Ask vote-passed for both versions instead of taking one positionally

`vote-passed <old_version>` published the version resolved from the tag and
deleted the version given as the argument. Two versions, one of them positional,
and the argument is the one that gets deleted - so `vote-passed 9.7.0` while
releasing 9.7.0 reads as "release 9.7.0" and instead promotes it into
dist/release and immediately svn rm's it.

Take no arguments. Ask for each version with a label saying what will happen to
it, offer a detected default, and refuse when the two are equal. Passing an
argument is now an error pointing at RELEASE_VERSION / OLD_VERSION, so existing
muscle memory fails loudly rather than doing something different.

The release-version default also stops sorting by version number. Releases are
not monotonic: a 9.6.1 patch cut from the 9.6.0 line after 9.7.0 has shipped is
newer in time but lower in version, and the old ordering would have offered the
already-released 9.7.0. Order by tag creation date instead - maven-release-plugin
writes annotated tags, so that timestamp belongs to the tag and survives fetches.

The old-version default now comes from dist/release, which is the only place that
actually knows what this release replaces, with the version being released
filtered out so re-running after a partial failure cannot offer to delete it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: wu-sheng

docs/en/contribution/release-java-agent.md

@@ -47,8 +47,8 @@ The release script `tools/releasing/release.sh` automates the full release workf
 
 # (send vote email to dev@skywalking.apache.org, wait 72h for vote to pass)
 
-# Step 2: Promote, push Docker images, generate announce email, and clean up
-./tools/releasing/release.sh vote-passed [old_version_to_remove]
+# Step 2: Promote, publish the GitHub Release, generate announce email, and clean up
+./tools/releasing/release.sh vote-passed
 ```
 
 Run `./tools/releasing/release.sh` without arguments to see all available commands, including individual steps if you need to run them separately.
@@ -107,6 +107,19 @@ merged and `release/x.y.z` deleted, and `main` has already moved on to the next
 the highest `vx.y.z` tag in the repository, and can be overridden with a positional
 argument (`./release.sh docker 9.7.0`) or `RELEASE_VERSION=9.7.0`.
 
+`vote-passed` takes no arguments. It asks for two versions, because they are easy to confuse
+and swapping them would delete the release that was just promoted:
+
+- **Release version** — the one being published. Defaults to the most recently *created*
+  `vx.y.z` tag, not the highest one: a `9.6.1` patch cut from the `9.6.0` line after `9.7.0`
+  has shipped is newer in time but lower in version.
+- **Old version** — removed from `dist/release`, which ASF policy keeps to just the current
+  release. Defaults to what is published there now, excluding the version being released.
+  Answer `none` to skip.
+
+Set `RELEASE_VERSION` and `OLD_VERSION` to answer non-interactively:
+`RELEASE_VERSION=9.7.0 OLD_VERSION=9.6.0 ./tools/releasing/release.sh vote-passed`.
+
 After the vote passes, run `vote-passed` which executes:
 1. **promote** — move packages from `dist/dev` to `dist/release` in Apache SVN (prompts for SVN credentials), then release the Nexus staging repository at https://repository.apache.org and update the website download page
 2. **github-release** — publish the GitHub Release for the tag, using `changes/changes-x.y.z.md` as its notes

tools/releasing/release.sh

@@ -27,8 +27,9 @@
 #   ./release.sh prepare-vote               Run prepare + stage + upload, then generate vote email
 #   ./release.sh email [vote|announce]      Generate email content
 #   ./release.sh promote                    Move from dist/dev to dist/release in SVN
-#   ./release.sh docker                     Build and push Docker images
-#   ./release.sh vote-passed                Run promote + docker, then generate announce email
+#   ./release.sh github-release             Publish the GitHub Release (pushes Docker images via CI)
+#   ./release.sh docker                     Push Docker images locally (fallback)
+#   ./release.sh vote-passed                Run promote + github-release + announce (asks for versions)
 #   ./release.sh cleanup <old_version>      Remove old release from dist/release
 
 set -euo pipefail
@@ -46,6 +47,39 @@ info()  { echo -e "${GREEN}[INFO]${NC} $*"; }
 warn()  { echo -e "${YELLOW}[WARN]${NC} $*"; }
 error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
 
+# ============================================================
+# detect_release_version — best guess at the release in flight
+# ============================================================
+# Ordered by when the tag was made, not by version number. Releases are not
+# monotonic: a 9.6.1 patch cut from the 9.6.0 line after 9.7.0 has shipped is
+# newer in time but lower in version, and sorting by version would pick the
+# already-released 9.7.0. maven-release-plugin writes annotated tags, so
+# creatordate is the tag's own timestamp and is stable across fetches.
+#
+# This is only ever a default offered to the release manager, never the final
+# word - vote-passed asks them to confirm it.
+detect_release_version() {
+    git for-each-ref --sort=-creatordate --format='%(refname:short)' \
+        'refs/tags/v[0-9]*.[0-9]*.[0-9]*' 2>/dev/null | head -1 | sed 's/^v//'
+}
+
+# ============================================================
+# detect_old_version — the release currently published in dist/release
+# ============================================================
+# ASF policy keeps only the current release in dist/release; older ones are
+# served from archive.apache.org. Whatever is there now is therefore what this
+# release replaces. Excludes the version being released, so re-running after a
+# partial failure - when promote has already copied it in - does not offer to
+# delete the release itself. Best effort: no network, no default.
+detect_old_version() {
+    local exclude="${1:-}"
+    svn ls "https://dist.apache.org/repos/dist/release/skywalking/java-agent/" 2>/dev/null \
+        | sed 's#/$##' \
+        | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
+        | grep -vx "$exclude" \
+        | sort -V | tail -1
+}
+
 # ============================================================
 # resolve_version — identify the release from its tag
 # ============================================================
@@ -60,8 +94,8 @@ error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
 # That would aim SVN moves and Docker pushes at the wrong version. Tags are
 # branch-independent and outlive the release branch, so select from the tag list.
 #
-# Order of precedence: explicit argument, then $RELEASE_VERSION, then the highest
-# vX.Y.Z tag in the repository.
+# Order of precedence: explicit argument, then $RELEASE_VERSION, then the most
+# recently created vX.Y.Z tag (see detect_release_version for why not the highest).
 resolve_version() {
     local explicit="${1:-}"
     [ -z "$explicit" ] && explicit="${RELEASE_VERSION:-}"
@@ -71,11 +105,11 @@ resolve_version() {
         version="${explicit#v}"
     else
         local latest
-        latest=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -1)
+        latest=$(detect_release_version)
         if [ -z "$latest" ]; then
             error "No vX.Y.Z release tag found. Pass the version explicitly, e.g. '$0 <command> 9.7.0'."
         fi
-        version="${latest#v}"
+        version="$latest"
     fi
 
     case "$version" in
@@ -710,15 +744,59 @@ cmd_prepare_vote() {
 # vote-passed — run all steps after the vote passes
 # ============================================================
 cmd_vote_passed() {
-    local old_version="${1:-}"
-
     cd "$PROJECT_ROOT"
 
-    # Resolved from the release tag, so this works after the release branch has
-    # been merged and deleted. Show it before touching SVN or Docker Hub, both of
-    # which are public and awkward to undo.
-    local version
-    version=$(resolve_version "")
+    # Both versions are asked for rather than taken positionally. They are easy to
+    # confuse - one is being published, the other deleted - and getting them the
+    # wrong way round would svn rm the release that was just promoted. Detection
+    # only supplies the defaults; the release manager confirms them.
+    # RELEASE_VERSION and OLD_VERSION answer non-interactively.
+    if [ "$#" -gt 0 ]; then
+        error "'$0 vote-passed' takes no arguments; it asks for the versions.
+  Set RELEASE_VERSION and OLD_VERSION to answer non-interactively, e.g.
+    RELEASE_VERSION=9.7.0 OLD_VERSION=9.6.0 $0 vote-passed"
+    fi
+
+    info "Publishing a release. Two versions are needed."
+    echo ""
+
+    local version="${RELEASE_VERSION:-}"
+    if [ -z "$version" ]; then
+        local suggested
+        suggested=$(detect_release_version)
+        echo "  The version being released. It must already be tagged and voted on."
+        if [ -n "$suggested" ]; then
+            echo "  Most recently tagged: ${suggested} (tag v${suggested})"
+        fi
+        read -rp "  Release version${suggested:+ [$suggested]}: " version
+        version="${version:-$suggested}"
+    fi
+    [ -z "$version" ] && error "No release version given."
+    version=$(resolve_version "$version")
+    echo ""
+
+    local old_version="${OLD_VERSION:-}"
+    if [ -z "$old_version" ]; then
+        local current
+        current=$(detect_old_version "$version")
+        echo "  The version to remove from dist/release. ASF policy keeps only the"
+        echo "  current release there; older ones are served from archive.apache.org."
+        if [ -n "$current" ]; then
+            echo "  Currently published in dist/release: ${current}"
+        else
+            echo "  Could not read dist/release, so there is no suggestion."
+        fi
+        read -rp "  Old version to remove${current:+ [$current]} (or 'none' to skip): " old_version
+        old_version="${old_version:-$current}"
+    fi
+    # 'none' is the explicit opt out; blank accepts the suggestion above.
+    [ "$old_version" = "none" ] && old_version=""
+
+    # The mistake this whole prompt exists to prevent.
+    if [ -n "$old_version" ] && [ "$old_version" = "$version" ]; then
+        error "Old version and release version are both ${version}; that would delete the release being published."
+    fi
+    echo ""
 
     info "Publishing release ${version}:"
     echo "  Release tag     : v${version}"
@@ -781,7 +859,7 @@ main() {
             echo "Quick start (two-step release):"
             echo "  $0 prepare-vote 9.7.0 [9.8.0]     # before vote (next version auto-calculated if omitted)"
             echo "  (wait for 72h vote to pass)"
-            echo "  $0 vote-passed [old_version]       # after vote"
+            echo "  $0 vote-passed                     # after vote (asks for the versions)"
             echo ""
             echo "Every command after 'prepare' identifies the release by its tag (vX.Y.Z), not by the"
             echo "checked-out branch, so they still work once release/x.y.z has been merged and deleted."
@@ -799,7 +877,9 @@ main() {
             echo "                                the Docker images, via publish-docker.yaml"
             echo "  docker [ver]                  Push Docker images from this machine (fallback"
             echo "                                for when the workflow fails)"
-            echo "  vote-passed [old_ver]         Run promote + github-release + announce [+ cleanup]"
+            echo "  vote-passed                   Run promote + github-release + announce [+ cleanup];"
+            echo "                                asks for the release version and the old version to"
+            echo "                                remove. RELEASE_VERSION / OLD_VERSION answer these."
             echo "  cleanup <old_version>         Remove old release from dist/release"
             ;;
     esac