Pre-validate before mutation; atomic push prevents orphan tags

[silverwind]

The bug

git push <remote> <branch> <tag> is not atomic. If the branch push is rejected (non-FF) but the tag push succeeds, the rollback hooks — registered after await exec returns — never run, so the orphan tag stays on the remote.

Architecture

main() is now gather → validate → execute:

• Gather — pure reads. Resolve versions, read files, probe remote refs and the forge endpoint.
• Validate — read-only assertions; all must pass before any mutation:
  • at least one specified file would change
  • git author identity is available
  • the planned tag is absent on the remote
  • local HEAD is a descendant of the remote tip (FF possible)
  • if --release: forge reachable, token accepted, permissions.push is true
• Execute — mutations only. Files → -c → commit → tag → git push --atomic → forge release. The local rollback chain runs only on failure before the atomic push lands; once it lands, the commit/tag are shared and we leave them.

Pre-validation removes the predictable post-push failure modes. --atomic removes the partial-push class. Post-push forge failure prints a recovery hint instead of force-pushing remote history.

Behavior changes

• File no-op is fatal — passing files that contain no version pattern (or where --base is wrong) now errors instead of silently exiting 0.
• ls-remote failure aborts — previously a warning + best-effort push; now refuses to mutate if the remote state can't be read.
• Remote tag conflict aborts before any commit/tag — previously failed at push time after the local mutations. Resuming a partial-failure run now requires deleting the remote tag first.
• Post-push release failure leaves the tag — the previous design force-pushed the branch back and deleted the remote tag. The new code prints `gh release create ` / `tea release create --tag ` and the user finishes the release manually.

Performance

All independent I/O probes fire in parallel at the top of main() and validate awaits them once. Critical path drops from ~450ms (sequential) to ~210–300ms (slowest single chain).

Tests

All 105 existing tests pass; added validate - aborts when remote branch has advanced beyond local regressing the exact orphan-tag trigger.

---

This PR was written with the help of Claude Opus 4.7

[Copilot]

Pull request overview

This PR restructures the versions CLI workflow to pre-validate all read-only constraints before performing any mutations, and to eliminate partial remote state (notably orphan remote tags) by switching to an atomic git push.

Changes:

• Split execution into Gather → Validate → Execute phases, ensuring validation failures exit cleanly before any file/git mutations.
• Replace non-atomic remote updates with git push --atomic <remote> <branch> <tag> to prevent orphan tags on rejected branch pushes.
• Add a regression test ensuring validation aborts when the remote branch has advanced beyond the local HEAD.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
index.ts	Adds gather/validate/execute phasing, remote probing + forge ping validation, and atomic push to prevent partial remote updates.
index.test.ts	Adds a regression test for the “remote advanced → abort before mutation” scenario and updates expectations for --remote + --release.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.