ci: support releases from maintenance branches

.github/workflows/release-draft.yml

@@ -21,10 +21,18 @@ jobs:
     name: Create Release PR
     runs-on: ubuntu-latest
     steps:
+      # A major bump off main would publish the next major from maintenance code.
+      - name: Block major bump outside main
+        if: github.ref_name != 'main' && inputs.bump-type == 'major'
+        run: |
+          echo "::error::Major releases can only be drafted from main"
+          exit 1
+
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Read current version
         id: current-version
@@ -38,10 +46,14 @@ jobs:
           level: ${{ github.event.inputs.bump-type || 'patch' }}
 
       - name: Write new version to VERSION
-        run: echo "${{ steps.bump-version.outputs.new_version }}" > VERSION
+        env:
+          NEW_VERSION: ${{ steps.bump-version.outputs.new_version }}
+        run: echo "$NEW_VERSION" > VERSION
 
       - name: Update package.json version
-        run: npm version "${{ steps.bump-version.outputs.new_version }}" --no-git-tag-version --allow-same-version
+        env:
+          NEW_VERSION: ${{ steps.bump-version.outputs.new_version }}
+        run: npm version "$NEW_VERSION" --no-git-tag-version --allow-same-version
 
       - name: Generate changelog from git history
         id: changelog
@@ -58,12 +70,15 @@ jobs:
           owner: ${{ github.repository_owner }}
           repositories: |
             react-native-mparticle
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Create release PR
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
         with:
           token: ${{ steps.generate-token.outputs.token }}
           branch: release/${{ steps.bump-version.outputs.new_version }}
+          base: ${{ github.ref_name }}
           title: 'chore: release ${{ steps.bump-version.outputs.new_version }}'
           body: |
             ## Release ${{ steps.bump-version.outputs.new_version }}

.github/workflows/release-publish.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - maintenance/*
     paths:
       - VERSION
 
@@ -49,6 +50,11 @@ jobs:
     name: Publish to npm and Create GitHub Release
     runs-on: ubuntu-latest
     needs: [react-tests, android-unit-tests]
+    # One publish at a time across branches, so each run reads npm's `latest` after the previous publish.
+    # GitHub keeps one pending run per group: a third concurrent release cancels the waiting one, which can be re-run.
+    concurrency:
+      group: npm-publish
+      cancel-in-progress: false
     permissions:
       contents: write
       id-token: write # Required for npm OIDC trusted publishing
@@ -80,16 +86,36 @@ jobs:
         with:
           release_notes_file: RELEASE_NOTES.md
 
+      # A maintenance release must not pull `latest` back below a newer major.
+      - name: Resolve npm dist-tag
+        id: dist-tag
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          current=$(npm view react-native-mparticle dist-tags.latest)
+          # sort -V orders 4.0.0-beta.1 above 4.0.0; fine while this package publishes no pre-releases
+          if [ "$(printf '%s\n' "$current" "$VERSION" | sort -V | tail -n1)" = "$VERSION" ]; then
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+            echo "latest=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=latest-${VERSION%%.*}" >> "$GITHUB_OUTPUT"
+            echo "latest=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Publish to npm
-        run: npm publish --provenance
+        env:
+          DIST_TAG: ${{ steps.dist-tag.outputs.tag }}
+        run: npm publish --provenance --tag "$DIST_TAG"
 
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_VERSION: ${{ steps.version.outputs.version }}
           RELEASE_COMMIT: ${{ github.sha }}
+          IS_LATEST: ${{ steps.dist-tag.outputs.latest }}
         run: >-
           gh release create "$RELEASE_VERSION"
           --title "$RELEASE_VERSION"
           --notes-file RELEASE_NOTES.md
           --target "$RELEASE_COMMIT"
+          --latest="$IS_LATEST"

.github/workflows/zizmor.yml

@@ -6,13 +6,15 @@ on:
     branches:
       - main
       - development
+      - maintenance/*
     paths:
       - .github/workflows/**
       - .github/actions/**
   push:
     branches:
       - main
       - development
+      - maintenance/*
     paths:
       - .github/workflows/**
       - .github/actions/**