Follow-up to #69, addressing the three Copilot review points that landed after it was merged:

- **`release.yml` Packagist poll**: Actions runs steps with `bash -e`, so a failed `curl` or `jq` in the `REF=$(…)` assignment ended the step on the first attempt instead of retrying. It now falls back to `REF=''` and the loop tries again. (The v3.0.1 release run was not affected: Packagist answered on the first attempt.)
- **Strict SemVer** in `build.yml`, `release.yml` and `ConfigurationTest`: no leading zeros in numeric pre-release identifiers (`3.0.1-beta.01`), no empty identifiers, and no leading zeros in the core numbers in the test (`03.0.1`).
- **`build.yml`**: rejects a `ConvertApi::VERSION` that is a pre-release of the latest release (e.g. `3.0.1-beta.1` after `v3.0.1`), which SemVer sorts below it.

Checked locally: the regex accepts `3.0.1`, `3.1.0-beta.1`, `3.1.0-rc.0` and `3.1.0-x-1.2a`, and rejects `03.0.1`, `3.0.1-beta.01`, `3.0.1-beta..1` and `3.0.1-`. The offline tests pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF2
Strict SemVer checks; keep polling Packagist through transient errors

Addresses the Copilot review of #69: the Packagist poll in release.yml
aborted on the first failed request under bash -e; SemVer validators
accepted leading-zero pre-release identifiers; build.yml let VERSION be a
pre-release of the latest release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: tomasr78

.github/workflows/build.yml

@@ -131,7 +131,7 @@ jobs:
         run: |
           set -euo pipefail
           VERSION=$(sed -n "s/^ *const VERSION = '\(.*\)';.*/\1/p" lib/ConvertApi/ConvertApi.php)
-          SEMVER='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
+          SEMVER='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?$'
           if ! [[ "$VERSION" =~ $SEMVER ]]; then
             echo "::error file=lib/ConvertApi/ConvertApi.php::ConvertApi::VERSION '$VERSION' is not {major}.{minor}.{patch}[-{pre-release}]"
             exit 1
@@ -141,6 +141,11 @@ jobs:
             echo "::error file=lib/ConvertApi/ConvertApi.php::ConvertApi::VERSION $VERSION is lower than the latest release $LATEST"
             exit 1
           fi
+          # SemVer sorts 3.0.1-beta.1 below 3.0.1, so a pre-release of the latest release is a step back.
+          if [[ "$VERSION" == *-* ]] && [ "${VERSION%%-*}" = "$LATEST" ]; then
+            echo "::error file=lib/ConvertApi/ConvertApi.php::ConvertApi::VERSION $VERSION is a pre-release of $LATEST, which is already released"
+            exit 1
+          fi
           {
             echo "version=$VERSION"
             echo "latest=$LATEST"

.github/workflows/release.yml

@@ -61,7 +61,7 @@ jobs:
         run: |
           set -euo pipefail
           # SemVer 2.0 without build metadata (Composer ignores "+...").
-          SEMVER='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
+          SEMVER='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?$'
           if ! [[ "$TAG" =~ $SEMVER ]]; then
             echo "::error::Tag '$TAG' is not v{major}.{minor}.{patch} or v{major}.{minor}.{patch}-{pre-release}, e.g. v3.0.1 or v3.1.0-beta.1"
             exit 1
@@ -139,10 +139,11 @@ jobs:
           TAG: ${{ github.event.release.tag_name }}
           SHA: ${{ steps.tag.outputs.sha }}
         run: |
+          # Steps run with bash -e: a failed request or parse sets REF empty and the loop tries again.
           set -uo pipefail
           for _ in $(seq 1 30); do
             REF=$(curl -fsS -H 'Cache-Control: no-cache' "https://repo.packagist.org/p2/$PACKAGE.json" \
-                  | jq -r --arg p "$PACKAGE" --arg v "$TAG" '.packages[$p][] | select(.version == $v) | .source.reference // empty')
+                  | jq -r --arg p "$PACKAGE" --arg v "$TAG" '.packages[$p][] | select(.version == $v) | .source.reference // empty') || REF=''
             if [ "$REF" = "$SHA" ]; then
               echo "$PACKAGE $TAG is on Packagist from $SHA"
               exit 0

tests/ConvertApi/ConfigurationTest.php

@@ -40,6 +40,10 @@ public function testClient()
 
     public function testVersionIsSemVer()
     {
-        $this->assertMatchesRegularExpression('/^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/', ConvertApi::VERSION);
+        $id = '(0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)';
+        $this->assertMatchesRegularExpression(
+            "/^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(-$id(\\.$id)*)?$/",
+            ConvertApi::VERSION
+        );
     }
 }