fix: use latest release for tag resolution, skip if binaries exist

target_commitish stores the branch name ("main"), not the commit SHA,
so the head_sha matching approach never finds a release. Revert to
gh release view (returns latest) with an idempotency guard: skip the
build if the release already has >=4 binary assets.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: lcandy2

.github/workflows/release-binaries.yaml

@@ -54,39 +54,44 @@ jobs:
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
           else
-            SHA="${{ github.event.workflow_run.head_sha }}"
-            TAG=$(gh api "repos/${{ github.repository }}/releases" --paginate \
-              --jq ".[] | select(.target_commitish == \"$SHA\") | .tag_name" | head -n1)
-            if [ -z "$TAG" ]; then
-              echo "::error::No release found for commit $SHA"
-              exit 1
+            TAG=$(gh release view --repo "${{ github.repository }}" --json tagName -q .tagName)
+            EXISTING=$(gh release view "$TAG" --repo "${{ github.repository }}" \
+              --json assets --jq '[.assets[] | select(.name | startswith("photon-"))] | length')
+            if [ "$EXISTING" -ge 4 ]; then
+              echo "::notice::Release $TAG already has binaries, skipping"
+              echo "skip=true" >> "$GITHUB_OUTPUT"
             fi
             echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/checkout@v5
+      - if: steps.tag.outputs.skip != 'true'
+        uses: actions/checkout@v5
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
-      - uses: oven-sh/setup-bun@v2
+      - if: steps.tag.outputs.skip != 'true'
+        uses: oven-sh/setup-bun@v2
         with:
           bun-version: "1.3.13"
 
       - name: Install
+        if: steps.tag.outputs.skip != 'true'
         run: bun install --frozen-lockfile
 
       - name: Compile binary
+        if: steps.tag.outputs.skip != 'true'
         run: |
           bun build ./src/index.ts \
             --compile \
             --target=${{ matrix.target }} \
             --outfile dist/${{ matrix.asset }}
 
       - name: Smoke test (native targets only)
-        if: matrix.target == 'bun-darwin-arm64' || matrix.target == 'bun-linux-x64'
+        if: steps.tag.outputs.skip != 'true' && (matrix.target == 'bun-darwin-arm64' || matrix.target == 'bun-linux-x64')
         run: ./dist/${{ matrix.asset }} --version
 
       - name: Compute SHA256
+        if: steps.tag.outputs.skip != 'true'
         run: |
           if command -v shasum >/dev/null 2>&1; then
             shasum -a 256 dist/${{ matrix.asset }} > dist/${{ matrix.asset }}.sha256
@@ -95,6 +100,7 @@ jobs:
           fi
 
       - name: Upload to release
+        if: steps.tag.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -115,13 +121,7 @@ jobs:
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
           else
-            SHA="${{ github.event.workflow_run.head_sha }}"
-            TAG=$(gh api "repos/${{ github.repository }}/releases" --paginate \
-              --jq ".[] | select(.target_commitish == \"$SHA\") | .tag_name" | head -n1)
-            if [ -z "$TAG" ]; then
-              echo "::error::No release found for commit $SHA"
-              exit 1
-            fi
+            TAG=$(gh release view --repo "${{ github.repository }}" --json tagName -q .tagName)
             echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
           fi