From 39c1255af5902697771ba5e89974f2a46c1c7f07 Mon Sep 17 00:00:00 2001
From: t8y2 <1156263951@qq.com>
Date: Thu, 25 Jun 2026 12:06:11 +0800
Subject: [PATCH] fix(release): serialize release workflows

---
 .github/workflows/agents-release.yml |  4 ++++
 .github/workflows/mcp-release.yml    | 32 ++++++++++++++++++----------
 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/agents-release.yml b/.github/workflows/agents-release.yml
index 0485e403ea..86e3aa7afe 100644
--- a/.github/workflows/agents-release.yml
+++ b/.github/workflows/agents-release.yml
@@ -7,6 +7,10 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: dbx-release-main
+  cancel-in-progress: false
+
 jobs:
   bump-versions:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/mcp-release.yml b/.github/workflows/mcp-release.yml
index 1d072f54fe..f758a6a0d0 100644
--- a/.github/workflows/mcp-release.yml
+++ b/.github/workflows/mcp-release.yml
@@ -11,6 +11,10 @@ permissions:
   contents: write
   id-token: write
 
+concurrency:
+  group: dbx-release-main
+  cancel-in-progress: false
+
 jobs:
   prepare:
     name: Prepare package release
@@ -113,16 +117,7 @@ jobs:
             git commit -m "chore(packages): release ${VERSION} [skip node-packages-release]"
           fi
 
-      - name: Create package release tag
-        run: |
-          TAG="${{ steps.version.outputs.tag }}"
-          if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
-            echo "Tag ${TAG} already exists."
-          else
-            git tag "${TAG}"
-          fi
-
-      - name: Push package release commit and tag
+      - name: Rebase package release commit and push
         env:
           RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
         run: |
@@ -130,8 +125,23 @@ jobs:
           if [ -n "${RELEASE_TOKEN}" ]; then
             git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           fi
+          git fetch origin main --no-tags
+          git rebase origin/main
+          REMOTE_TAG_SHA="$(git ls-remote --tags origin "refs/tags/${TAG}" | awk '{print $1}')"
+          HEAD_SHA="$(git rev-parse HEAD)"
+          if [ -n "${REMOTE_TAG_SHA}" ]; then
+            if [ "${REMOTE_TAG_SHA}" != "${HEAD_SHA}" ]; then
+              echo "::error::Remote tag ${TAG} already exists at ${REMOTE_TAG_SHA}, expected ${HEAD_SHA}."
+              exit 1
+            fi
+            echo "Remote tag ${TAG} already points at ${HEAD_SHA}."
+          else
+            git tag -f "${TAG}" "${HEAD_SHA}"
+          fi
           git push origin HEAD:main
-          git push origin "refs/tags/${TAG}:refs/tags/${TAG}"
+          if [ -z "${REMOTE_TAG_SHA}" ]; then
+            git push origin "refs/tags/${TAG}:refs/tags/${TAG}"
+          fi
 
   publish-node-core:
     name: Publish node-core