From 3dc8a15fc09c52a7cfa0dc023aeca9bb866c9cb2 Mon Sep 17 00:00:00 2001
From: JOY <joy@dos.ai>
Date: Sun, 24 May 2026 00:08:16 +0700
Subject: [PATCH 1/2] fix(ci): sync-upstream prefers stable releases over
 prereleases

The tag selection used 'git tag --sort=-v:refname | head -1', which ranks
v2.8.0-alpha.2 ABOVE v2.8.0 (git version-sort treats the prerelease suffix
as higher without versionsort.suffix config). This pinned the frontend to an
alpha forever once that alpha was synced.

Now prefer the newest STABLE release (no -alpha/-beta/-rc suffix), falling
back to the newest non-alpha prerelease only when no stable exists. Never
auto-sync -alpha.
---
 .github/workflows/sync-upstream.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index b471c7adbe..afa38e37ad 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -39,8 +39,13 @@ jobs:
           if [ -n "${{ inputs.tag }}" ]; then
             TAG="${{ inputs.tag }}"
           else
-            # Get latest release tag from upstream
-            TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -1)
+            # Prefer the newest STABLE release (no -alpha/-beta/-rc suffix).
+            # Fall back to the newest non-alpha prerelease (beta/rc) only when no
+            # stable release exists. Never auto-sync -alpha tags.
+            TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | grep -vE -- '-' | head -1)
+            if [ -z "$TAG" ]; then
+              TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | grep -ivE -- '-alpha' | head -1)
+            fi
           fi
           echo "tag=$TAG" >> $GITHUB_OUTPUT
           echo "Target tag: $TAG"

From 4df01471b614c0fca1aafedbf1b44abc8913ef7d Mon Sep 17 00:00:00 2001
From: JOY <joy@dos.ai>
Date: Sun, 24 May 2026 00:10:49 +0700
Subject: [PATCH 2/2] harden: abort sync if no upstream tag matched (empty TAG
 guard)

---
 .github/workflows/sync-upstream.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index afa38e37ad..ed7d5106e6 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -47,6 +47,12 @@ jobs:
               TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | grep -ivE -- '-alpha' | head -1)
             fi
           fi
+
+          if [ -z "$TAG" ]; then
+            echo "::error::No upstream release tag matched 'v[0-9]*.[0-9]*.[0-9]*'. Aborting."
+            exit 1
+          fi
+
           echo "tag=$TAG" >> $GITHUB_OUTPUT
           echo "Target tag: $TAG"