From 9a7cb5afc252143edb08a838fd9190be0e018981 Mon Sep 17 00:00:00 2001
From: tiennm99 <tiennm99@outlook.com>
Date: Fri, 23 Oct 2026 03:07:15 +0700
Subject: [PATCH] ci(release-legacy): refuse a version not above the live
 release

Before building, compare the requested version with the tag /releases/latest returns and fail unless it sorts strictly after it. With no published release yet, any version passes.
---
 .github/workflows/release-legacy.yml | 29 ++++++++++++++++++++++++++++
 docs/release-process.md              |  5 ++++-
 2 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-legacy.yml b/.github/workflows/release-legacy.yml
index 26f8bfe..0dc8ba4 100644
--- a/.github/workflows/release-legacy.yml
+++ b/.github/workflows/release-legacy.yml
@@ -32,8 +32,37 @@ permissions:
   contents: read
 
 jobs:
+  # A version at or below the live release is no update for any client, and
+  # publishing it as latest would hide that release from legacy clients.
+  check-version:
+    name: Check the version is above the live release
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+      VERSION: ${{ inputs.version }}
+    steps:
+      - name: Compare with /releases/latest
+        run: |
+          err=$(mktemp)
+          if latest=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" -q .tag_name 2>"$err"); then
+            live="${latest#v}"
+            highest=$(printf '%s\n%s\n' "$live" "$VERSION" | sort -V | tail -n 1)
+            if [ "$VERSION" = "$live" ] || [ "$highest" != "$VERSION" ]; then
+              echo "::error::version '$VERSION' is not higher than the live release $latest."
+              exit 1
+            fi
+            echo "$VERSION is higher than the live release $latest."
+          elif grep -q 'HTTP 404' "$err"; then
+            echo "No published release yet, so any version is higher."
+          else
+            cat "$err" >&2
+            echo "::error::Could not read /releases/latest."
+            exit 1
+          fi
+
   win-x64:
     name: Windows x64 (legacy)
+    needs: check-version
     runs-on: windows-latest
     outputs:
       sha: ${{ steps.sha.outputs.sha }}
diff --git a/docs/release-process.md b/docs/release-process.md
index aa367d8..8990e02 100644
--- a/docs/release-process.md
+++ b/docs/release-process.md
@@ -181,7 +181,10 @@ file is on the default branch, so this workflow, and a dry run of it,
 is available only after the Tauri port merges into `main`:
 
 1. Pick a version `X.Y.Z` higher than every release in the field, so
-   every client sees it as an update.
+   every client sees it as an update. The workflow fails before it
+   builds anything unless `X.Y.Z` sorts strictly after the tag that
+   `/releases/latest` returns (`sort -V`); with no published release
+   yet, any version passes.
 2. Start "Release legacy" from the Actions tab with `ref` set to a ref
    holding the Win32 sources (for example `v0.5.0`), `version` set to
    `X.Y.Z`, `tag` set to `vX.Y.Z`, and `draft` left at `true`.