Fix duplicate release workflow execution (#1327)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>

Author: Copilot

.github/workflows/release.yml

@@ -4,13 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to release (vX.Y.Z format)"
+        description: "Version to tag and release (vX.Y.Z or vX.Y.Z-prerelease format)"
         required: true
         default: "v1.1.0"
-      prerelease:
-        description: "Is this a pre-release?"
-        type: boolean
-        default: false
   push:
     tags:
       - "v*"
@@ -19,15 +15,68 @@ on:
 permissions: read-all
 
 jobs:
+  create-release-tag:
+    name: Create Release Tag
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Checkout main
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          ref: main
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "26"
+
+      - name: Validate version and create tag
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          if [[ ! "$RELEASE_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
+            echo "::error::Version must use vX.Y.Z or vX.Y.Z-prerelease format."
+            exit 1
+          fi
+          if git ls-remote --exit-code --tags origin "refs/tags/$RELEASE_VERSION" >/dev/null 2>&1; then
+            echo "::error::Tag $RELEASE_VERSION already exists."
+            exit 1
+          fi
+
+          npm version "${RELEASE_VERSION#v}" --no-git-tag-version
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add package.json package-lock.json
+          git commit -m "chore(release): bump version to $RELEASE_VERSION"
+          git tag --annotate "$RELEASE_VERSION" --message "$RELEASE_VERSION"
+          git push --atomic origin HEAD:main "refs/tags/$RELEASE_VERSION"
+
   prepare:
     name: Prepare Release
+    if: github.event_name == 'push'
     runs-on: ubuntu-26.04
-    # Only prepare job needs write permissions for commit and tagging
     permissions:
-      contents: write # Required for git auto-commit
+      contents: read
     outputs:
       version: ${{ steps.get-version.outputs.version }}
-      is_prerelease: ${{ github.event.inputs.prerelease || 'false' }}
+      is_prerelease: ${{ contains(steps.get-version.outputs.version, '-') }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -51,11 +100,7 @@ jobs:
       - name: Get version
         id: get-version
         run: |
-          if [[ "${{ github.event_name }}" == "push" ]]; then
-            VERSION=${GITHUB_REF#refs/tags/}
-          else
-            VERSION=${{ github.event.inputs.version }}
-          fi
+          VERSION=${GITHUB_REF#refs/tags/}
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
           echo "Version: ${VERSION}"
 
@@ -93,20 +138,6 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Set Version for release
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          PLAIN_VERSION="${{ github.event.inputs.version }}"
-          # Remove 'v' prefix if present
-          PLAIN_VERSION="${PLAIN_VERSION#v}"
-          npm version $PLAIN_VERSION --no-git-tag-version
-
-      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
-        if: github.event_name == 'workflow_dispatch'
-        with:
-          commit_message: "chore(release): bump version to ${{ github.event.inputs.version }}"
-          tagging_message: "${{ github.event.inputs.version }}"
-
       - name: Check licenses
         run: npm run test:licenses
 
@@ -203,7 +234,7 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
-          ref: ${{ github.event_name == 'push' && github.ref || github.event_name == 'workflow_dispatch' && github.event.inputs.version || '' }}
+          ref: ${{ needs.prepare.outputs.version }}
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -316,7 +347,7 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
-          ref: main # Always use main branch for deployment
+          ref: ${{ needs.prepare.outputs.version }}
 
       - name: Download build artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1