From 39de20049caac6d6956da4881cd64a655b70b6f3 Mon Sep 17 00:00:00 2001
From: Patrick Schaper <patrick.schaper@aoe.com>
Date: Tue, 27 Oct 2026 16:18:30 +0100
Subject: [PATCH] fix: select the highest release version tag

- sort release tags numerically instead of using the nearest reachable tag
- cover squash-merge history and numeric ordering with an isolated Git fixture
---
 .github/workflows/release.yml           |  6 ++----
 Tests/Homebrew/release_metadata_test.py | 24 ++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44d21d3..ef7a364 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -75,10 +75,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Use the latest git tag as the source of truth so the bump is
-          # always based on the actual last release, even if the VERSION file
-          # is stale (e.g. a back-merge PR was never merged).
-          current_version="$(git describe --tags --abbrev=0 2>/dev/null | tr -d '[:space:]')"
+          # Squash merges can leave an older tag nearer than the latest release.
+          current_version="$(git for-each-ref --sort=-version:refname --count=1 --format='%(refname:short)' refs/tags)"
           if [[ -z "${current_version}" ]]; then
             current_version="$(tr -d '[:space:]' < VERSION)"
           fi
diff --git a/Tests/Homebrew/release_metadata_test.py b/Tests/Homebrew/release_metadata_test.py
index 503057d..5faeb24 100644
--- a/Tests/Homebrew/release_metadata_test.py
+++ b/Tests/Homebrew/release_metadata_test.py
@@ -165,6 +165,30 @@ def test_release_workflow_builds_and_stages_both_bundles(self):
                         prepare.index("./build.sh\n"))
         self.assertIn('ditto "build/MatrixWallpaper.app" "${release_dir}/MatrixWallpaper.app"', publish)
 
+    def test_release_uses_highest_version_tag_not_nearest(self):
+        repository = self.root / "repository"
+        repository.mkdir()
+
+        def git(*args):
+            return subprocess.run(["git", "-c", "user.name=Test", "-c", "user.email=test@example.invalid",
+                                   "-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false",
+                                   "-c", "core.hooksPath=/dev/null", *args], cwd=repository,
+                                  check=True, capture_output=True, text=True)
+
+        git("init", "--quiet")
+        git("commit", "--allow-empty", "-m", "older release commit")
+        git("tag", "0.4.0")
+        git("tag", "0.10.0")
+        git("commit", "--allow-empty", "-m", "nearer older version tag")
+        git("tag", "0.3.0")
+        workflow = (ROOT / ".github/workflows/release.yml").read_text()
+        assignment = next(line.strip() for line in workflow.splitlines()
+                          if line.strip().startswith('current_version="$('))
+        result = subprocess.run(["bash", "-euo", "pipefail", "-c",
+                                 assignment + '\nprintf "%s" "$current_version"'],
+                                cwd=repository, check=True, capture_output=True, text=True)
+        self.assertEqual("0.10.0", result.stdout)
+
     def test_fetch_consumes_existing_asset_and_missing_asset_fails(self):
         from unittest.mock import Mock, call, patch
         spec = importlib.util.spec_from_file_location("render_release", SCRIPT)