From 2f11f6121a4cb8836906748252d643c591f74de7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 12 Jul 2026 23:46:18 +0000
Subject: [PATCH] Tighten Nightly deletion and tag verification

---
 .github/workflows/nightly.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 4525961a7c..5eaa709cb0 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -833,7 +833,10 @@ jobs:
         run: |
           if gh release view Nightly > /dev/null 2>&1; then
             # Delete the release and associated tag if it exists.
-            gh release delete Nightly --yes --cleanup-tag
+            if ! gh release delete Nightly --yes --cleanup-tag; then
+              echo "Failed to delete existing Nightly release/tag"
+              exit 1
+            fi
           else
             echo "No release to delete"
           fi
@@ -848,12 +851,12 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           git tag -f Nightly "${{ github.sha }}"
-          if ! git push --force origin refs/tags/Nightly; then
+          if ! git push --force-with-lease origin refs/tags/Nightly; then
             echo "Failed to push Nightly tag to origin"
             exit 1
           fi
 
-          TAG_SHA="$(git ls-remote --tags origin refs/tags/Nightly | awk '{print $1}')"
+          TAG_SHA="$(git ls-remote --tags origin refs/tags/Nightly | awk '$2 == "refs/tags/Nightly" { print $1 }')"
           if [ "$TAG_SHA" != "${{ github.sha }}" ]; then
             echo "Nightly tag points to $TAG_SHA, expected ${{ github.sha }}"
             exit 1