_URL}"
+          git config user.email "ci@holesail-browser"
+          git config user.name "CI"
+          git tag -f "${TAG}" "${{ github.sha }}"
+          git push origin "refs/tags/${TAG}" --force
+          echo "Tag ${TAG} force-pushed to ${{ github.sha }}"
 
           # Get existing release by tag (if any)
           EXISTING=$(curl -s -H "$AUTH" "${API}/releases/tags/${TAG}")