fix(release): push only new tags instead of all tags

[moss-bryophyta]

Previously git push origin --tags pushed all local tags, which fails when some tags already exist on the remote (the 4 rejected tags in the last release run). Now each tag is pushed individually right after creation, making the step idempotent — safe to re-run on failure.

Greptile Summary

This PR fixes a release workflow failure where git push origin --tags would reject tags that already existed on the remote (from a previous partial run), by instead pushing each tag individually immediately after it is created.

Key changes:

• git push origin "$tag" is now called inside the loop, right after git tag "$tag", replacing the trailing git push origin --tags
• This makes the tagging step idempotent: re-running after a partial failure only pushes the tags that were not yet pushed (existing remote tags are fetched by fetch-tags: true on checkout, so they are found locally and skipped by the if ! git tag -l "$tag" guard)
• The NEW_PACKAGES tracking and downstream release/build/publish steps are unaffected

Assessment: The fix is correct and minimal. The existing fetch-tags: true on the checkout step is the key enabler — it ensures any tag already on the remote is present locally before the guard check runs, making the idempotency guarantee reliable. The workflow-level concurrency setting also prevents race conditions between simultaneous pushes to main.

Confidence Score: 5/5

• This PR is safe to merge — it is a small, targeted fix with no behavioral regression risk.
• The change is a two-line delta that directly addresses the stated bug. The logic is sound: fetch-tags: true guarantees remote tags are reflected locally before the guard check, so only genuinely new tags are created and pushed. No downstream steps are affected, and the fix is idempotent by design.
• No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Moves git push origin "$tag" inside the per-tag loop (immediately after tag creation) and removes the trailing git push origin --tags, fixing the "already exists" rejection when re-running a partially-completed release.

Sequence Diagram

sequenceDiagram
    participant GHA as GitHub Actions Runner
    participant LocalGit as Local Git (checkout)
    participant Remote as origin (GitHub)
    participant PyPI as PyPI

    GHA->>LocalGit: checkout (fetch-depth=2, fetch-tags=true)
    Note over LocalGit: All existing remote tags<br/>are now available locally

    loop For each package in packages/*/
        GHA->>LocalGit: git tag -l "$tag"
        alt Tag does NOT exist locally (= not on remote)
            GHA->>LocalGit: git tag "$tag"
            GHA->>Remote: git push origin "$tag"
            Note over GHA: NEW_PACKAGES += $name
        else Tag already exists locally (already on remote)
            Note over GHA: Skip — idempotent on re-run
        end
    end

    loop For each new tag in NEW_PACKAGES
        GHA->>Remote: gh release create "$tag"
    end

    GHA->>GHA: uv build (new packages only)
    GHA->>PyPI: uv publish dist/*

Loading

_{Last reviewed commit: "fix(release): push o..."}