2.18.2

CI/CD

• Release tagging now expects to tag only the tip of main, because that is all CI can do. 2.18.1 moved tag creation to the refs API on the understanding that the API escaped the refusal a push had hit; it does not. GitHub blocks a bot from creating a ref at a commit whose .github/workflows tree differs from the branch tip however the ref is created, and no token permission or repository setting lifts it — GITHUB_TOKEN cannot hold the workflows permission. The push says so in as many words; the API returns a bare 403 "Resource not accessible by integration", which is also what an unprivileged token returns, and the run died on the first historical tag without reaching the release it existed to tag. A refusal is now recorded as skipped and the run continues, so the release being merged — which is the tip when the workflow runs — tags itself. The tag for the version at the triggering commit is still required, since the tip restriction cannot explain a refusal there — but only while that release is still what main points at. The job is handed the commit its event named, and a later push may already have moved past it, which makes the same refusal the ordinary one rather than a token or ruleset fault. (#604)

• scripts/backfill-release-tags.sh creates the tags CI cannot, from a checkout with push access: authenticated as a person rather than as an app, the restriction does not apply. It fetches, prints what is missing, asks before pushing, and is safe to re-run. It names the publisher with --push rather than unsetting GITHUB_TOKEN/GH_TOKEN — a token is what selects the Actions path, but GH_TOKEN may equally be the credential Git pushes with through gh auth setup-git, so clearing it would break the very push the script exists to make. Its preview passes --remote, because publishing reads the remote's tags while a preview reads the local ones, and git fetch --tags adds to the local set without removing a tag that exists only in this checkout — so a release tagged locally and never pushed would have been absent from the prompt and created anyway. (#604)

• release.yml no longer triggers on v*.*.* tag pushes. A push to main is what releases; tagging it is separate bookkeeping, and the tag trigger only meant that creating a tag by hand — or filling in one CI had missed — redeployed whatever commit it named. Removing it is what makes the backfill safe to run at all. (#604)