fix: nightly resolution to select newest published release (#562)

* fix(nightly): pick latest nightly by published_at

GitHub's /releases endpoint is not reliably ordered by published_at,
so resolveNightly could pick an older nightly than the most recent
one. Filter, sort by published_at desc, and take the first.

* test(nightly): add regression coverage for release ordering

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

__tests__/github.test.ts

@@ -104,3 +104,16 @@ describe('getRelease', () => {
     );
   });
 });
+
+describe('latestNightlyRelease', () => {
+  it('returns the newest nightly by published_at even when API order is wrong', () => {
+    const release = github.latestNightlyRelease([
+      {tag_name: 'v2.16.0-c9b458fa-nightly', published_at: '2026-05-12T01:27:50Z'},
+      {tag_name: 'v2.16.0-6724de64-nightly', published_at: '2026-05-13T01:32:53Z'},
+      {tag_name: 'v2.16.0-2827930b-nightly', published_at: '2026-05-17T01:34:11Z'},
+      {tag_name: 'v2.15.4', published_at: '2026-04-21T14:07:57Z'}
+    ]);
+
+    expect(release?.tag_name).toEqual('v2.16.0-2827930b-nightly');
+  });
+});

src/github.ts

@@ -28,6 +28,7 @@ const withRetry = async <T>(operation: () => Promise<T>): Promise<T> => {
 
 export interface GitHubRelease {
   tag_name: string;
+  published_at?: string;
 }
 
 // Matches the new-style nightly release tag pattern: vX.Y.Z-<sha>-nightly
@@ -37,6 +38,13 @@ export const isNightlyTag = (tag: string): boolean => {
   return nightlyTagRegex.test(tag);
 };
 
+export const latestNightlyRelease = (releases: Array<GitHubRelease>): GitHubRelease | undefined => {
+  return releases
+    .filter(r => nightlyTagRegex.test(r.tag_name))
+    .sort((a, b) => (b.published_at || '').localeCompare(a.published_at || ''))
+    .shift();
+};
+
 export const getRelease = async (distribution: string, version: string): Promise<GitHubRelease> => {
   if (version === 'latest') {
     core.warning("You are using 'latest' as default version. Will lock to '~> v2'.");
@@ -113,7 +121,7 @@ const resolveNightly = async (distribution: string): Promise<GitHubRelease> => {
     return <Array<GitHubRelease>>JSON.parse(body);
   });
 
-  const match = releases.find(r => nightlyTagRegex.test(r.tag_name));
+  const match = latestNightlyRelease(releases);
   if (!match) {
     throw new Error(`No '<version>-<sha>-nightly' release found in ${url}`);
   }