From 3bad7b30ec0c7e572ca4900e5e7ffe2da2507f63 Mon Sep 17 00:00:00 2001
From: Arne Luenser <arne.luenser@ory.sh>
Date: Fri, 10 Jul 2026 14:52:05 +0200
Subject: [PATCH 1/3] fix: broken stdin during `ory dev release publish`

---
 cmd/pkg/git.go | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/cmd/pkg/git.go b/cmd/pkg/git.go
index b0c80286..d80a37fc 100644
--- a/cmd/pkg/git.go
+++ b/cmd/pkg/git.go
@@ -16,6 +16,10 @@ import (
 
 const GitCommitMessagePreviousVersion = "Bumps from"
 
+// stdin is shared across all prompts. Creating a fresh bufio.Reader per prompt
+// discards read-ahead input, which breaks piped stdin and typed-ahead answers.
+var stdin = bufio.NewReader(os.Stdin)
+
 func NewCommand(name string, args ...string) *exec.Cmd {
 	_, _ = fmt.Fprintf(os.Stderr, "$ %s %s\n", name, strings.Join(args, " "))
 	ec := exec.Command(name, args...)
@@ -43,9 +47,8 @@ func GitTagRelease(dir string, annotate, dry bool, nextVersion semver.Version, p
 	Check(NewCommandIn(dir, "git", gitArgs...).Run())
 
 	if annotate {
-		tag := NewCommandIn(dir, "git", "tag", fmt.Sprintf("v%s", nextVersion.String()), "-a")
-		tag.Stdin = os.Stdin
-		Check(tag.Run())
+		message := promptTagMessage(nextVersion)
+		Check(NewCommandIn(dir, "git", "tag", fmt.Sprintf("v%s", nextVersion.String()), "-a", "-m", message).Run())
 	} else {
 		Check(NewCommandIn(dir, "git", "tag", fmt.Sprintf("v%s", nextVersion.String())).Run())
 	}
@@ -64,11 +67,34 @@ func GitClone(repo string) string {
 	return dest
 }
 
+// promptTagMessage reads the annotated tag message from stdin. Opening
+// $EDITOR instead is not safe here: handing the inherited terminal to vim
+// mid-run can leave the terminal in a broken state and subsequent stdin
+// reads fail with EOF.
+func promptTagMessage(version semver.Version) string {
+	fmt.Printf("Enter the tag message for v%s. Finish with an empty line:\n> ", version.String())
+	var lines []string
+	for {
+		line, err := stdin.ReadString('\n')
+		Check(err)
+
+		line = strings.TrimRight(line, "\r\n")
+		if line == "" {
+			if len(lines) > 0 {
+				return strings.Join(lines, "\n")
+			}
+			fmt.Print("The tag message must not be empty.\n> ")
+			continue
+		}
+		lines = append(lines, line)
+		fmt.Print("> ")
+	}
+}
+
 func Confirm(message string, args ...interface{}) {
 	for {
-		reader := bufio.NewReader(os.Stdin)
 		fmt.Printf("%s [y/n] ", fmt.Sprintf(message, args...))
-		answer, err := reader.ReadString('\n')
+		answer, err := stdin.ReadString('\n')
 		Check(err)
 
 		answer = strings.TrimSpace(answer)

From 9e0bb9a2653c4fe97ce7bfdb80b92268a3025845 Mon Sep 17 00:00:00 2001
From: Arne Luenser <arne.luenser@ory.sh>
Date: Fri, 10 Jul 2026 15:31:05 +0200
Subject: [PATCH 2/3] chore: deflake

---
 cmd/cloudx/testhelpers/testhelpers.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cmd/cloudx/testhelpers/testhelpers.go b/cmd/cloudx/testhelpers/testhelpers.go
index e28e7f97..514cfd29 100644
--- a/cmd/cloudx/testhelpers/testhelpers.go
+++ b/cmd/cloudx/testhelpers/testhelpers.go
@@ -286,7 +286,10 @@ func NewPage(t testing.TB, browser playwright.Browser) playwright.Page {
 		require.NoError(t, page.Context().Route(func(actual string) bool {
 			return strings.Contains(actual, route)
 		}, func(r playwright.Route) {
-			require.NoError(t, r.Abort())
+			// Best-effort: the page may already be closed during teardown, in
+			// which case Abort returns "target closed" for a request we no
+			// longer care about. Failing the test here races test completion.
+			_ = r.Abort()
 		}))
 	}
 	return page

From 834fabc101bac5add6c602af4560aec922097bfd Mon Sep 17 00:00:00 2001
From: Arne Luenser <arne.luenser@ory.sh>
Date: Fri, 10 Jul 2026 15:32:29 +0200
Subject: [PATCH 3/3] fix: bring back dummy `post-release` Make target

---
 Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Makefile b/Makefile
index 5a98e6eb..42e296f1 100644
--- a/Makefile
+++ b/Makefile
@@ -49,6 +49,11 @@ licenses: .bin/licenses node_modules  # checks open-source licenses
 docker:
 	docker build -f .docker/Dockerfile-build -t oryd/ory:latest-sqlite .
 
+# Dummy target for ory/ci pipeline to run after a release has been made. Needs to exist or release pipeline fails.
+.PHONY: post-release
+post-release:
+	echo "nothing to do"
+
 node_modules: package-lock.json
 	npm ci
 	touch node_modules