ci: harden Release workflow against tag races

.github/workflows/release.yml

@@ -2,13 +2,25 @@ name: Release
 
 on:
   workflow_dispatch: # Allows manual trigger from Actions tab.
+    inputs:
+      tag:
+        description: "Tag to release (e.g. v1.31.0). Empty = newest tag on the default branch."
+        required: false
+        type: string
+
+# One release at a time; a second dispatch queues instead of racing the first.
+concurrency:
+  group: release
+  cancel-in-progress: false
 
 jobs:
   build-linux:
     name: Build Linux, AUR, Create Release
     runs-on: ubuntu-latest
     permissions:
       contents: write
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
 
     steps:
       - uses: actions/checkout@v6
@@ -18,6 +30,22 @@ jobs:
       - name: Fetch all tags
         run: git fetch --tags --force
 
+      # Resolve the release tag ONCE and check it out, so goreleaser's
+      # git-state check (tag must point at HEAD) cannot race a tag pushed
+      # around dispatch time, and all jobs release the same tag even if a
+      # newer one lands mid-run.
+      - name: Resolve and check out release tag
+        id: tag
+        shell: bash
+        run: |
+          TAG="${{ inputs.tag }}"
+          if [ -z "$TAG" ]; then
+            TAG="$(git describe --tags --abbrev=0)"
+          fi
+          echo "Releasing tag: $TAG"
+          git checkout --quiet "$TAG"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
@@ -63,6 +91,10 @@ jobs:
       - name: Fetch all tags
         run: git fetch --tags --force
 
+      - name: Check out release tag
+        shell: bash
+        run: git checkout --quiet "${{ needs.build-linux.outputs.tag }}"
+
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
@@ -94,6 +126,10 @@ jobs:
       - name: Fetch all tags
         run: git fetch --tags --force
 
+      - name: Check out release tag
+        shell: bash
+        run: git checkout --quiet "${{ needs.build-linux.outputs.tag }}"
+
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
@@ -127,6 +163,10 @@ jobs:
       - name: Fetch all tags
         run: git fetch --tags --force
 
+      - name: Check out release tag
+        shell: bash
+        run: git checkout --quiet "${{ needs.build-linux.outputs.tag }}"
+
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"