Require an explicit stable base version in <major>.<minor>[.<patch>] form;
treat two components as patch 0. Do not infer it from the branch or package
metadata, and do not edit version files while creating the tag.
Prefer release/<major>.<minor>. If that remote branch does not exist, use
main only when its workspace version equals the requested base version. Select
the next unused positive beta number for that exact base version unless the user
provides one. Relay tags are raw SemVer: 0.9.0-beta.1, never v0.9.0-beta.1.
Before the destructive tag push, require explicit approval. Preserve user
changes: do not stash, discard, or switch away from a dirty checkout. Fetch the
source branch and tags, require HEAD to equal upstream/<source-branch>, and
require the workspace version to equal the stable base version. Verify both
local and remote tags are absent, create a signed annotated tag, verify it with
git tag -v, and push only refs/tags/<tag>. Stop on any failed check; never
force-update, replace, or delete tags.
Select and Verify the Source
Use upstream for NVIDIA/NeMo-Relay. The version and optional beta number
are user inputs. Validate a supplied number as a positive integer; otherwise
derive the next number after fetching tags for the selected source branch.
BASE_VERSION=<major.minor[.patch]>
[[ "$BASE_VERSION" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]] || { echo "Error: invalid base version" >&2; exit 1; }
if [[ "$BASE_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then BASE_VERSION="$BASE_VERSION.0"; fi
RELEASE_BRANCH="release/$(printf '%s' "$BASE_VERSION" | cut -d. -f1,2)"
SOURCE_BRANCH="$RELEASE_BRANCH"
if git ls-remote --exit-code --heads upstream "refs/heads/$SOURCE_BRANCH" >/dev/null; then
:
else
lookup_status=$?
case "$lookup_status" in
2) SOURCE_BRANCH=main ;;
*) echo "Error: release branch lookup failed" >&2; exit "$lookup_status" ;;
esac
fi
git fetch upstream "$SOURCE_BRANCH" --tags
LAST_BETA="$(git tag --list "${BASE_VERSION}-beta.*" | sed -nE "s/^${BASE_VERSION//./\\.}-beta\.([1-9][0-9]*)$/\\1/p" | sort -n | tail -1)"
BETA_NUMBER="${BETA_NUMBER:-$(( ${LAST_BETA:-0} + 1 ))}"
[[ "$BETA_NUMBER" =~ ^[1-9][0-9]*$ ]]
TAG="${BASE_VERSION}-beta.${BETA_NUMBER}"
From a clean checkout of SOURCE_BRANCH, verify the branch is current, the
workspace version matches BASE_VERSION, and the tag is absent locally and on
upstream. When SOURCE_BRANCH is main, make the same version check against
upstream/main before switching. After the user authorizes the push:
git tag -s -a -m "NVIDIA NeMo Relay ${TAG}" "$TAG" HEAD
git tag -v "$TAG"
git push upstream "refs/tags/$TAG"