From dc6694bc3feeffcdf119808c0cfab0a85e49889e Mon Sep 17 00:00:00 2001
From: Noah Hanford <spaced@csh.rit.edu>
Date: Fri, 19 Jun 2026 19:26:17 -0400
Subject: [PATCH 1/2] Create release-tag.yaml

---
 .github/workflows/release-tag.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 .github/workflows/release-tag.yaml

diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml
new file mode 100644
index 00000000..b40a00cf
--- /dev/null
+++ b/.github/workflows/release-tag.yaml
@@ -0,0 +1,15 @@
+name: Tag Release
+
+on:
+  release:
+
+jobs:
+  update-tag:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Run latest-tag
+      uses: EndBug/latest-tag@latest
+      with:
+        ref: prod
+        description: Latest release to prod

From 06ff5d804261a0cc8693879ad1f81e619211dec1 Mon Sep 17 00:00:00 2001
From: Noah Hanford <spaced@csh.rit.edu>
Date: Tue, 23 Jun 2026 15:55:15 -0400
Subject: [PATCH 2/2] Update release-tag.yaml to our own workflow

---
 .github/workflows/release-tag.yaml | 34 ++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml
index b40a00cf..1f19ce40 100644
--- a/.github/workflows/release-tag.yaml
+++ b/.github/workflows/release-tag.yaml
@@ -2,14 +2,36 @@ name: Tag Release
 
 on:
   release:
+    types: [published]
+
+concurrency:
+  group: release-tag
+  cancel-in-progress: false
+
+permissions:
+  contents: write
 
 jobs:
   update-tag:
     runs-on: ubuntu-latest
-
+    if: ${{ !github.event.release.prerelease && !github.event.release.draft }}
+    
     steps:
-    - name: Run latest-tag
-      uses: EndBug/latest-tag@latest
-      with:
-        ref: prod
-        description: Latest release to prod
+      - name: Checkout the release commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          fetch-depth: 1
+
+      - name: Configure git identity
+        run: |
+          git config user.name  "latest github tag bot"
+          git config user.email "webmaster@csh.rit.edu"
+
+      - name: Move "latest" to the release commit
+        run: |
+          set -euo pipefail
+          target_sha="$(git rev-parse "HEAD^{commit}")" # parses tag to git sha hash
+          echo "Release ${{ github.event.release.tag_name }} -> ${target_sha}"
+          git tag --force latest "${target_sha}"
+          git push --force origin refs/tags/latest