ci: fetch tags in release workflow so changeset tag skips already-released packages

[wrn14897]

Why

The 2.30.1 release run (29261242580) failed in the Check Changesets job:

! [rejected]  @hyperdx/common-utils@0.22.0 (already exists)
! [rejected]  @hyperdx/hdx-eval@0.2.1      (already exists)
! [rejected]  @hyperdx/cli@0.5.2           (already exists)
error: failed to push some refs

Root cause chain:

1. yarn release runs changeset publish --no-git-tag && changeset tag (since [HDX] Fix duplicate git tag push in release workflow #2377).
2. changeset tag creates a tag for every workspace package at its current version, skipping only tags that exist locally.
3. The check_changesets checkout is shallow with no tags fetched, so changeset tag re-creates all package tags on every release.
4. 2.30.1 only bumped the fixed group (api/app/otel-collector); the tags for the unchanged packages (common-utils@0.22.0, hdx-eval@0.2.1, cli@0.5.2) already existed from the 2.30.0 release. Changesets tags are annotated (git tag -m), so re-pushing is rejected even when pointing at the same commit — the job fails and every downstream image build/publish job is skipped.

This was the first release since #2377 where a subset of packages didn't bump, which is why it never surfaced before. Any future partial-bump release would fail the same way.

What

Fetch the full history and tags in the check_changesets checkout (fetch-depth: 0 + fetch-tags: true) so changeset tag sees existing tags via its tagExists() check and skips them. Only genuinely new tags get created and pushed.

Notes

• 2.30.1 itself was already hot-fixed by deleting/recreating the conflicting tags + releases and re-running the failed jobs (now green, images published).
• No changeset: CI-only change.

Testing

• YAML validated locally.
• Behavior verified against @changesets/cli (tagExists() local-tag check, annotated tag creation) and changesets/action@v1 (pushTag + createRelease per tag, no already-exists tolerance).

[changeset-bot]

⚠️ No Changeset found

Latest commit: dff5d3f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ignored		Jul 14, 2026 3:30am
hyperdx-storybook	Ignored		Jul 14, 2026 3:30am

[github-actions]

🔴 Tier 4 — Critical

Touches auth, data models, config, tasks, OTel pipeline, ClickHouse, or CI/CD.

Why this tier:

• Critical-path files (1):
  • .github/workflows/release.yml
• All files are docs / images / lock files

Review process: Deep review from a domain expert. Synchronous walkthrough may be required.
SLA: Schedule synchronous review within 2 business days.

Stats

• Production files changed: 0
• Production lines changed: 0
• Branch: warren/fix-release-tag-fetch
• Author: wrn14897

To override this classification, remove the review/tier-4 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[greptile-apps]

Greptile Summary

This PR makes existing package tags visible to the release job. The main changes are:

• Fetch the complete Git history in the check_changesets checkout.
• Fetch all tags so changeset tag skips versions that are already tagged.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Configures the release checkout to fetch full history and tags before Changesets publishes and creates package tags.

_{Reviews (1): Last reviewed commit: "ci: fetch existing tags in release workf..." | Re-trigger Greptile}

[github-actions]

Deep Review

✅ No critical issues found.

The diff correctly fixes the release-tag push rejection: adding fetch-depth: 0 + fetch-tags: true to the check_changesets checkout makes existing annotated tags visible to changeset tag, so already-released packages are skipped. Reviewers confirmed fetch-tags: true is load-bearing (actions/checkout@v6 passes --no-tags by default, so full history alone would not fetch tags), and that no sibling job runs changeset tag — release-cli guards its own release via gh release view, so the fix is complete for its stated scope.

🔵 P3 nitpicks (3)

• .github/workflows/release.yml:2 — The workflow has no concurrency group, so two near-simultaneous pushes to main can run check_changesets in parallel; a tag pushed by one run between the other's checkout and its changeset tag step re-opens the same annotated-tag push rejection this diff narrows. Pre-existing; the diff shrinks but does not close the window.
  • Fix: Add a concurrency group keyed on the ref with cancel-in-progress: false so release runs serialize.
  • _{ce-correctness-reviewer, ce-reliability-reviewer}
• .github/workflows/release.yml:30 — fetch-depth: 0 unshallows the entire repo history on every release run, but the stated goal only requires tags, which fetch-tags: true already retrieves independent of depth; the full-history fetch adds cost and history grows monotonically. Optional simplification, not a defect.
  • Fix: Consider dropping fetch-depth: 0 and keeping only fetch-tags: true, after verifying tag reachability holds at shallow depth.
  • _{ce-performance-reviewer, ce-maintainability-reviewer}
• .github/workflows/release.yml:13 — check_changesets has no timeout-minutes, so the now-deeper checkout falls back to the 360-minute default job timeout if a fetch hangs. Pre-existing, mildly aggravated by the larger fetch.
  • Fix: Add a job-level timeout-minutes bound, matching the pattern already used on notify_clickhouse_clickstack.
  • _{ce-reliability-reviewer}

---

Reviewers (5): ce-correctness-reviewer, ce-reliability-reviewer, ce-maintainability-reviewer, ce-performance-reviewer, ce-project-standards-reviewer.

Testing gaps: No CI assertion verifies tags are present before changeset tag runs, so a regression in checkout tag behavior would resurface only as a downstream push rejection; the zero-new-package and multi-package release paths are not exercised by any test.

[github-actions]

E2E Test Results

✅ All tests passed • 236 passed • 3 skipped • 1591s

Status	Count
✅ Passed	236
❌ Failed	0
⚠️ Flaky	2
⏭️ Skipped	3

Tests ran across 4 shards in parallel.

View full report →