Distrib on broken tags fails and can't roll back
When you dune-release tag a new git tag is created, but there is no validation that said tag actually works. So when doing dune-release distrib afterwards this might fail (because the build fails or tests fail etc) so now you have a tag that is invalid and needs to be removed manually.
I am aware that distrib needs a version to construct the tarball but the ordering is unfortunate. Maybe there could be something like attempt-tag or similar that could abort when it can't create a tarball.
You can use dune-release tag -d to remove the tag. That works fairly well since at that point the tag only exists locally.
I agree it is unfortunate though, we might consider offering to delete the tag ourselves if distrib fails!
Also note that you can run distrib without tagging, you should only get a warning!