fix(release): use ordered SemVer tags so mise detects the latest version

.github/workflows/golang.yaml

@@ -8,11 +8,11 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: setup-go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.22'
+          go-version: '1.24'
           cache: true
           cache-dependency-path: go.sum
       - name: build
@@ -27,18 +27,18 @@ jobs:
       pull-requests: read # allows the 'only-new-issues' option to work
       checks: write # annotate code in the PR
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: setup-go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.22'
+          go-version: '1.24'
           cache: true
           cache-dependency-path: go.sum
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v7.0.0
+        uses: golangci/golangci-lint-action@v9
         with:
           install-mode: "binary"
-          version: "v2.0.2" # matches `golangci-lint --version` in nix devshell
+          version: "v2.1.6"
           # the default behavior as of v7.0.0:
           verify: true
       - name: go mod tidy

.github/workflows/nix.yaml

@@ -8,15 +8,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - name: Install Nix
-      uses: cachix/install-nix-action@v22
+      uses: cachix/install-nix-action@v31
       with:
         nix_path: nixpkgs=channel:nixos-unstable
         extra_nix_config: |
           access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
     - name: Install Cache
-      uses: DeterminateSystems/magic-nix-cache-action@v4
+      uses: DeterminateSystems/magic-nix-cache-action@v15
     - run: nix flake check
     # confirms that the shell works, and that there are no linting errors
     - name: lint formatting

.github/workflows/release.yaml

@@ -12,11 +12,13 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
     - name: setup-go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v7
       with:
-        go-version: '1.22'
+        go-version: '1.24'
         cache: true
         cache-dependency-path: go.sum
     - name: release-darwin-amd64

VERSION

@@ -1 +1 @@
-v3.0.0
+v3.0.1

scripts/golang-ldflags.sh

@@ -14,7 +14,17 @@
 VERSION=$1
 COMMIT=$2
 if [ -z "$VERSION" ]; then
-  VERSION=$(cat ./VERSION)
+  base_version=$(tr -d '[:space:]' < ./VERSION)
+  version_commit=$(git log -n 1 --pretty=format:%H -- ./VERSION 2>/dev/null || true)
+  if [ -n "$version_commit" ]; then
+    commits_since=$(git rev-list --count "${version_commit}..HEAD")
+  else
+    commits_since=0
+  fi
+  major_minor="${base_version%.*}"
+  base_patch="${base_version##*.}"
+  patch=$((base_patch + commits_since))
+  VERSION="${major_minor}.${patch}"
 fi
 if [ -z "$COMMIT" ]; then
   COMMIT="$(git rev-parse --short HEAD || echo '<dev>')"

scripts/upsert-gh-release.sh

@@ -8,15 +8,27 @@
 # Docs:
 #   https://docs.github.com/en/rest/releases/releases#create-a-release
 #   https://stackoverflow.com/questions/45240336/how-to-use-github-release-api-to-make-a-release-without-source-code
-version=$(cat ./VERSION)
-commit_sha=$(git rev-parse --short HEAD || echo 'unknown')
-# https://semver.org/#spec-item-10
-release_name="$version+commit.$commit_sha"
+# Read base version from ./VERSION (e.g. v3.0.1) and count commits since ./VERSION
+# was last modified to increment the patch between VERSION edits.
+base_version=$(tr -d '[:space:]' < ./VERSION)
+version_commit=$(git log -n 1 --pretty=format:%H -- ./VERSION 2>/dev/null || true)
+if [ -n "$version_commit" ]; then
+  commits_since=$(git rev-list --count "${version_commit}..HEAD")
+else
+  commits_since=0
+fi
+# Split "v3.0.1" into "v3.0" (%.*) and "1" (##*.), then offset patch by commit count
+major_minor="${base_version%.*}"
+base_patch="${base_version##*.}"
+patch=$((base_patch + commits_since))
+
+commit_sha=$(git rev-parse --verify HEAD) || exit 1
+release_name="${major_minor}.${patch}"
 if ! upload_url=$(
   gh api --method POST 'repos/{owner}/{repo}/releases' \
     -F "tag_name=$release_name" \
     -F "name=$release_name" \
-    -F "target_comitish=$commit_sha" \
+    -F "target_commitish=$commit_sha" \
     --jq '.upload_url' \
 ); then 
   if ! upload_url=$(
@@ -26,6 +38,24 @@ if ! upload_url=$(
     exit 1
   fi
 fi
+
+# Creating a release can also succeed for an existing tag. Resolve the remote
+# tag (including annotated tags) before returning any upload URL, so a VERSION
+# edit or a concurrent release cannot cause uploads to another commit's release.
+if ! tag_commit=$(
+  gh api --method GET 'repos/{owner}/{repo}/commits/refs/tags/'"$release_name" \
+    --jq '.sha' \
+); then
+  exit 1
+fi
+
+# The release tag must point to the commit we're building; otherwise we'd
+# upload this commit's binaries to an older commit's release.
+if [ "$tag_commit" != "$commit_sha" ]; then
+  echo "Release tag $release_name points to $tag_commit, not $commit_sha. Increase VERSION to an unused version." >&2
+  exit 1
+fi
+
 # the upload url looks like
 #   https://uploads.github.com/.../<release_id>/assets{?name,label}
 # this trick strips off the {?name,label}