From 175c52b0a76f8e719a95d34a45f8bfa82b275617 Mon Sep 17 00:00:00 2001
From: hervee <hervee@jfrog.com>
Date: Thu, 20 Aug 2026 10:21:14 +0200
Subject: [PATCH 1/2] WKS-2687 - Compute publish-api release version from git
 tags, not main's package.json

---
 .github/workflows/publish-api.yml | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-api.yml b/.github/workflows/publish-api.yml
index 2692838..3678a6a 100644
--- a/.github/workflows/publish-api.yml
+++ b/.github/workflows/publish-api.yml
@@ -20,9 +20,32 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Bump minor version
+      # The version committed in api/package.json on `main` is only a placeholder — it can go
+      # stale if a prior run's "Merge to main" step fails after already publishing (as happened
+      # before this fix: a publish succeeded but its merge-back never landed, so `main` kept
+      # showing an old version and the next run's collision check silently skipped a real
+      # release). Git tags are the source of truth for what has actually been published, so the
+      # next version is always computed from the latest `jfrog-workers/*` tag on the remote —
+      # never from whatever happens to be committed on `main`.
+      - name: Compute next version from latest release tag
         working-directory: ./api
-        run: npm version minor --no-git-tag-version
+        run: |
+          LATEST=$(git ls-remote --tags origin 'refs/tags/jfrog-workers/*' \
+            | awk '{print $2}' \
+            | sed 's#^refs/tags/jfrog-workers/##' \
+            | grep -v '\^{}$' \
+            | sort -t. -k1,1n -k2,2n -k3,3n \
+            | tail -1)
+          if [ -z "$LATEST" ]; then
+            echo "No jfrog-workers/* tag found on origin; falling back to the version committed in api/package.json"
+            LATEST=$(jq -r '.version' package.json)
+          fi
+          echo "Latest released version: $LATEST"
+          MAJOR=$(echo "$LATEST" | cut -d. -f1)
+          MINOR=$(echo "$LATEST" | cut -d. -f2)
+          NEXT_VERSION="${MAJOR}.$((MINOR + 1)).0"
+          echo "Computed next version: $NEXT_VERSION"
+          npm version "$NEXT_VERSION" --no-git-tag-version --allow-same-version
 
       - name: Read version
         id: version

From cf2d4cded32675b748091eedf1e205d36106db44 Mon Sep 17 00:00:00 2001
From: hervee <hervee@jfrog.com>
Date: Thu, 20 Aug 2026 10:25:48 +0200
Subject: [PATCH 2/2] WKS-2687 - Harden publish-api version-compute step
 against silent pipeline failures

---
 .github/workflows/publish-api.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-api.yml b/.github/workflows/publish-api.yml
index 3678a6a..b6bf6d9 100644
--- a/.github/workflows/publish-api.yml
+++ b/.github/workflows/publish-api.yml
@@ -30,10 +30,11 @@ jobs:
       - name: Compute next version from latest release tag
         working-directory: ./api
         run: |
+          set -euo pipefail
           LATEST=$(git ls-remote --tags origin 'refs/tags/jfrog-workers/*' \
             | awk '{print $2}' \
             | sed 's#^refs/tags/jfrog-workers/##' \
-            | grep -v '\^{}$' \
+            | { grep -v '\^{}$' || true; } \
             | sort -t. -k1,1n -k2,2n -k3,3n \
             | tail -1)
           if [ -z "$LATEST" ]; then