From 0714595687d205362effe2179274e68ce765f4da Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Wed, 1 Apr 2026 11:54:52 +0100
Subject: [PATCH 1/3] fix: replace broken actions-tagger with github-script for
 version tagging

---
 .github/scripts/update-major-tag.js | 45 +++++++++++++++++++++++++++++
 .github/workflows/versioning.yml    |  8 +++--
 2 files changed, 50 insertions(+), 3 deletions(-)
 create mode 100644 .github/scripts/update-major-tag.js

diff --git a/.github/scripts/update-major-tag.js b/.github/scripts/update-major-tag.js
new file mode 100644
index 00000000..e04ab9ca
--- /dev/null
+++ b/.github/scripts/update-major-tag.js
@@ -0,0 +1,45 @@
+// @ts-check
+
+/** @param {import('@actions/github-script').AsyncFunctionArguments} args */
+module.exports = async ({ github, context }) => {
+  const tag = context.payload.release?.tag_name;
+  if (!tag) {
+    throw new Error("No release tag found in event payload");
+  }
+
+  const match = tag.match(/^(v\d+)\.\d+\.\d+/);
+  if (!match) {
+    throw new Error(`Tag "${tag}" does not match semver pattern vX.Y.Z`);
+  }
+
+  const majorTag = match[1];
+  const sha = context.sha;
+
+  const tagsToUpdate = [majorTag, "latest"];
+
+  for (const tagName of tagsToUpdate) {
+    const ref = `tags/${tagName}`;
+    try {
+      await github.rest.git.updateRef({
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        ref,
+        sha,
+        force: true,
+      });
+      console.log(`Updated ${ref} to ${sha}`);
+    } catch (error) {
+      if (error.status === 422) {
+        await github.rest.git.createRef({
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          ref: `refs/${ref}`,
+          sha,
+        });
+        console.log(`Created ${ref} at ${sha}`);
+      } else {
+        throw error;
+      }
+    }
+  }
+};
diff --git a/.github/workflows/versioning.yml b/.github/workflows/versioning.yml
index b1dd2878..370d32ce 100644
--- a/.github/workflows/versioning.yml
+++ b/.github/workflows/versioning.yml
@@ -11,7 +11,9 @@ jobs:
   actions-tagger:
     runs-on: ubuntu-latest
     steps:
-      - uses: Actions-R-Us/actions-tagger@148653c6179832f8392d083de6b46ad3dcc54de3
+      - uses: actions/checkout@v4
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
-          publish_latest_tag: true
-          token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fn = require('./.github/scripts/update-major-tag.js');
+            await fn({ github, context });

From 830631ea4cd4dd2361402429414fc5cd09fb2c08 Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Wed, 1 Apr 2026 13:48:15 +0100
Subject: [PATCH 2/3] chore: use ESM module and pin actions to latest versions

---
 .github/scripts/update-major-tag.js | 4 ++--
 .github/workflows/versioning.yml    | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/update-major-tag.js b/.github/scripts/update-major-tag.js
index e04ab9ca..541c432c 100644
--- a/.github/scripts/update-major-tag.js
+++ b/.github/scripts/update-major-tag.js
@@ -1,7 +1,7 @@
 // @ts-check
 
 /** @param {import('@actions/github-script').AsyncFunctionArguments} args */
-module.exports = async ({ github, context }) => {
+export default async function updateMajorTag({ github, context }) {
   const tag = context.payload.release?.tag_name;
   if (!tag) {
     throw new Error("No release tag found in event payload");
@@ -42,4 +42,4 @@ module.exports = async ({ github, context }) => {
       }
     }
   }
-};
+}
diff --git a/.github/workflows/versioning.yml b/.github/workflows/versioning.yml
index 370d32ce..5075340b 100644
--- a/.github/workflows/versioning.yml
+++ b/.github/workflows/versioning.yml
@@ -11,9 +11,9 @@ jobs:
   actions-tagger:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
-            const fn = require('./.github/scripts/update-major-tag.js');
-            await fn({ github, context });
+            const { default: updateMajorTag } = await import('${{ github.workspace }}/.github/scripts/update-major-tag.js');
+            await updateMajorTag({ github, context });

From e1bdba1a073b74288bd233a5706a6063f6dae38a Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Wed, 1 Apr 2026 14:07:43 +0100
Subject: [PATCH 3/3] fix: handle 404 when tag ref does not exist yet

---
 .github/scripts/update-major-tag.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/scripts/update-major-tag.js b/.github/scripts/update-major-tag.js
index 541c432c..e7f3d38b 100644
--- a/.github/scripts/update-major-tag.js
+++ b/.github/scripts/update-major-tag.js
@@ -29,7 +29,7 @@ export default async function updateMajorTag({ github, context }) {
       });
       console.log(`Updated ${ref} to ${sha}`);
     } catch (error) {
-      if (error.status === 422) {
+      if (error?.status === 404 || error?.status === 422) {
         await github.rest.git.createRef({
           owner: context.repo.owner,
           repo: context.repo.repo,