ci(publish): tag latest only for the highest version#255
Merged
Conversation
Drop the cnctver step that gated the docker 'latest' tag on the CLI major matching the platform's Connect-Version header — CLI majors no longer track the platform, so 'latest' was frozen at the last coinciding release. Instead, apply 'latest' (docker tag and GitHub release) only when the pushed tag is the highest version in the repo, so a security backport like 39.8 never steals 'latest' from a newer major.
pcaro
marked this pull request as ready for review
July 21, 2026 15:34
arnaugiralt
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Reworks how the
latestlabel is applied when publishing a release:cnctverstep that only tagged the Docker image aslatestwhen the CLI tag major matched the platform'sConnect-Versionheader. CLI majors no longer track the platform (platform is at 43, CLI at 40.x), solatesthas been frozen since the last coinciding release.latest(Docker tag and GitHub releasemakeLatest) only when the pushed tag is the highest version in the repo (git tag | sort -V).Why
We want
latestto always point to the newest major release, while keeping the door open for security backports on older majors: releasing e.g.39.8after41.0will publish39.8and retag39, but will not steallatest.PyPI needs no change — pip always resolves the highest version.
🤖 Generated with Claude Code