fix(ci): Stop publishing floating pre-releases, keep floating tags

.github/actions/update-floating-tags/action.yml

@@ -1,5 +1,5 @@
 name: 'Update floating tags'
-description: 'Push floating major/minor/latest git tags and recreate corresponding GitHub releases'
+description: 'Push floating major/minor/latest git tags for a released version'
 
 inputs:
   release-version:
@@ -9,17 +9,6 @@ inputs:
     description: 'Git tag prefix (e.g. "gitlab/", "github/", "rules/", or empty for CLI)'
     required: true
     default: ''
-  component-name:
-    description: 'Human-readable component name for release notes (e.g. "GitLab CI template")'
-    required: true
-  release-assets:
-    description: 'Files to attach to floating releases (space-separated paths)'
-    required: false
-    default: ''
-  copy-assets-from:
-    description: 'Tag to copy assets from (e.g. v0.1.2). Mutually exclusive with release-assets.'
-    required: false
-    default: ''
 
 runs:
   using: 'composite'
@@ -31,7 +20,6 @@ runs:
 
         VERSION="$(echo "${{ inputs.release-version }}" | sed 's/^v//')"
         PREFIX="${{ inputs.tag-prefix }}"
-        COMPONENT="${{ inputs.component-name }}"
         MAJOR="$(echo "$VERSION" | cut -d. -f1)"
         MAJOR_TAG="${PREFIX}v${MAJOR}"
         MINOR_TAG="${PREFIX}v$(echo "$VERSION" | cut -d. -f1-2)"
@@ -46,36 +34,3 @@ runs:
         git push origin "$MINOR_TAG" --force
         git tag -f "$LATEST_TAG"
         git push origin "$LATEST_TAG" --force
-
-        ASSET_ARGS=()
-        ASSETS_DIR=""
-        if [ -n "${{ inputs.copy-assets-from }}" ]; then
-          ASSETS_DIR=$(mktemp -d)
-          gh release download "${{ inputs.copy-assets-from }}" --dir "$ASSETS_DIR"
-          for f in "$ASSETS_DIR"/*; do
-            [ -f "$f" ] || continue
-            ASSET_ARGS+=("$f")
-          done
-        elif [ -n "${{ inputs.release-assets }}" ]; then
-          read -ra ASSET_ARGS <<< "${{ inputs.release-assets }}"
-        fi
-
-        gh release delete "$LATEST_TAG" --yes || true
-        gh release create "$LATEST_TAG" \
-          --title "$LATEST_TAG" \
-          --notes "Floating release tracking the latest ${COMPONENT} version (${PREFIX}v${VERSION})" \
-          --latest=false \
-          --prerelease \
-          "${ASSET_ARGS[@]+"${ASSET_ARGS[@]}"}"
-
-        gh release delete "$MINOR_TAG" --yes || true
-        gh release create "$MINOR_TAG" \
-          --title "$MINOR_TAG" \
-          --notes "Floating release tracking the latest ${COMPONENT} ${MINOR_TAG#${PREFIX}}.x version (${PREFIX}v${VERSION})" \
-          --latest=false \
-          --prerelease \
-          "${ASSET_ARGS[@]+"${ASSET_ARGS[@]}"}"
-
-        if [ -n "$ASSETS_DIR" ]; then
-          rm -rf "$ASSETS_DIR"
-        fi

.github/workflows/publish-analyzer.yaml

@@ -101,6 +101,5 @@ jobs:
             --title "analyzer/latest" \
             --notes "Floating release tracking the latest analyzer version (v${{ steps.changes.outputs.version }})" \
             --latest=false \
-            --prerelease \
             core/build/libs/opentaint-project-analyzer.jar \
             opentaint-models.tar.gz

.github/workflows/publish-autobuilder.yaml

@@ -95,5 +95,4 @@ jobs:
             --title "autobuilder/latest" \
             --notes "Floating release tracking the latest autobuilder version (v${{ steps.changes.outputs.version }})" \
             --latest=false \
-            --prerelease \
             core/opentaint-jvm-autobuilder/build/libs/opentaint-project-auto-builder.jar

.github/workflows/publish-go-server.yaml

@@ -124,5 +124,4 @@ jobs:
             --title "go-server/latest" \
             --notes "Floating release tracking the latest go-ssa-server version (v${{ steps.changes.outputs.version }})" \
             --latest=false \
-            --prerelease \
             dist/*

.github/workflows/release-cli.yaml

@@ -347,8 +347,6 @@ jobs:
         with:
           release-version: ${{ steps.release_version.outputs.RELEASE_VERSION }}
           tag-prefix: ''
-          component-name: 'CLI'
-          copy-assets-from: v${{ steps.release_version.outputs.RELEASE_VERSION }}
 
     outputs:
       release_version: ${{ steps.release_version.outputs.RELEASE_VERSION }}

.github/workflows/release-github.yaml

@@ -112,7 +112,6 @@ jobs:
         with:
           release-version: ${{ steps.manual_release.outputs.new-version || steps.version.outputs.new_release_version }}
           tag-prefix: 'github/'
-          component-name: 'GitHub Action'
 
     outputs:
       release_version: ${{ steps.manual_release.outputs.new-version || steps.version.outputs.new_release_version }}

.github/workflows/release-gitlab.yaml

@@ -129,7 +129,6 @@ jobs:
         with:
           release-version: ${{ steps.manual_release.outputs.new-version || steps.release_version.outputs.RELEASE_VERSION }}
           tag-prefix: 'gitlab/'
-          component-name: 'GitLab CI template'
 
     outputs:
       release_version: ${{ steps.manual_release.outputs.new-version || steps.release_version.outputs.RELEASE_VERSION }}

.github/workflows/release-rules.yaml

@@ -134,8 +134,6 @@ jobs:
         with:
           release-version: ${{ steps.manual_release.outputs.new-version || steps.release_version.outputs.RELEASE_VERSION }}
           tag-prefix: 'rules/'
-          component-name: 'rules'
-          release-assets: opentaint-rules.tar.gz
 
     outputs:
       release_version: ${{ steps.manual_release.outputs.new-version || steps.release_version.outputs.RELEASE_VERSION }}

docs/installation.md

@@ -33,33 +33,45 @@ The correct binary for your platform (Linux, macOS, or Windows; x64 or arm64) is
 
 ## Install Scripts
 
-The install scripts accept an optional version argument. Without one, the latest GitHub release is installed.
+The install scripts accept an optional version argument (leading `v` optional). Without one, the latest GitHub release is installed. You can pin to:
+
+- an exact version — `v0.4.5`
+- the newest patch of a minor line — `v0.4` (resolves to the newest `v0.4.x`)
+- the newest release of a major line — `v0` (resolves to the newest `v0.x.y`)
+
+The leading `v` is optional in every form (`0.4.5` works the same as `v0.4.5`).
 
 **Linux/macOS:**
 ```bash
 # Latest
 curl -fsSL https://opentaint.org/install.sh | bash
 
-# Specific version (leading 'v' is optional)
-curl -fsSL https://opentaint.org/install.sh | bash -s -- 1.2.3
+# Exact version, minor line, or major line
+curl -fsSL https://opentaint.org/install.sh | bash -s -- v0.4.5
+curl -fsSL https://opentaint.org/install.sh | bash -s -- v0.4
+curl -fsSL https://opentaint.org/install.sh | bash -s -- v0
 ```
 
 **Windows (PowerShell):**
 ```powershell
 # Latest
 irm https://opentaint.org/install.ps1 | iex
 
-# Specific version
-& ([scriptblock]::Create((irm https://opentaint.org/install.ps1))) -Version 1.2.3
+# Exact version, minor line, or major line
+& ([scriptblock]::Create((irm https://opentaint.org/install.ps1))) -Version v0.4.5
+& ([scriptblock]::Create((irm https://opentaint.org/install.ps1))) -Version v0.4
+& ([scriptblock]::Create((irm https://opentaint.org/install.ps1))) -Version v0
 ```
 
 **Windows (CMD):**
 ```cmd
 :: Latest
 curl -fsSL https://opentaint.org/install.cmd -o install.cmd && install.cmd && del install.cmd
 
-:: Specific version
-curl -fsSL https://opentaint.org/install.cmd -o install.cmd && install.cmd 1.2.3 && del install.cmd
+:: Exact version, minor line, or major line
+curl -fsSL https://opentaint.org/install.cmd -o install.cmd && install.cmd v0.4.5 && del install.cmd
+curl -fsSL https://opentaint.org/install.cmd -o install.cmd && install.cmd v0.4 && del install.cmd
+curl -fsSL https://opentaint.org/install.cmd -o install.cmd && install.cmd v0 && del install.cmd
 ```
 
 ### Environment variables

github/README.md

@@ -149,23 +149,36 @@ After the job completes, you’ll find:
 
 ## Version Selection
 
+There are two independent version selectors.
+
+### GitHub Action version
+
+The tag after `@` selects the integration code. Major and minor tags move to the newest compatible release. Exact tags remain pinned:
+
+* `github/v0` — latest action in major version 0
+* `github/v0.4` — latest action in minor version 0.4
+* `github/v0.4.5` — exact action version 0.4.5
+
+```yaml
+uses: seqra/opentaint/github@github/v0.4
+```
+
+### OpenTaint CLI version
+
 `opentaint-version` supports flexible selectors so you do not need to update this action for every OpenTaint release:
 
 * `latest` - always use the latest stable release
 * `v0` - use the latest stable release in major version 0 (default)
-* `v0.1` - use the latest stable patch in minor version 0.1
-* `v0.1.0` - pin an exact release
+* `v0.4` - use the latest stable patch in minor version 0.4
+* `v0.4.5` - pin an exact release
 
 Examples:
 
 ```yaml
 with:
-  opentaint-version: 'latest'
-```
-
-```yaml
-with:
-  opentaint-version: 'v0.1'
+  opentaint-version: 'v0'      # latest v0.x.y
+  # opentaint-version: 'v0.4'  # latest v0.4.x
+  # opentaint-version: 'v0.4.5'
 ```
 
 

gitlab/README.md

@@ -98,16 +98,16 @@ There are two independent version selectors:
 
 ### CI template version
 
-Controlled by the tag in the `include:` URL. Using a major-version tag ensures you always get the latest compatible template without manual updates.
+Controlled by the tag in the `include:` URL. Major and minor tags move to the newest compatible template release. Exact tags remain pinned.
 
-* `gitlab/v0` — latest stable template in major version 0 (recommended)
-* `gitlab/v0.1` — pin to a specific minor version
-* `gitlab/v0.1.0` — pin to an exact version
-* `gitlab/latest` — always use the latest template
+* `gitlab/v0` — latest template in major version 0
+* `gitlab/v0.4` — latest template in minor version 0.4
+* `gitlab/v0.4.5` — exact template version 0.4.5
+* `gitlab/latest` — latest template release
 
 ```yaml
 include:
-  - remote: https://raw.githubusercontent.com/seqra/opentaint/gitlab/v0.1/gitlab/opentaint.gitlab-ci.yml
+  - remote: https://raw.githubusercontent.com/seqra/opentaint/gitlab/v0.4/gitlab/opentaint.gitlab-ci.yml
 ```
 
 ### OpenTaint CLI version
@@ -116,17 +116,14 @@ Controlled by the `OPENTAINT_VERSION` variable. This determines which release of
 
 * `latest` — always use the latest stable release
 * `v0` — use the latest stable release in major version 0 (default)
-* `v0.1` — use the latest stable patch in minor version 0.1
-* `v0.1.0` — pin an exact release
+* `v0.4` — use the latest stable patch in minor version 0.4
+* `v0.4.5` — pin an exact release
 
 ```yaml
 variables:
-  OPENTAINT_VERSION: "latest"
-```
-
-```yaml
-variables:
-  OPENTAINT_VERSION: "v0.1"
+  OPENTAINT_VERSION: "v0"      # latest v0.x.y
+  # OPENTAINT_VERSION: "v0.4"  # latest v0.4.x
+  # OPENTAINT_VERSION: "v0.4.5"
 ```
 
 

scripts/install/install.Tests.ps1

@@ -0,0 +1,44 @@
+BeforeAll {
+    $installer = Get-Content (Join-Path $PSScriptRoot "install.ps1") -Raw
+    $installer = $installer -replace '(?m)^Main\s*$', ''
+    Invoke-Expression $installer
+}
+
+Describe "Resolve-FloatingSelector pagination" {
+    BeforeEach {
+        Mock Invoke-RestMethod {
+            param($Uri, $Headers, [switch]$UseBasicParsing)
+
+            if ($Uri -match 'page=1$') {
+                return 1..100 | ForEach-Object {
+                    [pscustomobject]@{ tag_name = "analyzer/2026.01.$_.abcdef0" }
+                }
+            }
+            if ($Uri -match 'page=2$') {
+                return @(
+                    [pscustomobject]@{ tag_name = "v0.4.5" },
+                    [pscustomobject]@{ tag_name = "v0.5.1" }
+                )
+            }
+            throw "unexpected page: $Uri"
+        }
+    }
+
+    It "resolves a major selector from a later page" {
+        Resolve-FloatingSelector -Selector "v0" | Should -Be "v0.5.1"
+        Should -Invoke Invoke-RestMethod -Times 2
+    }
+
+    It "resolves a minor selector from a later page" {
+        Resolve-FloatingSelector -Selector "v0.4" | Should -Be "v0.4.5"
+        Should -Invoke Invoke-RestMethod -Times 2
+    }
+}
+
+Describe "Test-Version prerelease support" {
+    It "keeps exact prerelease installation supported" {
+        $result = Test-Version -Raw "v0.4.5-rc.1"
+        $result.Tag | Should -Be "v0.4.5-rc.1"
+        $result.PathSegment | Should -Be "download/v0.4.5-rc.1"
+    }
+}

scripts/install/install.cmd

@@ -2,7 +2,9 @@
 REM OpenTaint installer for Windows (CMD wrapper)
 REM This script invokes the PowerShell installer.
 REM Usage: install.cmd            installs latest
-REM        install.cmd 1.2.3       installs version 1.2.3
+REM        install.cmd v0.4.5     installs exact version ('v' optional)
+REM        install.cmd v0          installs newest v0.x.y
+REM        install.cmd v0.4        installs newest v0.4.x
 
 where powershell >nul 2>nul
 if %ERRORLEVEL% equ 0 (