chore: Add workflow to update major version tag on release

[DenverCoder1]

Description

Fixes #938

Type of change

• Bug fix (added a non-breaking change which fixes an issue)
• New feature (added a non-breaking change which adds functionality)
• Updated documentation (updated the readme, templates, or other repo files)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

• Tested locally with a valid username
• Tested locally with an invalid username
• Ran tests with composer test
• Added or updated test cases to test new features

Checklist:

• I have checked to make sure no other pull requests are open for this issue
• The code is properly formatted and is consistent with the existing code style
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings

Screenshots

[Copilot]

🟡 Changes recommended

Critical security and tag-consistency issues, plus moderate release-handling issues, remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds a GitHub Actions workflow to update floating major-version tags when releases are published.

Changes:

• Triggers on published releases.
• Parses semantic version tags.
• Creates or force-updates the corresponding major tag.
• Grants permission to push tags.

File summaries

File	Summary	Review findings
.github/workflows/update-major-version-tag.yml	Adds release-triggered major-version tag management.	Critical shell-injection and concurrent-update risks; moderate prerelease and invalid-tag handling issues.

Review details

Suppressed comments (3)

.github/workflows/update-major-version-tag.yml:59

• This is a second direct interpolation of the untrusted release tag into shell code. A malicious tag can execute commands before git rev-list runs; reuse a step environment variable instead of embedding the expression in run.
  .github/workflows/update-major-version-tag.yml:34
• The diagnostic says the update is being skipped, but exit 1 fails the job. A manually created release with a non-semver tag will therefore report a failed workflow rather than leave the major tag unchanged; either add an explicit skip path for the remaining tag-update steps or make the message describe the intentional failure.

          # Preserve the "v" prefix convention if the release tag used one.
          if [[ "$tag" == v* ]]; then

.github/workflows/update-major-version-tag.yml:17

• The published event also fires for prereleases, and this condition does not exclude them. Publishing v1.2.3-rc.1 will therefore move the stable v1 alias to prerelease code; exclude github.event.release.prerelease if this tag is intended to serve stable consumers.

        with:

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Address the concurrency loss and prerelease tagging issues.

Get a fresh assessment by requesting another Copilot review.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite