ci(release): fix lint + harden release workflow

.github/workflows/release-on-version.yml

@@ -1,20 +1,19 @@
 ---
-  name: Release on version.js update
+name: Release on version.js update
 
-  on:
+on:
   push:
-      branches:
-        - master
+    branches: ["master"]
     paths:
       - public/js/version.js
   workflow_run:
-      workflows: "Bump version and sync Changelog to Docker Repo"
-      types: completed
+    workflows: ["Bump version and sync Changelog to Docker Repo"]
+    types: [completed]
 
-  permissions:
+permissions:
   contents: write
 
-  jobs:
+jobs:
   release:
     runs-on: ubuntu-latest
     concurrency:
@@ -27,6 +26,10 @@
         with:
           fetch-depth: 0
 
+      - name: Ensure tags available
+        run: |
+          git fetch --tags --force --prune --quiet
+
       - name: Read version from version.js
         id: ver
         shell: bash
@@ -45,7 +48,6 @@
         shell: bash
         run: |
           set -euo pipefail
-            git fetch --tags --quiet
           if git rev-parse -q --verify "refs/tags/${{ steps.ver.outputs.version }}" >/dev/null; then
             echo "exists=true" >> "$GITHUB_OUTPUT"
             echo "Tag ${{ steps.ver.outputs.version }} already exists. Skipping release."
@@ -53,13 +55,17 @@
             echo "exists=false" >> "$GITHUB_OUTPUT"
           fi
 
-        # Build the artifact first so we can checksum it
       - name: Build zip artifact
         if: steps.tagcheck.outputs.exists == 'false'
         shell: bash
         run: |
           set -euo pipefail
-            zip -r "FileRise-${{ steps.ver.outputs.version }}.zip" public/ README.md LICENSE >/dev/null || true
+          ZIP="FileRise-${{ steps.ver.outputs.version }}.zip"
+          zip -r "$ZIP" . \
+            -x "./.git/*" "./.github/*" \
+               "./resources/*" "./resources/**" \
+               "./.dockerignore" "./.gitattributes" "./.gitignore" \
+               "$ZIP" "${ZIP}.sha256" >/dev/null
 
       - name: Compute SHA-256 checksum
         if: steps.tagcheck.outputs.exists == 'false'
@@ -100,8 +106,8 @@
         shell: bash
         run: |
           set -euo pipefail
-            git fetch --tags --quiet
-            PREV=$(git tag --list "v*" --sort=-v:refname | sed -n '2p' || true)
+          VER="${{ steps.ver.outputs.version }}"
+          PREV=$(git tag --list "v*" --sort=-v:refname | grep -v -F "$VER" | head -n1 || true)
           if [[ -z "$PREV" ]]; then
             PREV=$(git rev-list --max-parents=0 HEAD | tail -n1)
           fi