[anth-volk]

Fixes #4167

Summary

Release runs tag each release commit with its version again. The last tag the release run created is 3.34.3 (2026-02-24).

• .github/scripts/publish_git_tag.sh (moved from .github/publish-git-tag.sh, so the ci-scripts guard now runs shellcheck on it and requires a test for it):
  • Reads [project] version from pyproject.toml with tomllib, and fails unless it's a release version (<major>.<minor>.<patch>). It used to run python setup.py --version, and setup.py was removed in Migrate from setup.py to pyproject.toml #3319.
  • Looks the tag up on origin with git ls-remote. If the tag already names the release commit, lightweight or annotated, it changes nothing and passes, so a rerun of a release works. If it names another commit, it fails and names both commits.
  • Otherwise it creates a lightweight tag named after the version on the release commit, as the existing tags are (3.34.3), and pushes only that tag. It used to push every local tag with git push --tags.
  • Runs under set -euo pipefail, with no || true.
• push.yml: the "Publish Git Tag" step runs bash .github/scripts/publish_git_tag.sh. The job is otherwise unchanged.
• docs/engineering/skills/ci-workflows.md describes what the step does.

Expected effect

• The next release run creates and pushes a tag for its version.
• A failure to read the version, or to push the tag, now fails publish-git-tag. Every later release job needs it, so the release stops there instead of passing without a tag. Rerunning the job is safe once the cause is fixed.
• Nothing runs on tag pushes (no workflow has an on: push: tags trigger), so creating tags starts nothing else.

The missing tags

The releases from 3.35.0 to the current version have no tags. Each "Update PolicyEngine API" commit records its version in pyproject.toml (or setup.py/policyengine_api/constants.py before #3319), so those tags could be created afterwards with a one-off script. This pull request creates none, and whether to do that is a separate decision.

Testing

Built test-first:

Commit	Content	Result
962bf1aa	moves the script unchanged; adds tests/unit/test_publish_git_tag_script.py	5 failed, 2 passed
eda408a8	the fixed script, changelog fragment and doc	7 passed

The tests run the script in a temporary clone whose origin is a bare repository, with git's global and system configuration turned off. They cover: tagging the release commit with the pyproject.toml version; pushing only the release tag when another local tag exists; failing with no version and with a version that isn't a release version; failing, with the tag unchanged, when it names another commit; and passing, with the tag unchanged, when a lightweight or annotated tag already names the release commit. The two "already names" cases also passed before the fix, because the old script never created a tag.

Ran only those tests, by node ID. Also ran: shellcheck on the script, python scripts/run_quality_guards.py (every guard passed, including ci-scripts), python -m scripts.rules guard --base-ref origin/master, ruff format --check and ruff check on the test file, and check_changelog_fragment.sh against origin/master.

Environment variables and tokens

The script reads no environment variables of its own. What it uses:

• The push credential: the GITHUB_TOKEN, which actions/checkout@v4 stores in the clone's git configuration (default persist-credentials). Neither push.yml nor the publish-git-tag job sets permissions, so the token has the repository's default workflow permissions, write (checked with gh api repos/PolicyEngine/policyengine-api/actions/permissions/workflow). The repository's only ruleset applies to branches, so nothing restricts creating tags.
• python3: from actions/setup-python@v5 (3.12) in the same job. tomllib needs Python 3.11 or later.
• JOB_RESULTS: unchanged. It's set from toJSON(needs) for the preceding release_commit.py require-checks step.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.30%. Comparing base (528cef1) to head (eda408a).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #4168       +/-   ##
===========================================
+ Coverage   53.93%   88.30%   +34.37%     
===========================================
  Files         281      293       +12     
  Lines       16261    17457     +1196     
  Branches     2629     2865      +236     
===========================================
+ Hits         8770    15416     +6646     
+ Misses       6760     1331     -5429     
+ Partials      731      710       -21     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.