From f55f2ebf93c9938df57c870d67a81da4c50b45e7 Mon Sep 17 00:00:00 2001
From: yaroslavmokflmg <yaroslav@flamingo.cx>
Date: Wed, 8 Jul 2026 15:51:01 -0400
Subject: [PATCH 1/3] ci(release): guard helm chart tag against non-semver
 mutable tag

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 640afbdf01..c096f35998 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -144,7 +144,7 @@ jobs:
         with:
           name: meshcentral
           repository: ${{ github.repository }}/helm-charts
-          tag: ${{ needs.version.outputs.version }}
+          tag: ${{ needs.version.outputs.version == 'latest' && '9.9.9' || needs.version.outputs.version }}
           path: ./charts/meshcentral
           registry: ${{ env.REGISTRY }}
           registry_username: ${{ github.actor }}

From 77509fb685b9c9b83a4428d4c592f66ebdb10b89 Mon Sep 17 00:00:00 2001
From: yaroslavmokflmg <yaroslav@flamingo.cx>
Date: Wed, 8 Jul 2026 19:17:08 -0400
Subject: [PATCH 2/3] ci(release): resolve latest via releases/latest API, fail
 on non-semver

---
 .github/workflows/version.yml | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 37f882e6b5..e45591fa6d 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -37,11 +37,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Releases, not git tags: upstream's inherited bare tags and the 9.9.x sentinel outrank the real line under sort -V
-          latest=$(gh release list --limit 100 --exclude-drafts --exclude-pre-releases \
-            --json tagName --jq '.[].tagName' \
-            | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | grep -v '^9\.9\.' | sort -V | tail -1 || true)
-          latest=${latest:-0.0.0}
+          latest=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)
+          [[ "$latest" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Latest release tag '${latest}' is not x.y.z"; exit 1; }
           IFS='.' read -r cur_major cur_minor cur_patch <<< "$latest"
 
           if [ -z "$INPUT_VERSION" ]; then

From 4e241e2a15df41e72e86b859f7ae955bc9039643 Mon Sep 17 00:00:00 2001
From: yaroslavmokflmg <yaroslav@flamingo.cx>
Date: Wed, 8 Jul 2026 19:46:59 -0400
Subject: [PATCH 3/3] ci(release): restore release job on partial builds,
 resolve latest via releases/latest API

---
 .github/workflows/release.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c096f35998..a160202e90 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -154,6 +154,7 @@ jobs:
   release:
     name: "Create Release"
     needs: [version, build, build_helm]
+    if: ${{ !failure() && !cancelled() }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout