Keep nightly versions ahead of published stable releases

[zortos293]

Correction

Set the authoritative Qt project base to 1.0.2. With stable v1.0.1 already published, both 1.0.0-nightly.620.1 and 1.0.1-nightly.620.1 compare below that stable version. The corrected generator produces 1.0.2-nightly.620.1.

Require a nightly base strictly greater than the highest numeric SemVer published stable. Fetch release metadata at publish-request preflight and again after draft asset upload, immediately before making the draft public. Missing or malformed metadata fails closed. Drafts, prereleases, and non-SemVer historical tags do not set the stable base; valid build metadata does not change precedence. With no published stable, a correctly formed nightly identity is still required.

The six-file change preserves source-ref pinning, update-key requirements, signing policy, immutable artifact verification, and the stable-release workflow. It does not dispatch, sign, publish, retag, or delete any release.

Verification

Independently replayed on the reviewed source:

• All 185 Python contracts passed, including 27 nightly-base guard regressions.
• actionlint v1.7.12 passed for qt-ci.yml; git diff --check passed.
• Live GitHub metadata rejected the two obsolete candidates and accepted 1.0.2-nightly.620.1 against stable 1.0.1.
• The actual upload, guard, and publish scripts, executed with an isolated fake GitHub client, left the draft unpublished when stable advanced to 1.0.2 or 1.0.3 during upload, or when the fresh API request failed. The unchanged-stable control reached publication.
• The updater's real SemVer dependency confirmed all three version comparisons. Its stable_promotes_the_same_base_nightly_on_both_channels regression passed.

No production streaming behavior changes. Existing native wheel/HOTAS deferral and physical-hardware qualification limits are unchanged.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 3f4e8fe6-e27e-489d-bd92-2817ad637e8f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[capy-ai]

Independent review completed for exact head ba19d114e414e8df9aad1c62deba7d28a2261179, tree 6ea3ebd821df69136ba7e2d0264c5d9eb52054f4, against dev 99f96bb7f65b92bb0a76dfcefec7e625474d76c6.

The six-file diff keeps CMake as the version authority and preserves the existing signing, immutable inventory, source-ref, and stable-release policies. Review caught and resolved bootstrap identity validation and invalid build-metadata parsing before publication. Numeric stable selection and both fresh-metadata guards are covered by executable regressions.

I independently replayed all 185 contracts, including 27 guard tests, actionlint 1.7.12, and the updater's real promotion regression. Live release metadata rejects both obsolete nightly bases and accepts the corrected base. Executing the actual draft-upload/guard/publication scripts with an isolated fake GitHub client proves that a stable advance or API failure after upload prevents the undraft command.

No blocking source findings remain. Fresh PR CI must finish before the authorized normal merge; no release operation is delegated to this PR.

[capy-ai]

The first CI attempt failed only network_test::probe_tests::a_hostile_flood_cannot_stretch_the_probe_deadline on Windows: 420.0697 ms against a 420 ms limit. I independently checked the pre-existing failure on the unchanged base 99f96bb7, run 35089279745, where the same test measured 421.3435 ms. Linux, macOS, and all 185 release contracts passed.

Reran only the failed job of PR-event run 35096729554 at the unchanged reviewed head. No assertion changes, check bypasses, or release dispatches.

[capy-ai]

Attempt 3 passed all required checks at the unchanged reviewed head: eight successes and four expected release-job skips. Merged normally as f84d5b3e4c97706be7967c1d731f1ab59018288e after fresh exact-head/dev checks; the landed tree matches 6ea3ebd821df69136ba7e2d0264c5d9eb52054f4. Version generation from the actual merged source produces the 1.0.2 nightly base. No release was dispatched or modified here.