build(release): v4 is a branch now, and the tag that pretended to be one is gone

A ref that moves should look like one. `v4` was a tag this repository
force-pushed onto every release, so `dAppCore/build@v4` meant different
code from one afternoon to the next while looking pinned — which is how
lthn/desktop asked for darwin:package, got it, and then got darwin:build
from the same unchanged line. It is a branch at the same name, so @v4
still resolves and now says what it does.

Version tags stay exactly as they are: cut once, never moved. Consumers
pin those. The manifests reach each other at @v4 so consuming the branch
runs the whole tree rather than a new root over frozen sub-actions, and
that is what our own repositories use — better it breaks for us.

v4-branch.yml fast-forwards the branch from main, and refuses if the two
have diverged rather than discarding anything. scripts/release.sh cuts a
tag on a detached commit with the internal references rewritten to that
version, leaving the branch alone.

Co-Authored-By: Virgil <virgil@lethean.io>

Author: Snider

.github/workflows/v4-branch.yml

@@ -0,0 +1,54 @@
+name: v4 branch
+
+# The manifests reach for each other at @v4, so that branch is what every job
+# using dAppCore/build@v4 actually runs — including this repository's own CI.
+# If it lagged main, a change would test green against the previous tree and the
+# sub-action edit in the same commit would simply not be there.
+#
+# A fast-forward, never a force. If v4 has somehow diverged from main this fails
+# and says so, rather than discarding whatever is on it.
+#
+# This moves a branch, which is what branches do. Release tags are cut by
+# scripts/release.sh and never moved by anything.
+
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: v4-branch
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    name: fast-forward v4 to main
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fast-forward
+        shell: bash
+        run: |
+          set -euo pipefail
+          MAIN="$(git rev-parse origin/main)"
+
+          if git rev-parse -q --verify origin/v4 >/dev/null; then
+            CURRENT="$(git rev-parse origin/v4)"
+            if [ "$CURRENT" = "$MAIN" ]; then
+              echo "[DEBUG_LOG] v4 already at $MAIN"
+              exit 0
+            fi
+            if ! git merge-base --is-ancestor "$CURRENT" "$MAIN"; then
+              echo "::error::v4 is at $CURRENT, which is not an ancestor of main — fast-forwarding would discard it"
+              exit 1
+            fi
+          fi
+
+          git push origin "$MAIN:refs/heads/v4"
+          echo "[DEBUG_LOG] v4 -> $MAIN"

README.md

@@ -18,22 +18,25 @@ a workflow artifact, and publishes a GitHub release when the ref is a tag.
 
 ## Versions
 
-Pin an exact release. There is no `@v4` that follows the newest v4 — a tag here
-points at one commit and is never moved onto another, so the build you tested is
-the build you keep getting. Upgrading is a line in your workflow, chosen by you.
+Pin an exact release: `@v4.16.0`. A tag here points at one commit and is never
+moved onto another, so the build you tested is the build you keep getting.
+Upgrading is a line in your workflow, chosen by you.
 
-`@main` is the development branch, and it is what dAppCore's own repositories
-use. Its manifests reach for each other at `@main` too, so consuming it exercises
-the whole tree rather than a new root over frozen sub-actions. It moves without
-warning and it is meant to — better that it breaks for us first.
+`@v4` is a branch — the major line's development head, and what dAppCore's own
+repositories use. Its manifests reach for each other at `@v4` too, so consuming
+it exercises the whole tree rather than a new root over frozen sub-actions. It
+moves without warning and it is meant to — better that it breaks for us first.
+
+It was a tag once, moved onto each release by CI. A ref that moves should look
+like one, so it is a branch now and `@v4` still resolves.
 
 ## Contents
 
 | | |
 | :-- | :-- |
 | [Quickstart](https://dappco.re/build/quickstart/) | The matrix build, build-only, and apps not at the repository root |
 | [How detection works](https://dappco.re/build/detection/) | What it reads, what it concludes, how to overrule it |
-| [Wails v3](https://dappco.re/build/stacks/wails3/) | Runs your Taskfile target — so CI takes the path you do |
+| [Wails v3](https://dappco.re/build/stacks/wails3/) | Runs `wails3 build` or `wails3 package` — so CI takes the path you do |
 | [Wails v2](https://dappco.re/build/stacks/wails2/) | Composes `wails build` flags from inputs |
 | [Go binaries](https://dappco.re/build/stacks/go/) | A module, a main package, a binary |
 | [C++](https://dappco.re/build/stacks/cpp/) | Conan 2 resolves, CMake builds |

action.yml

@@ -123,13 +123,13 @@ runs:
   steps:
     - name: Discovery
       id: discovery
-      uses: dAppCore/build/actions/discovery@main
+      uses: dAppCore/build/actions/discovery@v4
       with:
         working-directory: ${{ inputs.app-working-directory }}
 
     - name: Delegate to directory orchestrator
       id: dir_orch
-      uses: dAppCore/build/actions@main
+      uses: dAppCore/build/actions@v4
       with:
         build: ${{ inputs.build }}
         sign: ${{ inputs.sign }}

actions/README.md

@@ -21,4 +21,4 @@ Stacks under actions/build/
 Notes
 - In composite actions (inside this repo), reference other sub-actions via relative paths like `uses: ./actions/discovery`.
 - In workflows within this repo, reference local actions with `uses: ./actions/<name>` (or the repo root with `uses: ./`).
-- For consumers of this repo, use the fully qualified path, for example: `uses: dAppCore/build/actions/discovery@main`.
+- For consumers of this repo, use the fully qualified path, for example: `uses: dAppCore/build/actions/discovery@v4`.

actions/action.yml

@@ -151,7 +151,7 @@ runs:
     - name: Call Wails v2 wrapper
       id: w2
       if: steps.sel.outputs.SELECTED_STACK == 'wails2'
-      uses: dAppCore/build/actions/build/wails2@main
+      uses: dAppCore/build/actions/build/wails2@v4
       with:
         build: ${{ inputs.build }}
         sign: ${{ inputs.sign }}
@@ -168,7 +168,7 @@ runs:
     - name: Call Wails v3 wrapper
       id: w3
       if: steps.sel.outputs.SELECTED_STACK == 'wails3'
-      uses: dAppCore/build/actions/build/wails3@main
+      uses: dAppCore/build/actions/build/wails3@v4
       with:
         build: ${{ inputs.build }}
         sign: ${{ inputs.sign }}
@@ -185,7 +185,7 @@ runs:
     - name: Call Go wrapper
       id: go
       if: steps.sel.outputs.SELECTED_STACK == 'go'
-      uses: dAppCore/build/actions/build/go@main
+      uses: dAppCore/build/actions/build/go@v4
       with:
         build: ${{ inputs.build }}
         sign: ${{ inputs.sign }}
@@ -214,7 +214,7 @@ runs:
     - name: Call C++ wrapper
       id: cpp
       if: steps.sel.outputs.SELECTED_STACK == 'cpp'
-      uses: dAppCore/build/actions/build/cpp@main
+      uses: dAppCore/build/actions/build/cpp@v4
       with:
         build: ${{ inputs.build }}
         sign: ${{ inputs.sign }}
@@ -232,7 +232,7 @@ runs:
     - name: Call Node wrapper
       id: node
       if: steps.sel.outputs.SELECTED_STACK == 'node'
-      uses: dAppCore/build/actions/build/node@main
+      uses: dAppCore/build/actions/build/node@v4
       with:
         build: ${{ inputs.build }}
         package: ${{ inputs.package }}
@@ -243,7 +243,7 @@ runs:
     - name: Call Bun wrapper
       id: bun
       if: steps.sel.outputs.SELECTED_STACK == 'bun'
-      uses: dAppCore/build/actions/build/bun@main
+      uses: dAppCore/build/actions/build/bun@v4
       with:
         build: ${{ inputs.build }}
         package: ${{ inputs.package }}
@@ -254,7 +254,7 @@ runs:
     - name: Call Deno wrapper
       id: deno
       if: steps.sel.outputs.SELECTED_STACK == 'deno'
-      uses: dAppCore/build/actions/build/deno@main
+      uses: dAppCore/build/actions/build/deno@v4
       with:
         build: ${{ inputs.build }}
         sign: ${{ inputs.sign }}
@@ -275,7 +275,7 @@ runs:
     - name: Call Core Go wrapper
       id: core
       if: steps.sel.outputs.SELECTED_STACK == 'core'
-      uses: dAppCore/build/actions/build/core@main
+      uses: dAppCore/build/actions/build/core@v4
       with:
         app-working-directory: ${{ inputs.app-working-directory }}
         go-directory: ${{ inputs.go-directory }}

actions/build/README.md

@@ -19,7 +19,7 @@ Usage examples
   ```
 - From another repo:
   ```yaml
-  - uses: dAppCore/build/actions/build/wails2@main
+  - uses: dAppCore/build/actions/build/wails2@v4
     with:
       build-name: myApp
       build-platform: linux/amd64

actions/build/bun/action.yml

@@ -65,7 +65,7 @@ runs:
   steps:
     - name: Discovery
       id: discovery
-      uses: dAppCore/build/actions/discovery@main
+      uses: dAppCore/build/actions/discovery@v4
       with:
         working-directory: ${{ inputs.app-working-directory }}
 
@@ -76,7 +76,7 @@ runs:
 
     - name: Build
       id: build
-      uses: dAppCore/build/actions/build/bun/build@main
+      uses: dAppCore/build/actions/build/bun/build@v4
       with:
         build: ${{ inputs.build }}
         app-working-directory: ${{ inputs.app-working-directory }}
@@ -86,7 +86,7 @@ runs:
         install: ${{ inputs.install }}
 
     - name: Package & release
-      uses: dAppCore/build/actions/package@main
+      uses: dAppCore/build/actions/package@v4
       with:
         package: ${{ inputs.package }}
         build-name: ${{ inputs.build-name }}

actions/build/cpp/action.yml

@@ -61,18 +61,18 @@ runs:
   steps:
     - name: Discovery
       id: discovery
-      uses: dAppCore/build/actions/discovery@main
+      uses: dAppCore/build/actions/discovery@v4
       with:
         working-directory: ${{ inputs.app-working-directory }}
 
     - name: Setup Conan
-      uses: dAppCore/build/actions/setup/conan@main
+      uses: dAppCore/build/actions/setup/conan@v4
       with:
         version: ${{ inputs.conan-version }}
 
     - name: Build
       id: build
-      uses: dAppCore/build/actions/build/cpp/build@main
+      uses: dAppCore/build/actions/build/cpp/build@v4
       with:
         build: ${{ inputs.build }}
         app-working-directory: ${{ inputs.app-working-directory }}
@@ -82,14 +82,14 @@ runs:
         test: ${{ inputs.test }}
 
     - name: Sign artifacts (OS-conditional)
-      uses: dAppCore/build/actions/sign@main
+      uses: dAppCore/build/actions/sign@v4
       with:
         sign: ${{ inputs.sign }}
         app-working-directory: ${{ inputs.app-working-directory }}
         build-name: ${{ inputs.build-name }}
 
     - name: Package & release
-      uses: dAppCore/build/actions/package@main
+      uses: dAppCore/build/actions/package@v4
       with:
         package: ${{ inputs.package }}
         build-name: ${{ inputs.build-name }}

actions/build/deno/action.yml

@@ -84,7 +84,7 @@ runs:
   steps:
     - name: Discovery
       id: discovery
-      uses: dAppCore/build/actions/discovery@main
+      uses: dAppCore/build/actions/discovery@v4
       with:
         working-directory: ${{ inputs.app-working-directory }}
 
@@ -116,7 +116,7 @@ runs:
     - name: Danet
       id: danet
       if: steps.fw.outputs.FRAMEWORK == 'danet'
-      uses: dAppCore/build/actions/build/deno/framework/danet@main
+      uses: dAppCore/build/actions/build/deno/framework/danet@v4
       with:
         build: ${{ inputs.build }}
         app-working-directory: ${{ inputs.app-working-directory }}
@@ -131,7 +131,7 @@ runs:
     - name: Plain build
       id: plain
       if: steps.fw.outputs.FRAMEWORK == 'none'
-      uses: dAppCore/build/actions/build/deno/build@main
+      uses: dAppCore/build/actions/build/deno/build@v4
       with:
         build: ${{ inputs.build }}
         app-working-directory: ${{ inputs.app-working-directory }}
@@ -142,14 +142,14 @@ runs:
         output-directory: ${{ inputs.output-directory }}
 
     - name: Sign artifacts (OS-conditional)
-      uses: dAppCore/build/actions/sign@main
+      uses: dAppCore/build/actions/sign@v4
       with:
         sign: ${{ inputs.sign }}
         app-working-directory: ${{ inputs.app-working-directory }}
         build-name: ${{ inputs.build-name }}
 
     - name: Package & release
-      uses: dAppCore/build/actions/package@main
+      uses: dAppCore/build/actions/package@v4
       with:
         package: ${{ inputs.package }}
         build-name: ${{ inputs.build-name }}

actions/build/deno/framework/danet/action.yml

@@ -44,7 +44,7 @@ runs:
   steps:
     - name: Compile
       id: build
-      uses: dAppCore/build/actions/build/deno/build@main
+      uses: dAppCore/build/actions/build/deno/build@v4
       with:
         build: ${{ inputs.build }}
         app-working-directory: ${{ inputs.app-working-directory }}