feat(releases): support a vendor-selected latest version

[jdx]

Semver ordering currently forces latest to select the highest eligible version, preventing a vendor from publishing 3.0.0 while recommending 2.8.4. Add an optional signed release-list latest pointer and packslip releases --latest VERSION, validating that it exactly names a listed semver version.

The specification defines signed vendor pointer → GitHub latest pointer when no signed pointer exists → highest eligible semver. An ineligible recommendation falls directly back to semver, with an explanation. Signature, digest, identity, list freshness/continuity, yanks, age, stamping, and host eligibility still apply; verification errors are not fallback conditions. Ranges and channels keep semver ordering, and stamping lists do not override vendor recommendations.

Includes regenerated schema, CLI reference, and specification page. Tests cover old lists without the field, exact membership (including build metadata), invalid spellings, yanked targets, and signed library/CLI round trips.

Validation: all 58 Rust tests passed; clippy with warnings denied; documentation generation and production build; diff whitespace check. Consumer resolution is specified here; mise still needs to implement this new policy.

---

Note

Medium Risk
Changes release-list semantics and documents consumer selection behavior that downstream tools must implement consistently; in-repo changes are mostly validation and list authoring.

Overview
Adds an optional list-level latest field so vendors can recommend a specific semver for unconstrained “install latest” requests, separate from semver ordering (e.g. ship 3.0.0 but recommend 2.8.4).

Publishing: packslip releases --latest VERSION writes the pointer into signed release lists; the field is omitted when unset. Validation requires an exact semver that matches a releases[] entry (unknown versions fail with UnknownLatest); pointing at a yanked release still validates—the spec defines consumer fallback.

Spec: New Latest section documents priority (signed list → GitHub latest API → none), eligibility checks, semver fallback, and that verification/list errors are not softened by fallback.

Schema/docs/tests: releases-v1 JSON schema, CLI usage, and mirrored spec docs updated; unit and CLI tests cover round-trip and invalid pointers.

^{Reviewed by Cursor Bugbot for commit 9cb4796. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 3798150a-3ca2-4cab-b624-451c7298aeea

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}