fix: downgrade gate flags rc-to-release finalization as downgrade

internal/promote/downgrade_test.go

@@ -158,3 +158,61 @@ func TestCheckDowngrade_EmptyVersions_Skipped(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t, result2.Warnings)
 }
+
+// TestCheckDowngrade_PublishBoundary_RCToReleaseNotDowngrade reproduces the
+// cascade publish-boundary false positive: a cascade from a prerelease env at
+// v1.0.0-rc.0 to prod materializes a "release" promotion carrying the stripped
+// semver v1.0.0. The release env currently holds the previously published
+// v1.0.0. The version that LANDS on release is v1.0.0 (promo.Version), which is
+// equal, not a downgrade. The gate must compare against promo.Version, not the
+// source env's raw rc version, otherwise it wrongly blocks the finalization.
+func TestCheckDowngrade_PublishBoundary_RCToReleaseNotDowngrade(t *testing.T) {
+	p := newDowngradePreflighter(t, map[string]*config.EnvState{
+		"release": {Version: "v1.0.0"},
+		"prod":    {Version: "v0.3.0"},
+	}, false)
+	// SourceVersion is the source env's raw rc; promo.Version is what lands.
+	result := &PreflightResult{SourceVersion: "v1.0.0-rc.0"}
+	promotions := []EnvPromotion{
+		{Environment: "release", Version: "v1.0.0"},
+		{Environment: "prod", Version: "v1.0.0"},
+	}
+
+	err := p.checkDowngrade(promotions, result, "prod")
+	require.NoError(t, err)
+	require.Empty(t, result.Warnings)
+}
+
+// TestCheckDowngrade_RealDowngrade_StillBlockedViaPromoVersion proves the fix
+// does not weaken protection: when the version that actually lands (promo.Version)
+// is older than the env's current version, the gate still blocks.
+func TestCheckDowngrade_RealDowngrade_StillBlockedViaPromoVersion(t *testing.T) {
+	p := newDowngradePreflighter(t, map[string]*config.EnvState{
+		"release": {Version: "v2.0.0"},
+	}, false)
+	// Source raw version looks newer, but the version landing on release is older.
+	result := &PreflightResult{SourceVersion: "v2.1.0-rc.0"}
+	promotions := []EnvPromotion{{Environment: "release", Version: "v1.5.0"}}
+
+	err := p.checkDowngrade(promotions, result, "prod")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "release")
+	require.Contains(t, err.Error(), "v2.0.0")
+	require.Contains(t, err.Error(), "v1.5.0")
+	require.Contains(t, err.Error(), "--allow-downgrade")
+}
+
+// TestCheckDowngrade_PrereleaseEnv_RCProgressesForward confirms a cascade that
+// carries an rc forward into prerelease envs is allowed when the rc is newer,
+// using promo.Version (the rc) rather than a stripped value.
+func TestCheckDowngrade_PrereleaseEnv_RCProgressesForward(t *testing.T) {
+	p := newDowngradePreflighter(t, map[string]*config.EnvState{
+		"uat": {Version: "v0.3.0-rc.0"},
+	}, false)
+	result := &PreflightResult{SourceVersion: "v1.0.0-rc.0"}
+	promotions := []EnvPromotion{{Environment: "uat", Version: "v1.0.0-rc.0"}}
+
+	err := p.checkDowngrade(promotions, result, "prod")
+	require.NoError(t, err)
+	require.Empty(t, result.Warnings)
+}

internal/promote/preflight.go

@@ -289,18 +289,32 @@ func (p *Preflighter) checkDowngrade(promotions []EnvPromotion, result *Prefligh
 			currentStr = state.Version
 		}
 
+		// The incoming version is the one that actually LANDS on this env, which
+		// is promo.Version. In a cascade across the publish boundary these differ
+		// from the source env's raw version: the prerelease envs receive the RC
+		// (e.g. v1.0.0-rc.0) while the release/prod envs receive the stripped
+		// semver (v1.0.0). Comparing every env against result.SourceVersion (the
+		// single source env's raw version) wrongly flags the rc-to-release
+		// finalization as a downgrade, because an rc sorts below its release under
+		// semver precedence. Use promo.Version per env; fall back to SourceVersion
+		// only when a promotion carries no version (version-less manifests).
+		incomingStr := promo.Version
+		if incomingStr == "" {
+			incomingStr = result.SourceVersion
+		}
+
 		// Skip if either version is empty (first promotion / version-less).
-		if result.SourceVersion == "" || currentStr == "" {
+		if incomingStr == "" || currentStr == "" {
 			continue
 		}
 
-		incoming, errIn := version.Parse(result.SourceVersion)
+		incoming, errIn := version.Parse(incomingStr)
 		current, errCur := version.Parse(currentStr)
 		if errIn != nil || errCur != nil {
 			// FAIL-OPEN: non-semver version -> warn and continue.
 			result.Warnings = append(result.Warnings, fmt.Sprintf(
 				"downgrade check skipped on env %q: could not compare current version %s to incoming %s; ensure both are semver to enforce monotonicity",
-				promo.Environment, currentStr, result.SourceVersion,
+				promo.Environment, currentStr, incomingStr,
 			))
 			continue
 		}
@@ -315,20 +329,20 @@ func (p *Preflighter) checkDowngrade(promotions []EnvPromotion, result *Prefligh
 		if p.allowDowngrade {
 			result.Warnings = append(result.Warnings, fmt.Sprintf(
 				"downgrade on %s from %s to %s permitted via --allow-downgrade",
-				promo.Environment, currentStr, result.SourceVersion,
+				promo.Environment, currentStr, incomingStr,
 			))
 			continue
 		}
 
 		if isProd {
 			return fmt.Errorf(
 				"downgrade blocked on prod env %q: current version %s is newer than incoming %s; prod downgrades always require --allow-downgrade",
-				promo.Environment, currentStr, result.SourceVersion,
+				promo.Environment, currentStr, incomingStr,
 			)
 		}
 		return fmt.Errorf(
 			"downgrade blocked on env %q: current version %s is newer than incoming %s; pass --allow-downgrade to permit",
-			promo.Environment, currentStr, result.SourceVersion,
+			promo.Environment, currentStr, incomingStr,
 		)
 	}
 	return nil