fix(release): check auto-release ordering with the shared SemVer guard

[BunsDev]

Summary

Auto-release's forward-only check now uses the same SemVer guard as manual releases. Before, it compared local tags with sort -V, which is not SemVer precedence for prereleases. Manual releases have used #200's preflight against origin tags since that PR merged.

Context

• Related request: code-surface audit, unit 63 ("Unit63 shares a SemVer forward-release guard across manual and automatic release preflights" in the surface status). Source surface-release-forward (fix/release-forward-guard).
• The unit was first deferred, because its own scripts/check-release-version.py collides with fix(ci): block on the reverse engine contract and preflight release versions #200's accepted preflight at the same path. fix(ci): block on the reverse engine contract and preflight release versions #200's script also verifies the version stamps, which auto-release only writes after its forward-only step, so calling it there unchanged would always fail. This PR reconciles the two instead of replacing either.
• Already on main from fix(ci): block on the reverse engine contract and preflight release versions #200, so not repeated here:
  • the manual release preflight;
  • the pre-publication recheck;
  • one concurrency group serializing every release.
• Scope: scripts/check-release-version.py, scripts/test-release-version.py, .github/workflows/auto-release.yml, and the new .github/workflows/release-version-tests.yml.
• Non-goals: no change to the manual release path, version stamping, or marker parsing (fix(release): parse auto-release markers as whole tokens #300).

Changes

• check-release-version.py gains --forward-only. It checks only SemVer precedence against git ls-remote --tags origin and skips stamp verification. check_release now calls a shared check_forward, so both modes order versions identically. Without the flag, behavior is unchanged.
• Auto-release's "Forward-only check" step runs check-release-version.py --forward-only "$RELEASE_VERSION" instead of the sort -V shell block. An equal, existing or lower version fails, and so does a remote read error. Stamps are still verified afterwards by the dispatched release.yml preflight and its pre-publication recheck.
• Unit 63's ordering cases move into a ForwardOnly test class. The CLI tests show --forward-only accepts a candidate on an unstamped checkout while the full preflight rejects it.
• Behavior choice (kept from main): a malformed version-shaped tag such as v1.0 or v9.0.0-01 fails closed, as in fix(ci): block on the reverse engine contract and preflight release versions #200. Unit 63's own script ignored those tags. This keeps the stricter accepted contract rather than loosening it.
• release-version-tests.yml, unit 63's lightweight workflow, runs these tests on PRs touching the release scripts or either release workflow. Rust CI's existing run of the same tests only triggers on its own path list, which doesn't include auto-release.yml.

Validation

• RED: on main there is no --forward-only, so the CLI forward-only tests fail there. The auto-release step it replaces ranks v1.0.0-rc.1 above v1.0.0 under sort -V.
• python3 -B scripts/test-release-version.py -v on this branch: 17 passed (fix(ci): block on the reverse engine contract and preflight release versions #200's 11 plus 6 forward-only).
• python3 -B scripts/test_release_markers.py: 5 passed, so the auto-release marker steps still parse. python3 -B scripts/test_bump_version.py: 4 passed.
• actionlint on auto-release.yml, release.yml and release-version-tests.yml: clean apart from the existing SC2016.
• git diff --check: clean.
• Accepted source: unit 63's ordering tests were independently reviewed. Its 8 local-origin tests are carried over with the same cases.

PR Readiness

• Diff is limited to the release guard, its tests and the two workflows.
• Generated files were not edited by hand.
• User-facing docs: not needed. Release maintainers see the guard's error text in the workflow log.
• No secrets, credentials, local paths, or unrelated logs are included. The tests mock git ls-remote and make no network calls.
• Remaining risks: hosted execution of auto-release is unverified, since it only acts for the release bot. The new step needs python3 3.11 or later (for tomllib), which ubuntu-latest provides.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 15, 2026 4:43pm UTC