From d1a3ce1ba1be756433cbf8c6e055f3619d1ffbf7 Mon Sep 17 00:00:00 2001
From: JOY <joy@dos.ai>
Date: Sun, 24 May 2026 00:08:47 +0700
Subject: [PATCH 1/2] fix(ci): sync-upstream prefers stable releases over
 prereleases

Consistency with the frontend fix: select the newest STABLE release
(no -alpha/-beta/-rc suffix), falling back to the newest non-alpha
prerelease only when no stable exists. The backend currently only has
stable tags so behavior is unchanged (still v11.0.3), but this hardens
the selection against any future prerelease tags upstream might publish.
---
 .github/workflows/sync-upstream.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index 2baa0bbe4879..733ba8807d10 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -39,8 +39,13 @@ jobs:
           if [ -n "${{ inputs.tag }}" ]; then
             TAG="${{ inputs.tag }}"
           else
-            # Get latest release tag from upstream (filter only vX.Y.Z pattern)
-            TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -1)
+            # Prefer the newest STABLE release (no -alpha/-beta/-rc suffix).
+            # Fall back to the newest non-alpha prerelease (beta/rc) only when no
+            # stable release exists. Never auto-sync -alpha tags.
+            TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | grep -vE -- '-' | head -1)
+            if [ -z "$TAG" ]; then
+              TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | grep -ivE -- '-alpha' | head -1)
+            fi
           fi
           echo "tag=$TAG" >> $GITHUB_OUTPUT
           echo "Target tag: $TAG"

From e46f2c0a138a122e5b304f5ef8d1ade74c728f7b Mon Sep 17 00:00:00 2001
From: JOY <joy@dos.ai>
Date: Sun, 24 May 2026 00:10:58 +0700
Subject: [PATCH 2/2] harden: abort sync if no upstream tag matched (empty TAG
 guard)

---
 .github/workflows/sync-upstream.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index 733ba8807d10..f4b4d1756f5b 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -47,6 +47,12 @@ jobs:
               TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | grep -ivE -- '-alpha' | head -1)
             fi
           fi
+
+          if [ -z "$TAG" ]; then
+            echo "::error::No upstream release tag matched 'v[0-9]*.[0-9]*.[0-9]*'. Aborting."
+            exit 1
+          fi
+
           echo "tag=$TAG" >> $GITHUB_OUTPUT
           echo "Target tag: $TAG"