From c2248eb9ba9d4e71f61a8b2a47db37dc69fc9535 Mon Sep 17 00:00:00 2001
From: Zoltan Kochan <z@kochan.io>
Date: Fri, 10 Jul 2026 16:52:23 +0200
Subject: [PATCH] ci: derive latest-<major> dist-tag from the version in the
 Tag workflow (#12911)

The Tag workflow hardcoded the latest-11 dist-tag (each release branch
carried its own hardcoded major), so dispatching it from the wrong branch
applied the wrong line's tag: tagging 10.34.5 from main pointed latest-11
at a v10 release (https://github.com/pnpm/pnpm/issues/12906).

Derive latest-<major> from the version input instead, and fail fast when
the requested tag names a different major than the version, or when a
plain 'latest' tag would move backwards to an older major.
---
 .github/workflows/update-latest.yml | 42 +++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/update-latest.yml b/.github/workflows/update-latest.yml
index b9c8b3c251..3f2bf36a0b 100644
--- a/.github/workflows/update-latest.yml
+++ b/.github/workflows/update-latest.yml
@@ -7,7 +7,7 @@ on:
         description: Version
         required: true
       tag:
-        description: Tag
+        description: Tag (use latest-<major> when tagging an older release line)
         default: latest
         required: true
 
@@ -23,16 +23,48 @@ jobs:
         api_token: ${{ secrets.GARNET_API_TOKEN }}
     - name: Setup Node
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+    # The latest-<major> tag is derived from the version instead of being
+    # hardcoded per release branch, so dispatching this workflow from the wrong
+    # branch cannot point a newer line's tag at an older release
+    # (https://github.com/pnpm/pnpm/issues/12906).
+    - name: Validate version and tag
+      env:
+        VERSION: ${{ github.event.inputs.version }}
+        TAG: ${{ github.event.inputs.tag }}
+      run: |
+        if ! printf '%s\n' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[.0-9A-Za-z-]+)?$'; then
+          echo "::error::Version must be an exact semver version like 11.2.0. Got: ${VERSION}"
+          exit 1
+        fi
+        MAJOR="${VERSION%%.*}"
+        case "$TAG" in
+          latest-*)
+            if [ "$TAG" != "latest-${MAJOR}" ]; then
+              echo "::error::Tag ${TAG} does not match the major version of ${VERSION}. Expected latest-${MAJOR}."
+              exit 1
+            fi
+            ;;
+          latest)
+            CURRENT_LATEST_MAJOR="$(npm view pnpm dist-tags.latest | cut -d . -f 1)"
+            if [ "$MAJOR" -lt "$CURRENT_LATEST_MAJOR" ]; then
+              echo "::error::Refusing to move the latest tag back from v${CURRENT_LATEST_MAJOR} to ${VERSION}. Use latest-${MAJOR} to tag an older release line."
+              exit 1
+            fi
+            ;;
+        esac
     - name: Update tag
       env:
         "npm_config_//registry.npmjs.org/:_authToken": ${{ secrets.NPM_TOKEN }}
         VERSION: ${{ github.event.inputs.version }}
         TAG: ${{ github.event.inputs.tag }}
       run: |
-        npm dist-tag add "pnpm@${VERSION}" latest-11
-        npm dist-tag add "pnpm@${VERSION}" "${TAG}"
-        npm dist-tag add "@pnpm/exe@${VERSION}" latest-11
-        npm dist-tag add "@pnpm/exe@${VERSION}" "${TAG}"
+        MAJOR="${VERSION%%.*}"
+        npm dist-tag add "pnpm@${VERSION}" "latest-${MAJOR}"
+        npm dist-tag add "@pnpm/exe@${VERSION}" "latest-${MAJOR}"
+        if [ "$TAG" != "latest-${MAJOR}" ]; then
+          npm dist-tag add "pnpm@${VERSION}" "${TAG}"
+          npm dist-tag add "@pnpm/exe@${VERSION}" "${TAG}"
+        fi
 
   publish-to-winget:
     runs-on: ubuntu-latest