From bf17a2ed43b41b9e8cff14aa442b1bd8a9c43cdc Mon Sep 17 00:00:00 2001
From: Pablo Caro Revuelta <correo@pablocaro.es>
Date: Tue, 21 Jul 2026 17:32:41 +0200
Subject: [PATCH] ci(publish): tag latest only for the highest version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop the cnctver step that gated the docker 'latest' tag on the
CLI major matching the platform's Connect-Version header — CLI
majors no longer track the platform, so 'latest' was frozen at the
last coinciding release. Instead, apply 'latest' (docker tag and
GitHub release) only when the pushed tag is the highest version in
the repo, so a security backport like 39.8 never steals 'latest'
from a newer major.
---
 .github/workflows/publish.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d387d03..cec1fc0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -48,11 +48,10 @@ jobs:
         poetry version ${{ steps.tag.outputs.result }}
         poetry build
         if [ "$(curl -s -o /dev/null -w '%{http_code}' https://pypi.org/pypi/connect-cli/${{ steps.tag.outputs.result }}/json)" = "404" ]; then poetry publish -u $TWINE_USERNAME -p $TWINE_PASSWORD; fi
-    - name: Set Connect and CLI major versions
-      id: cnctver
+    - name: Check if tag is the highest version
+      id: latest
       run: |
-        echo connect_major="$(curl -sI https://api.connect.cloudblue.com/public/v1|grep -Fi 'connect-version' | tr -d '\r' | sed -En 's/^Connect-Version: (.*)/\1/p'|cut -f1 -d'.')" >> $GITHUB_OUTPUT
-        echo cli_major="$(echo ${{ steps.tag.outputs.result }}|cut -f1 -d '.')" >> $GITHUB_OUTPUT
+        echo is_latest=$([ "$(git tag | sort -V | tail -1)" = "${{ steps.tag.outputs.result }}" ] && echo true || echo false) >> $GITHUB_OUTPUT
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v2
       with:
@@ -72,7 +71,7 @@ jobs:
         tags: |
           type=semver,pattern={{major}}.{{minor}},value=${{ steps.tag.outputs.result }}.0
           type=semver,pattern={{major}},value=${{ steps.tag.outputs.result }}.0
-          type=raw,value=latest,enable=${{ steps.cnctver.outputs.connect_major == steps.cnctver.outputs.cli_major }}
+          type=raw,value=latest,enable=${{ steps.latest.outputs.is_latest }}
         flavor: |
           latest=false
     - name: Build and push docker image
@@ -160,6 +159,10 @@ jobs:
         result-encoding: string
         script: |
           return context.payload.ref.replace(/refs\/tags\//, '')
+    - name: Check if tag is the highest version
+      id: latest
+      run: |
+        echo is_latest=$([ "$(git tag | sort -V | tail -1)" = "${{ steps.tag.outputs.result }}" ] && echo true || echo false) >> $GITHUB_OUTPUT
     - name: Create release
       uses: ncipollo/release-action@v1
       id: create_release
@@ -171,6 +174,7 @@ jobs:
         name: Release ${{ steps.tag.outputs.result }}
         draft: false
         prerelease: false
+        makeLatest: ${{ steps.latest.outputs.is_latest }}
     - name: Download windows artifact
       uses: actions/download-artifact@v6
       with: