From 4ce163da9bca4d0a7052aa1fb65795ad62836b04 Mon Sep 17 00:00:00 2001
From: Alan Tse <alandtse@gmail.com>
Date: Wed, 3 Jun 2026 01:41:03 -0700
Subject: [PATCH] ci: roll dev-latest tag to dev-HEAD on each publish
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rolling dev-latest prerelease froze its tag at the commit where this
workflow first published: ncipollo/release-action honors `commit:` only
when it creates a tag, not on allowUpdates updates. So the tag, the release
"target" commit, and `git checkout dev-latest` source all stuck days behind
dev while only the body and .7z asset advanced — the release looked dead
even though nightly builds ran fine.

Force-move the ref to github.sha before the ncipollo publish so the rolling
release tracks dev-HEAD. Scoped to release-dev only; the shared
publish-release action keeps semver release tags immutable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release-dev.yaml | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-dev.yaml b/.github/workflows/release-dev.yaml
index eec1e4e737..056e124853 100644
--- a/.github/workflows/release-dev.yaml
+++ b/.github/workflows/release-dev.yaml
@@ -162,6 +162,23 @@ jobs:
                   } > "${FILE}"
                   echo "body-file=${FILE}" >> "$GITHUB_OUTPUT"
 
+            # Force-roll the rolling tag to the built commit BEFORE publishing.
+            # ncipollo honors `commit:` only when it *creates* a tag — on an
+            # update (allowUpdates) it leaves an existing tag pinned to its
+            # original commit. Without this, dev-latest froze at the commit where
+            # this workflow first published (the tag, release "target", and
+            # checkout source all stuck days behind dev while only the body/asset
+            # advanced). Move the ref ourselves so the release tracks dev-HEAD.
+            - name: Roll dev-latest tag to the built commit
+              env:
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+              run: |
+                  set -euo pipefail
+                  ref="repos/${{ github.repository }}/git/refs/tags/dev-latest"
+                  gh api -X PATCH "$ref" -f sha="${{ github.sha }}" -F force=true \
+                    || gh api -X POST "repos/${{ github.repository }}/git/refs" \
+                         -f ref="refs/tags/dev-latest" -f sha="${{ github.sha }}"
+
             - name: Refresh dev-latest prerelease
               uses: ./.github/actions/publish-release
               with:
@@ -169,7 +186,8 @@ jobs:
                   token: ${{ secrets.GITHUB_TOKEN }}
                   # Non-semver tag: dodges maint-cleanup and the dev branch name.
                   tag: dev-latest
-                  # Point the rolling tag at the built commit (matches the body).
+                  # First-publish only (ncipollo ignores this on update); the
+                  # Roll step above keeps the existing tag tracking dev-HEAD.
                   commit: ${{ github.sha }}
                   name: "Open Shaders (dev) — latest build ${{ needs.build.outputs.version }}"
                   prerelease: "true"