release-scripts: refuse downgrades and short-circuit no-op runs

Both .github/release-homebrew.sh and .github/release-vfsforgit.sh are
meant to be run by hand by whoever promotes a microsoft/git
pre-release to a full release. That human is likely tired at the end
of a long release day, may paste the wrong tag, or may re-trigger the
promotion out of habit. Without a guard, either mistake silently
rewrites the downstream state and, in the VFSForGit case, opens a
bogus pull request on top.

Teach both scripts to look at the downstream's current state before
touching anything: the `version '...'` line in the microsoft-git
cask, and the `GIT_VERSION` default in VFSForGit's build workflow.
If the downstream is already at the target version, warn and exit
successfully so a duplicate run is a quiet no-op rather than
pointless churn. If the target is older than what the downstream
already has, refuse with an explicit "regression: refusing to
downgrade" error rather than clobbering it.

Version comparison uses `sort -V`, which orders our
`vX.Y.Z.vfs.N.M` tag shape correctly.

The check runs before any clone or push, and the only API call it
adds (`gh api ... contents/<file>` with the raw accept header) is
read-only, so a bug in the guard itself cannot damage the downstream.

The third release script, .github/release-winget.ps1, is
intentionally left untouched here; a follow-up commit ports it from
PowerShell to POSIX sh and adds the same guard along the way.

Assisted-by: Opus 4.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: dscho

.github/release-homebrew.sh

@@ -42,6 +42,28 @@ echo "==> Tag:       $TAG_NAME"
 version=${TAG_NAME#v}
 echo "==> Version:   $version"
 
+# Refuse to downgrade the cask and short-circuit no-op runs. Look up
+# the version currently in the tap and compare before fetching the
+# release JSON or cloning.
+current_content=$(gh api \
+	repos/microsoft/homebrew-git/contents/Casks/microsoft-git.rb \
+	-H "Accept: application/vnd.github.raw")
+current_version=$(printf '%s\n' "$current_content" | sed -nE \
+	"s/^[[:space:]]*version *['\"]([^'\"]*)['\"].*/\\1/p")
+test -n "$current_version" || die "could not parse current cask version"
+echo "==> Current:   $current_version"
+
+if [ "$version" = "$current_version" ]; then
+	echo "warning: cask is already at $version; nothing to do." >&2
+	exit 0
+fi
+lowest=$(printf '%s\n%s\n' "$version" "$current_version" |
+	sort -V | sed 1q)
+if [ "$lowest" = "$version" ]; then
+	die "regression: cask is at $current_version," \
+		"refusing to downgrade to $version"
+fi
+
 echo "==> Fetching release metadata"
 release_json=$(gh api \
 	-H "Accept: application/vnd.github+json" \

.github/release-vfsforgit.sh

@@ -39,6 +39,27 @@ BRANCH="automation/gitrelease-$TAG_NAME"
 FILE=.github/workflows/build.yaml
 RELEASE_URL="https://github.com/microsoft/git/releases/tag/$TAG_NAME"
 
+# Refuse to downgrade and short-circuit no-op runs. Read the current
+# GIT_VERSION default straight from build.yaml on the VFSForGit
+# default branch before cloning anything.
+current_content=$(gh api "repos/$REPO/contents/$FILE" \
+	-H "Accept: application/vnd.github.raw")
+current_tag=$(printf '%s\n' "$current_content" | sed -nE \
+	"/GIT_VERSION/s/.*\\|\\| *'([^']*)' *\\}\\}.*/\\1/p")
+test -n "$current_tag" || die "could not parse current GIT_VERSION"
+echo "==> Current:   $current_tag"
+
+if [ "$TAG_NAME" = "$current_tag" ]; then
+	echo "warning: GIT_VERSION is already $TAG_NAME; nothing to do." >&2
+	exit 0
+fi
+lowest=$(printf '%s\n%s\n' "$TAG_NAME" "$current_tag" |
+	sort -V | sed 1q)
+if [ "$lowest" = "$TAG_NAME" ]; then
+	die "regression: GIT_VERSION is $current_tag," \
+		"refusing to downgrade to $TAG_NAME"
+fi
+
 workdir=$(mktemp -d)
 trap 'rm -rf "$workdir"' EXIT
 

.github/release-winget.sh

@@ -62,6 +62,32 @@ echo "==> Tag:       $TAG_NAME"
 version=$(printf '%s' "${TAG_NAME#v}" | sed 's/vfs\.//')
 echo "==> Version:   $version"
 
+echo "==> Downloading wingetcreate"
+test -x wingetcreate.exe || {
+	curl -fsSL https://aka.ms/wingetcreate/latest -o wingetcreate.exe &&
+	chmod +x wingetcreate.exe
+} || die "Could not initialize wingetcreate.exe"
+
+# Refuse to downgrade the package and short-circuit no-op runs. Look up
+# the version currently in the manifest and compare before trying to
+# update.
+info="$(./wingetcreate.exe show Microsoft.Git)"
+current_version=${info##*PackageVersion: }
+current_version=${current_version%%[!0-9.]*}
+test -n "$current_version" || die "could not parse current package version"
+echo "==> Current:   $current_version"
+
+if [ "$version" = "$current_version" ]; then
+	echo "warning: package is already at $version; nothing to do." >&2
+	exit 0
+fi
+lowest=$(printf '%s\n%s\n' "$version" "$current_version" |
+	sort -V | sed 1q)
+if [ "$lowest" = "$version" ]; then
+	die "regression: package is at $current_version," \
+		"refusing to downgrade to $version"
+fi
+
 echo "==> Fetching release metadata"
 release_json=$(gh api \
 	-H "Accept: application/vnd.github+json" \
@@ -104,12 +130,6 @@ trap cleanup EXIT
 cd "$workdir"
 echo "==> Working in $workdir"
 
-echo "==> Downloading wingetcreate"
-test -x wingetcreate.exe || {
-	curl -fsSL https://aka.ms/wingetcreate/latest -o wingetcreate.exe &&
-	chmod +x wingetcreate.exe
-} || die "Could not initialize wingetcreate.exe"
-
 # wingetcreate reads its GitHub token from this env var; hand it the
 # operator's own gh session token so no PAT needs to be stashed.
 WINGET_CREATE_GITHUB_TOKEN=$(gh auth token)