Project
cortex
Description
In the "Update manifest" step of publish-r2.yml:264, the workflow uses jq's unique | reverse to maintain the all_versions array in the R2 release manifest. However, jq's unique sorts strings alphabetically (lexicographic), not by semantic version. This produces incorrect version ordering for any project that reaches double-digit minor or patch versions.
Error Message
No error — silent data corruption in manifest.json served from Cloudflare R2.
Debug Logs
# jq's unique sorts strings lexicographically:
$ echo '["0.2.0","0.10.0","0.1.0"]' | jq 'unique | reverse'
[
"0.2.0",
"0.10.0",
"0.1.0"
]
# Expected semver order:
# ["0.10.0", "0.2.0", "0.1.0"]
System Information
File: .github/workflows/publish-r2.yml, line 264
Component: R2 release manifest generation (Cloudflare R2 CDN)
jq string sorting: lexicographic comparison, character-by-character
Screenshots
No response
Steps to Reproduce
Publish version 0.1.0 via the workflow → all_versions: ["0.1.0"]
Publish version 0.2.0 → all_versions: ["0.2.0", "0.1.0"] (correct so far)
Publish version 0.10.0 → all_versions: ["0.2.0", "0.10.0", "0.1.0"]
At step 3, "0.10.0" sorts between "0.1..." and "0.2..." because jq compares character-by-character: '1' < '2', so "0.10.0" < "0.2.0".
Expected Behavior
all_versions should be ordered by descending semantic version: ["0.10.0", "0.2.0", "0.1.0"]. Consumers of the manifest (e.g., update checkers, download pages, CLI self-update) that read all_versions[0] as the latest version would get 0.10.0.
Actual Behavior
all_versions is ordered lexicographically descending: ["0.2.0", "0.10.0", "0.1.0"]. Any consumer reading all_versions[0] as "latest" gets 0.2.0 instead of 0.10.0, potentially downgrading users or showing stale versions.
Additional Context
The problematic jq expression at line 264:
.all_versions = ([$version] + (.all_versions // []) | unique | reverse)
jq has no built-in semver sort. unique uses default string comparison, and reverse just flips the alphabetical order. This affects all multi-digit version components — e.g., 1.0.0 vs 0.9.0 works correctly (different first character), but 0.9.0 vs 0.10.0 fails ("0.9" > "0.1" lexicographically). A fix would require splitting on ., converting to numbers, and sorting by each component, or using an external tool like sort -V.
Project
cortex
Description
In the "Update manifest" step of publish-r2.yml:264, the workflow uses jq's unique | reverse to maintain the all_versions array in the R2 release manifest. However, jq's unique sorts strings alphabetically (lexicographic), not by semantic version. This produces incorrect version ordering for any project that reaches double-digit minor or patch versions.
Error Message
No error — silent data corruption in manifest.json served from Cloudflare R2.Debug Logs
System Information
Screenshots
No response
Steps to Reproduce
Publish version 0.1.0 via the workflow → all_versions: ["0.1.0"]
Publish version 0.2.0 → all_versions: ["0.2.0", "0.1.0"] (correct so far)
Publish version 0.10.0 → all_versions: ["0.2.0", "0.10.0", "0.1.0"]
At step 3, "0.10.0" sorts between "0.1..." and "0.2..." because jq compares character-by-character: '1' < '2', so "0.10.0" < "0.2.0".
Expected Behavior
all_versions should be ordered by descending semantic version: ["0.10.0", "0.2.0", "0.1.0"]. Consumers of the manifest (e.g., update checkers, download pages, CLI self-update) that read all_versions[0] as the latest version would get 0.10.0.
Actual Behavior
all_versions is ordered lexicographically descending: ["0.2.0", "0.10.0", "0.1.0"]. Any consumer reading all_versions[0] as "latest" gets 0.2.0 instead of 0.10.0, potentially downgrading users or showing stale versions.
Additional Context
The problematic jq expression at line 264:
.all_versions = ([$version] + (.all_versions // []) | unique | reverse)
jq has no built-in semver sort. unique uses default string comparison, and reverse just flips the alphabetical order. This affects all multi-digit version components — e.g., 1.0.0 vs 0.9.0 works correctly (different first character), but 0.9.0 vs 0.10.0 fails ("0.9" > "0.1" lexicographically). A fix would require splitting on ., converting to numbers, and sorting by each component, or using an external tool like sort -V.