From da0d6b6a2efcac04c31ec1b4b78c6aa6f82700a2 Mon Sep 17 00:00:00 2001
From: Aarnav Tale <git@tale.me>
Date: Fri, 16 Oct 2026 11:18:29 -0700
Subject: [PATCH] ci: support release branches and keep latest on the newest
 release

(cherry picked from commit a91f898c1f29fd0dd0dd7d538287787c6307266a)
---
 .github/workflows/automated.yaml |  1 +
 .github/workflows/build.yaml     |  1 +
 .github/workflows/docs.yaml      | 25 +++++++++++++++++++++++--
 .github/workflows/release.yaml   | 27 ++++++++++++++++++++++++---
 scripts/release.ts               |  2 +-
 5 files changed, 50 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/automated.yaml b/.github/workflows/automated.yaml
index d93d5917..5189b5d3 100644
--- a/.github/workflows/automated.yaml
+++ b/.github/workflows/automated.yaml
@@ -6,6 +6,7 @@ on:
       - "package.json"
     branches:
       - "main"
+      - "release/**"
   schedule:
     - cron: "0 8 * * 0"
   workflow_dispatch:
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f0c721f9..943b9144 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -8,6 +8,7 @@ on:
       - "README.md"
     branches:
       - "main"
+      - "release/**"
   pull_request:
 
 concurrency:
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 7e98dc96..c066c840 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -49,11 +49,32 @@ jobs:
           accountId: ${{ secrets.CF_ACCOUNT_ID }}
           command: pages deploy docs/.vitepress/dist --project-name=headplane-docs-beta
 
+  channel:
+    name: Release Channel
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    outputs:
+      latest: ${{ steps.check.outputs.latest }}
+    steps:
+      # Patch releases on older lines must not replace the stable docs.
+      - name: Check if this is the newest stable release
+        id: check
+        env:
+          TAG: ${{ github.ref_name }}
+          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
+        run: |
+          NEWEST=$(git ls-remote --tags --refs "$REPO_URL" 'v*' \
+            | sed 's|.*refs/tags/||' | grep -v -- - | sort -V | tail -n 1)
+          [[ "$TAG" == "$NEWEST" ]] && LATEST=true || LATEST=false
+          echo "Newest stable release is $NEWEST, latest=$LATEST"
+          echo "latest=$LATEST" >> "$GITHUB_OUTPUT"
+
   stable:
     name: Deploy Stable Docs
+    needs: channel
     if: >
-      (startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-'))
-      || github.ref == 'refs/heads/release/docs'
+      !cancelled()
+      && (needs.channel.outputs.latest == 'true' || github.ref == 'refs/heads/release/docs')
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8a993b11..c89ef439 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -16,8 +16,28 @@ permissions:
   attestations: write
 
 jobs:
+  channel:
+    name: Release Channel
+    runs-on: ubuntu-latest
+    outputs:
+      latest: ${{ steps.check.outputs.latest }}
+    steps:
+      # Patch releases on older lines must not take over `latest`.
+      - name: Check if this is the newest stable release
+        id: check
+        env:
+          TAG: ${{ github.ref_name }}
+          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
+        run: |
+          NEWEST=$(git ls-remote --tags --refs "$REPO_URL" 'v*' \
+            | sed 's|.*refs/tags/||' | grep -v -- - | sort -V | tail -n 1)
+          [[ "$TAG" == "$NEWEST" ]] && LATEST=true || LATEST=false
+          echo "Newest stable release is $NEWEST, latest=$LATEST"
+          echo "latest=$LATEST" >> "$GITHUB_OUTPUT"
+
   docker:
     name: Docker Release (${{ matrix.target }})
+    needs: channel
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -39,7 +59,7 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
           flavor: |
-            latest=auto
+            latest=${{ needs.channel.outputs.latest }}
             suffix=${{ matrix.tag_suffix }},onlatest=true
 
       - name: Set up QEMU
@@ -81,7 +101,7 @@ jobs:
 
   release:
     name: GitHub Release
-    needs: docker
+    needs: [channel, docker]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -98,10 +118,11 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
+          LATEST: ${{ needs.channel.outputs.latest }}
         run: |
           node --disable-warning=ExperimentalWarning scripts/release.ts notes "$TAG" > "$RUNNER_TEMP/notes.md"
           if [[ "$TAG" == *-* ]]; then
             gh release create "$TAG" --title "$TAG" --notes-file "$RUNNER_TEMP/notes.md" --prerelease
           else
-            gh release create "$TAG" --title "$TAG" --notes-file "$RUNNER_TEMP/notes.md" --latest
+            gh release create "$TAG" --title "$TAG" --notes-file "$RUNNER_TEMP/notes.md" --latest="$LATEST"
           fi
diff --git a/scripts/release.ts b/scripts/release.ts
index 4a1ff28c..e87be90e 100644
--- a/scripts/release.ts
+++ b/scripts/release.ts
@@ -73,7 +73,7 @@ function cut(version: string) {
   git("tag", "-m", tag, tag);
 
   console.log(`${tag} is committed and tagged. To ship it:\n`);
-  console.log("  git push origin main --follow-tags");
+  console.log(`  git push origin ${git("branch", "--show-current")} --follow-tags`);
 }
 
 function notes(tag?: string) {