fix: allow prereleases to publish directly to latest

[ytallo]

Summary

• allow experimental, alpha, and beta releases to publish directly to latest when the worker catalog enables allow_direct_latest
• apply the same policy in create-tag validation and release repair
• preserve next as the default for workers that do not opt in and retain exact supported release-version validation

Prerelease candidate promotion is handled separately in the follow-up PR from fix/allow-prerelease-promotion.

Validation

• release script tests
• actionlint on all workflows
• benchmark site tests
• Python compile checks for the changed release scripts
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workers	Ready	Preview	Aug 7, 2026 2:13pm
workers-tech-spec	Ready	Preview	Aug 7, 2026 2:13pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bcddccbe-924e-4644-bb6a-b03f4dac6827

📥 Commits

Reviewing files that changed from the base of the PR and between 2a8b34f and 86b97cd.

📒 Files selected for processing (5)

• .github/scripts/parse_release_tag.py
• .github/scripts/tests/test_parse_release_tag.py
• .github/workflows/create-tag.yml
• .github/workflows/repair-worker-release.yml
• docs/sops/release.md

---

📝 Walkthrough

Walkthrough

The release system now permits experimental, alpha, and beta versions to publish directly to latest when the worker allows it. Tag creation, repair validation, tests, and release documentation reflect the updated channel rules.

Changes

Release channel policy

Layer / File(s)	Summary
Direct latest authorization tests .github/scripts/parse_release_tag.py, .github/scripts/tests/test_parse_release_tag.py	Worker setup now controls direct latest permission. Tests cover permitted experimental, alpha, and beta releases, plus permission denial.
Workflow channel validation .github/workflows/create-tag.yml, .github/workflows/repair-worker-release.yml	Prerelease releases no longer require next. Repair validation accepts next or latest, while candidate-smoke remains restricted to next.
Release channel rules docs/sops/release.md	Documentation now describes permitted direct latest publication and existing Harness and candidate-validation gates.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• iii-hq/workers#615: Modifies prerelease registry-channel validation and related tests.
• iii-hq/workers#643: Changes prerelease publishing behavior across workflows and documentation.
• iii-hq/workers#719: Updates prerelease channel validation, tests, and documentation.

Suggested reviewers: andersonleal

Poem

I’m a rabbit with tags in a row,
Sending prereleases where they may go.
next still guides the test,
latest works when blessed,
And the release docs now know.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/allow-prerelease-latest

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

skill-check — worker

0 verified, 56 skipped (no docs/).

Layer	Result
structure	✓
vale	✓
ai	✓
render	✓

Four for four. Nicely done.