[Andreas-Garcia]

Summary

The Release tag workflow failed on correct tags (agent-config v2.6.1 → da18672, run 42998815962) because GitHub briefly returns 404 when the tag is re-read right after creation. This PR makes tagging tolerate that lag and makes the helper scripts run from the caller-pinned workflow commit instead of a hard-coded pre-squash SHA.

Changes

• release/create-tag.py: validates the POST /git/tags and POST /git/refs responses (type and sha only, since GitHub adds url), then verifies through new wait_for_commit (backoff 1, 2, 4, 8, 8 s, injectable sleep). A 404 on the ref or the tag object counts as lag; a mismatch fails at once; a tag still unreadable fails with a rerun hint (a rerun reports existing). On the 422 path a still-absent tag re-raises the original API error.
• release-tag.yml (2 checkouts) and release-github.yml (1): ref: ${{ job.workflow_sha }} replaces bbd93e5… (reachable only via refs/pull/33/head). A first-step guard requires a 40-hex SHA and job.workflow_repository = BehindTheMusicTree/github-workflows, with no fallback.
• .github/actionlint.yaml: ignores only actionlint's "property workflow_sha/workflow_repository is not defined" on those two files (actionlint 1.7.12 does not know them yet).
• README (self-pin and verification paragraphs) and CHANGELOG [Unreleased].
• Tests: FakeGitHub now returns realistic write responses (including url) and can simulate lag on the ref and on the tag object. New cases cover lag below and above the attempt limit, lag on the 422 path, mismatch after lag, tag-object lag and malformed responses, with no real waits.

Test plan

• python3 -m unittest discover -s release -p 'test_*.py': 39 OK
• bash .github/scripts/tests/release.sh: exit 0
• shellcheck .github/scripts/release.sh .github/scripts/tests/release.sh: clean
• actionlint: clean
• Live run in release-automation-sandbox-20261106 pinned to this PR's head (bump to 0.0.6) is required before merge: expect created, tag v0.0.6 dereferencing to the merge commit, and a GitHub Release. Result to be added as a comment.
• Step 0 already verified: rerunning run 42998815962 printed existing and went green.

Screenshots

N/A

Risk

Intent change, depth deep: release-critical workflows holding the release App token, consumed by about 20 repositories. An independent review found one real defect, strict equality on the API object that would have failed every real run because of the extra url key. It is fixed (identity-only comparison, url added to the fake) and the delta was rechecked by the principal session. No breaking change for callers: they keep pinning the outer workflow, which now also fixes the helper scripts. The guard fails closed if job.workflow_sha is unavailable. Callers only get the fix when repinned (rollout follows).

How to revert

Revert the merge commit. Callers pinned to the merged SHA keep working until repinned to the revert.

Deployment notes

No migration or environment change. Merge only after the sandbox live test; then repin this repository's own release.yml/publish.yml and all callers to the merged SHA. No release of this repository is part of this PR.

[Andreas-Garcia]

Sandbox live test passed (release-automation-sandbox-20261106 PR #7, merge e7654ce): guard logged WORKFLOW_SHA=aae109a and the repository, helper checkout used aae109a, create-tag.py printed created, tag v0.0.6 dereferences to e7654ce, GitHub Release v0.0.6 exists.