fix(publishing): preserve newest metadata during release registration

tools/gitea.mjs

@@ -60,10 +60,15 @@ function authorization(token) {
   if (token) return `token ${token}`;
   if (process.env.GITEA_ACTIONS === 'true') throw new Error('Workflow token is missing');
   if (!localAuthorization) {
-    const output = execFileSync('git', ['-c', 'credential.interactive=false', 'credential', 'fill'], {
+    let output;
+    try {
+      output = execFileSync('git', ['-c', 'credential.interactive=false', 'credential', 'fill'], {
         input: `url=${server}\n\n`, encoding: 'utf8', timeout: 10_000,
         env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, stdio: ['pipe', 'pipe', 'ignore'],
       });
+    } catch {
+      throw new Error('Set GITEA_TOKEN or configure Git HTTPS credentials');
+    }
     const fields = Object.fromEntries(output.trim().split('\n').map(line => {
       const separator = line.indexOf('='); return [line.slice(0, separator), line.slice(separator + 1)];
     }));

tools/release-catalog.mjs

@@ -1,3 +1,5 @@
+import { gt } from 'semver';
+
 // Published identity is (Curio ID, version, target). Existing identities are immutable.
 export function appendRelease(catalog, manifest, artifact, releasedAt) {
   const next = structuredClone(catalog);
@@ -18,12 +20,15 @@ export function appendRelease(catalog, manifest, artifact, releasedAt) {
     return next;
   }
   if (!version) {
+    const newest = curio.versions.every(item => gt(manifest.version, item.version));
     version = { version: manifest.version, engine: structuredClone(manifest.engine), releasedAt, artifacts: [] };
     curio.versions.unshift(version);
+    if (newest) {
       curio.name = manifest.name;
       curio.description = manifest.description ?? '';
       if (manifest.icon) curio.icon = manifest.icon;
     }
+  }
   version.artifacts.push(structuredClone(artifact));
   next.generatedAt = next.generatedAt > releasedAt ? next.generatedAt : releasedAt;
   return next;