fix(ci): compare release validation against the previous stable version (#9636)

Ancestry-based tag selection skips stable tags that live only on older release branches.

Signed-off-by: paomian <xpaomian@gmail.com>

.github/workflows/checks.yml

@@ -82,6 +82,8 @@ jobs:
           version: "latest"
       - name: Run check-version script tests
         run: uv run --no-project python .github/scripts/check-version-test.py
+      - name: Run previous-release-tag script tests
+        run: python3 .github/scripts/previous-release-tag-test.py
       - name: Run enterprise license check tests
         run: python3 scripts/check-enterprise-license-test.py
       - name: Run fuzz orchestration script tests

.github/workflows/release.yml

@@ -415,11 +415,15 @@ jobs:
           REQUESTED_VALIDATION_POLICY: ${{ inputs.release_validation }}
         run: |
           set -euo pipefail
-          base_commit="${GITHUB_SHA}"
-          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
-            base_commit="${GITHUB_SHA}^"
-          fi
-          previous_release_tag="$(git tag --merged "${base_commit}" --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1 || true)"
+          # Stable tags on older release branches are not ancestors of this
+          # commit. Pick the newest vX.Y.Z older than the version being released.
+          release_version="${{ needs.allocate-runners.outputs.version }}"
+          previous_release_tag="$(
+            git ls-remote --tags origin 'refs/tags/v*' \
+              | awk '{print $2}' \
+              | sed -e 's#^refs/tags/##' \
+              | python3 .github/scripts/previous-release-tag.py --version "${release_version}"
+          )"
           if [[ -z "${previous_release_tag}" ]]; then
             previous_release_tag="main"
           fi