ci(release): enforce daily release version sequence (2026.6.15.0-18FE)

Author: RealWhyKnot

.github/scripts/Assert-ReleaseVersionSequence.ps1

@@ -0,0 +1,66 @@
+#!/usr/bin/env pwsh
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string] $Tag,
+    [string] $RepoRoot = (Get-Location).Path
+)
+
+$ErrorActionPreference = "Stop"
+
+function Invoke-Git {
+    param([Parameter(Mandatory = $true)][string[]] $Arguments)
+
+    $output = & git @Arguments
+    if ($LASTEXITCODE -ne 0) {
+        throw "git $($Arguments -join ' ') failed with exit code $LASTEXITCODE"
+    }
+    return @($output)
+}
+
+function Get-ExpectedReleaseRevision {
+    param(
+        [string] $DateStamp,
+        [string] $ExcludeTag
+    )
+
+    $escapedDate = [regex]::Escape($DateStamp)
+    $pattern = "^v$escapedDate\.(\d+)(-[A-Za-z0-9]{4})?$"
+    $existingTags = @(Invoke-Git -Arguments @("tag", "--list", "v$DateStamp.*"))
+    $highest = -1
+
+    foreach ($existingTag in $existingTags) {
+        if ($existingTag -eq $ExcludeTag) {
+            continue
+        }
+        if ($existingTag -match $pattern) {
+            $value = [int] $Matches[1]
+            if ($value -gt $highest) {
+                $highest = $value
+            }
+        }
+    }
+
+    return $highest + 1
+}
+
+$repoRootPath = (Resolve-Path -LiteralPath $RepoRoot).Path
+Push-Location $repoRootPath
+try {
+    if ($Tag -notmatch "^v(\d{4})\.(\d+)\.(\d+)\.(\d+)(-[A-Za-z0-9]{4})?$") {
+        throw "Release tag must be vYYYY.M.D.N or vYYYY.M.D.N-XXXX, got '$Tag'."
+    }
+
+    $dateStamp = "$($Matches[1]).$($Matches[2]).$($Matches[3])"
+    $actualRevision = [int] $Matches[4]
+    $expectedRevision = Get-ExpectedReleaseRevision -DateStamp $dateStamp -ExcludeTag $Tag
+
+    if ($actualRevision -ne $expectedRevision) {
+        throw "Release tag $Tag uses revision $actualRevision, expected $expectedRevision for $dateStamp. Use .0 when no release exists for the day; otherwise increment the highest same-day release or prerelease revision by one."
+    }
+
+    Write-Host "Release tag $Tag uses the expected same-day revision $expectedRevision."
+}
+finally {
+    Pop-Location
+}

.github/scripts/Test-ReleaseVersionSequence.ps1

@@ -0,0 +1,106 @@
+#!/usr/bin/env pwsh
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = "Stop"
+
+$ScriptRoot = Split-Path -Parent $MyInvocation.MyCommand.Path
+$AssertScript = Join-Path $ScriptRoot "Assert-ReleaseVersionSequence.ps1"
+
+function Invoke-TestGit {
+    param(
+        [string] $RepoRoot,
+        [string[]] $Arguments
+    )
+
+    Push-Location $RepoRoot
+    try {
+        $output = & git @Arguments
+        if ($LASTEXITCODE -ne 0) {
+            throw "git $($Arguments -join ' ') failed with exit code $LASTEXITCODE"
+        }
+        return @($output)
+    }
+    finally {
+        Pop-Location
+    }
+}
+
+function New-TestRepo {
+    $root = Join-Path ([System.IO.Path]::GetTempPath()) ("handoff-release-sequence-" + [System.Guid]::NewGuid().ToString("N"))
+    New-Item -ItemType Directory -Path $root | Out-Null
+    Invoke-TestGit -RepoRoot $root -Arguments @("init", "-q", ".") | Out-Null
+    Invoke-TestGit -RepoRoot $root -Arguments @("config", "user.name", "Handoff Tests") | Out-Null
+    Invoke-TestGit -RepoRoot $root -Arguments @("config", "user.email", "handoff-tests@example.invalid") | Out-Null
+    Set-Content -LiteralPath (Join-Path $root "sample.txt") -Value "base" -Encoding ASCII
+    Invoke-TestGit -RepoRoot $root -Arguments @("add", ".") | Out-Null
+    Invoke-TestGit -RepoRoot $root -Arguments @("commit", "-q", "-m", "initial") | Out-Null
+    return $root
+}
+
+function Assert-Passes {
+    param(
+        [string] $RepoRoot,
+        [string] $Tag,
+        [string] $Message
+    )
+
+    & $AssertScript -RepoRoot $RepoRoot -Tag $Tag | Out-Host
+    if ($LASTEXITCODE -ne 0) {
+        throw $Message
+    }
+}
+
+function Assert-Fails {
+    param(
+        [string] $RepoRoot,
+        [string] $Tag,
+        [string] $Message
+    )
+
+    $failed = $false
+    try {
+        & $AssertScript -RepoRoot $RepoRoot -Tag $Tag | Out-Host
+    }
+    catch {
+        $failed = $true
+    }
+
+    if (-not $failed) {
+        throw $Message
+    }
+}
+
+$tempRoots = [System.Collections.Generic.List[string]]::new()
+try {
+    $repo = New-TestRepo
+    $tempRoots.Add($repo) | Out-Null
+    Assert-Passes -RepoRoot $repo -Tag "v2026.6.15.0-beta" -Message "First same-day prerelease should be .0."
+    Assert-Fails -RepoRoot $repo -Tag "v2026.6.15.1-beta" -Message ".1 should fail when no same-day release exists."
+
+    $repo = New-TestRepo
+    $tempRoots.Add($repo) | Out-Null
+    Invoke-TestGit -RepoRoot $repo -Arguments @("tag", "v2026.6.15.0") | Out-Null
+    Assert-Passes -RepoRoot $repo -Tag "v2026.6.15.1-beta" -Message "Prerelease after same-day stable .0 should be .1."
+    Assert-Fails -RepoRoot $repo -Tag "v2026.6.15.0-beta" -Message ".0-beta should fail after same-day stable .0."
+
+    $repo = New-TestRepo
+    $tempRoots.Add($repo) | Out-Null
+    Invoke-TestGit -RepoRoot $repo -Arguments @("tag", "v2026.6.15.0-beta") | Out-Null
+    Invoke-TestGit -RepoRoot $repo -Arguments @("tag", "v2026.6.15.1") | Out-Null
+    Assert-Passes -RepoRoot $repo -Tag "v2026.6.15.2-beta" -Message "Sequence should increment the highest same-day tag."
+
+    $repo = New-TestRepo
+    $tempRoots.Add($repo) | Out-Null
+    Invoke-TestGit -RepoRoot $repo -Arguments @("tag", "v2026.6.15.0-beta") | Out-Null
+    Assert-Passes -RepoRoot $repo -Tag "v2026.6.15.0-beta" -Message "Rerunning the exact release tag should be allowed."
+
+    Write-Host "Release version sequence tests passed."
+}
+finally {
+    foreach ($tempRoot in $tempRoots) {
+        if (Test-Path -LiteralPath $tempRoot) {
+            Remove-Item -LiteralPath $tempRoot -Recurse -Force
+        }
+    }
+}

.github/workflows/release.yml

@@ -34,6 +34,7 @@ jobs:
         run: |
           ./.github/scripts/Test-WorkflowSyntax.ps1
           ./.github/scripts/Test-ResolveReleaseBaseTag.ps1
+          ./.github/scripts/Test-ReleaseVersionSequence.ps1
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -65,6 +66,10 @@ jobs:
           "is_pre=$($isPre.ToString().ToLower())" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
           Write-Host "tag=$tag version=$version is_pre=$isPre"
 
+      - name: Validate release version sequence
+        shell: pwsh
+        run: ./.github/scripts/Assert-ReleaseVersionSequence.ps1 -Tag '${{ steps.ver.outputs.tag }}'
+
       - name: Fetch picotool
         shell: pwsh
         run: |