ci: support release branches and keep latest on the newest release

(cherry picked from commit a91f898c1f)

.github/workflows/automated.yaml

@@ -6,6 +6,7 @@ on:
       - "package.json"
     branches:
       - "main"
+      - "release/**"
   schedule:
     - cron: "0 8 * * 0"
   workflow_dispatch:

.github/workflows/build.yaml

@@ -8,6 +8,7 @@ on:
       - "README.md"
     branches:
       - "main"
+      - "release/**"
   pull_request:
 
 concurrency:

.github/workflows/docs.yaml

@@ -49,11 +49,32 @@ jobs:
           accountId: ${{ secrets.CF_ACCOUNT_ID }}
           command: pages deploy docs/.vitepress/dist --project-name=headplane-docs-beta
 
+  channel:
+    name: Release Channel
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    outputs:
+      latest: ${{ steps.check.outputs.latest }}
+    steps:
+      # Patch releases on older lines must not replace the stable docs.
+      - name: Check if this is the newest stable release
+        id: check
+        env:
+          TAG: ${{ github.ref_name }}
+          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
+        run: |
+          NEWEST=$(git ls-remote --tags --refs "$REPO_URL" 'v*' \
+            | sed 's|.*refs/tags/||' | grep -v -- - | sort -V | tail -n 1)
+          [[ "$TAG" == "$NEWEST" ]] && LATEST=true || LATEST=false
+          echo "Newest stable release is $NEWEST, latest=$LATEST"
+          echo "latest=$LATEST" >> "$GITHUB_OUTPUT"
+
   stable:
     name: Deploy Stable Docs
+    needs: channel
     if: >
-      (startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-'))
-      || github.ref == 'refs/heads/release/docs'
+      !cancelled()
+      && (needs.channel.outputs.latest == 'true' || github.ref == 'refs/heads/release/docs')
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo

.github/workflows/release.yaml

@@ -16,8 +16,28 @@ permissions:
   attestations: write
 
 jobs:
+  channel:
+    name: Release Channel
+    runs-on: ubuntu-latest
+    outputs:
+      latest: ${{ steps.check.outputs.latest }}
+    steps:
+      # Patch releases on older lines must not take over `latest`.
+      - name: Check if this is the newest stable release
+        id: check
+        env:
+          TAG: ${{ github.ref_name }}
+          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
+        run: |
+          NEWEST=$(git ls-remote --tags --refs "$REPO_URL" 'v*' \
+            | sed 's|.*refs/tags/||' | grep -v -- - | sort -V | tail -n 1)
+          [[ "$TAG" == "$NEWEST" ]] && LATEST=true || LATEST=false
+          echo "Newest stable release is $NEWEST, latest=$LATEST"
+          echo "latest=$LATEST" >> "$GITHUB_OUTPUT"
+
   docker:
     name: Docker Release (${{ matrix.target }})
+    needs: channel
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -39,7 +59,7 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
           flavor: |
-            latest=auto
+            latest=${{ needs.channel.outputs.latest }}
             suffix=${{ matrix.tag_suffix }},onlatest=true
 
       - name: Set up QEMU
@@ -81,7 +101,7 @@ jobs:
 
   release:
     name: GitHub Release
-    needs: docker
+    needs: [channel, docker]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -98,10 +118,11 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
+          LATEST: ${{ needs.channel.outputs.latest }}
         run: |
           node --disable-warning=ExperimentalWarning scripts/release.ts notes "$TAG" > "$RUNNER_TEMP/notes.md"
           if [[ "$TAG" == *-* ]]; then
             gh release create "$TAG" --title "$TAG" --notes-file "$RUNNER_TEMP/notes.md" --prerelease
           else
-            gh release create "$TAG" --title "$TAG" --notes-file "$RUNNER_TEMP/notes.md" --latest
+            gh release create "$TAG" --title "$TAG" --notes-file "$RUNNER_TEMP/notes.md" --latest="$LATEST"
           fi

scripts/release.ts

@@ -73,7 +73,7 @@ function cut(version: string) {
   git("tag", "-m", tag, tag);
 
   console.log(`${tag} is committed and tagged. To ship it:\n`);
-  console.log("  git push origin main --follow-tags");
+  console.log(`  git push origin ${git("branch", "--show-current")} --follow-tags`);
 }
 
 function notes(tag?: string) {