Warn only about a higher version

The check compared the pinned version with the latest release for
equality, so any other version counted as newer. GitHub's latest release
is the one published last, and a fix for an older line can come out
after a newer line started: with open-java-format numbered 21.x now, a
2.98.0.7 would have told every repository on 21 to update, and the
hourly bump would have moved this repository back to it.

Now the warning and the code scanning alert come only when the latest
release sorts after the pinned one by version number, and the hourly
bump only goes upward. The `latest` step hands the decision on as its
`newer` output, so the two steps cannot disagree.

Author: abashev

.github/workflows/follow-releases.yml

@@ -35,8 +35,11 @@ jobs:
           release=$(gh release view --repo openjavaformat/open-java-format --json tagName,publishedAt)
           latest=$(jq -r .tagName <<< "$release")
           published=$(jq -r '.publishedAt[:10]' <<< "$release")
-          if [ "$latest" = "$current" ]; then
-            echo "Already on $current."
+          # The latest release is the one published last, and a fix for an older line can come out
+          # after a newer line started: only a higher version number is a bump.
+          newer=$(printf '%s\n' "$current" "$latest" | sort -V | tail -n 1)
+          if [ "$latest" = "$current" ] || [ "$newer" != "$latest" ]; then
+            echo "Already on $current; the latest release is $latest."
             exit 0
           fi
 

README.md

@@ -127,7 +127,7 @@ jobs:
 
 ## Code scanning
 
-The action compares the version in `.open-java-format-version` with the latest [open-java-format release](https://github.com/openjavaformat/open-java-format/releases) and warns in the job log when a newer one is out. A log warning is easy to miss, so the check can also be reported to code scanning: the action then uploads a SARIF file with one alert while the version is behind, and with none once it is current, which closes the alert. The alert shows up under **Security → Code scanning** and in the **Code scanning results** check on pull requests, and points at `.open-java-format-version`.
+The action compares the version in `.open-java-format-version` with the latest [open-java-format release](https://github.com/openjavaformat/open-java-format/releases) and warns in the job log when a newer one is out. Newer is a higher version number: a repository on a release ahead of the latest one gets no warning. A log warning is easy to miss, so the check can also be reported to code scanning: the action then uploads a SARIF file with one alert while the version is behind, and with none once it is current, which closes the alert. The alert shows up under **Security → Code scanning** and in the **Code scanning results** check on pull requests, and points at `.open-java-format-version`.
 
 This is off by default, because the upload needs the `security-events: write` permission, which the default token does not have. To turn it on, set `code-scanning: true` and give the job the permission, as in the [second recommended setup](#with-the-version-check-in-code-scanning-too). If the permission is missing anyway, the upload is skipped with a line in the log, the check passes as before, and the log warning stays. Code scanning is free on public repositories; a private repository needs [GitHub Code Security](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository) enabled. Pull requests from forks run with a read-only token and get the log warning only.
 

action.yml

@@ -90,12 +90,17 @@ runs:
           https://api.github.com/repos/openjavaformat/open-java-format/releases/latest 2>/dev/null \
           | jq -r '.tag_name // empty' 2>/dev/null || true)
 
+        # Newer is a higher version number, not merely a different one: the latest release is the
+        # one published last, and a fix for an older line can come out after a newer line started.
         echo "version=$LATEST" >> "$GITHUB_OUTPUT"
+        NEWER=false
         if [ -z "$LATEST" ]; then
           echo "Could not check the latest open-java-format version — skipping this check."
-        elif [ "$LATEST" != "$VERSION" ]; then
+        elif [ "$LATEST" != "$VERSION" ] && [ "$(printf '%s\n' "$VERSION" "$LATEST" | sort -V | tail -n 1)" = "$LATEST" ]; then
+          NEWER=true
           echo "::warning file=.open-java-format-version,line=1::A newer open-java-format version is available: $LATEST (.open-java-format-version has $VERSION)"
         fi
+        echo "newer=$NEWER" >> "$GITHUB_OUTPUT"
 
     - name: Report the version check to code scanning
       if: inputs.code-scanning == 'true' && steps.latest.outputs.version != ''
@@ -104,6 +109,7 @@ runs:
         GH_TOKEN: ${{ github.token }}
         VERSION: ${{ steps.version.outputs.version }}
         LATEST: ${{ steps.latest.outputs.version }}
+        NEWER: ${{ steps.latest.outputs.newer }}
       run: |
         # A log warning is easy to miss, so the check is also handed to code scanning: a SARIF
         # file with one alert while a newer release is out, and with none once the version is
@@ -121,7 +127,7 @@ runs:
         WORKFLOW="${WORKFLOW%@*}"
 
         RESULTS='[]'
-        if [ "$LATEST" != "$VERSION" ]; then
+        if [ "$NEWER" = true ]; then
           FILE=".open-java-format-version"
           LINE=1
           # Code scanning tells alerts apart by this fingerprint, made from the line's text.