tell a confirmed absence apart from a failed release lookup, and check the bump case-sensitively

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: johnsca

.github/workflows/cut-release.yml

@@ -46,16 +46,22 @@ jobs:
           use-policy-store: true
           api-key: ${{ secrets.STEP_SECURITY_API_KEY }} # zizmor: ignore[secrets-outside-env]
 
-      # An unrecognised bump does not fail the tag action. It falls back to
-      # reading the commit messages and publishes a version nobody asked for.
+      # The tag action throws on a bump it does not recognise, which is a
+      # confusing place to find out. Checked in the shell rather than an `if:`
+      # because workflow expressions compare case-insensitively, so `Major`
+      # would clear one and then fail inside the action.
       - name: Check the requested bump
-        if: ${{ !contains(fromJSON('["patch", "minor", "major"]'), inputs.bump) }}
         env:
           BUMP: ${{ inputs.bump }}
         run: |
-          echo "The bump has to be patch, minor, or major. This run asked for" >&2
-          echo "'${BUMP}'." >&2
-          exit 1
+          case "${BUMP}" in
+            patch | minor | major) ;;
+            *)
+              echo "The bump has to be patch, minor, or major. This run asked for" >&2
+              echo "'${BUMP}'." >&2
+              exit 1
+              ;;
+          esac
 
       # A dispatch can target any branch, and a release cut from a topic branch
       # names code that never merged. Immutability makes that permanent.
@@ -187,12 +193,19 @@ jobs:
           # An EXIT trap covers a cancelled job as well as a failed command,
           # though not a SIGKILL.
           cleanup() {
-            local ref_sha
+            local ref_sha releases
             ref_sha=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq .object.sha 2>/dev/null) || return 0
             if [ "${ref_sha}" != "${COMMIT}" ]; then
               return 0
             fi
-            if gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" > /dev/null 2>&1; then
+            # Listing answers "no release" with an empty result and a success,
+            # which is what tells a confirmed absence apart from a lookup that
+            # failed. Asking for the release by tag reports both the same way,
+            # and deleting on an unconfirmed absence would strip the tag off a
+            # release that did publish.
+            releases=$(gh api --paginate "repos/${GITHUB_REPOSITORY}/releases" \
+              --jq '.[] | select(.tag_name == env.TAG) | .id') || return 0
+            if [ -n "${releases}" ]; then
               return 0
             fi
             gh api -X DELETE "repos/${GITHUB_REPOSITORY}/git/refs/tags/${TAG}" > /dev/null 2>&1 || true