Drop explicit 'latest' handling; rely on GitHub auto-latest

gh release create defaults to marking the highest-version release as
"Latest", so a back-major release (e.g. a v2 hotfix) never steals the
badge from the current major on its own. The explicit latest controls
were therefore redundant, and rollback's badge edit conflicted with
immutable releases.

- release.yml: remove the latest input, the back-major latest guard, and
  the --latest flag on gh release create.
- rollback.yml: remove the set_latest input and the gh release edit
  --latest badge step. Rollback now does only the major-tag move (matching
  the original runbook) plus the admin gate and built-artifact checks.

The "Latest" badge is display-only and never affects what azure/login@vN
resolves to, so this is behaviourally safe.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MaddyMicrosoft

.github/workflows/release.yml

@@ -20,10 +20,6 @@ on:
         description: "Branch to release from. Use master for the current major (v3). For a back-major release (e.g. v2), branch a hotfix off the latest release tag (git checkout -b hotfix/v2.3.2 v2.3.1) and pass that hotfix/* branch."
         required: false
         default: master
-      latest:
-        description: "Mark as the latest release (only for the highest major, e.g. v3)"
-        type: boolean
-        default: true
 
 permissions:
   contents: write   # push branch/tag, force-move major tag, create the Release
@@ -78,27 +74,8 @@ jobs:
         with:
           ref: ${{ inputs.ref }}   # master for the current major; a hotfix/* branch for a back-major release
           fetch-depth: 0
-          # fetch tags so the 'latest' guard can find the highest major
           fetch-tags: true
 
-      - name: Guard 'latest' against back-major releases
-        env:
-          V: ${{ inputs.version }}
-          LATEST: ${{ inputs.latest }}
-        run: |
-          # 'latest' controls only the "Latest" badge on the Releases page, of
-          # which there is one per repo. Refuse to move it onto an older major
-          # (e.g. a v2 hotfix must not steal the badge from v3).
-          MAJOR="${V%%.*}"                                                   # v2.3.2 -> v2
-          # Highest major among existing tags AND this release, so a brand-new
-          # top major (e.g. first v4.0.0) is still allowed to be latest.
-          HIGHEST=$(printf '%s\n' $(git tag -l 'v*' | grep -E '^v[0-9]+$') "$MAJOR" | sort -V | tail -1)
-          echo "Release major: $MAJOR   Highest major: $HIGHEST   latest=$LATEST"
-          if [[ "$LATEST" == "true" && "$MAJOR" != "$HIGHEST" ]]; then
-            echo "::error::Refusing to mark $V as latest: $MAJOR is not the highest major ($HIGHEST). Re-run with latest=false for back-major releases."
-            exit 1
-          fi
-
       - name: Ensure version is new
         env:
           V: ${{ inputs.version }}
@@ -159,11 +136,10 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           V: ${{ inputs.version }}
-          LATEST: ${{ inputs.latest }}
         run: |
-          LATEST_FLAG="--latest=false"
-          [[ "$LATEST" == "true" ]] && LATEST_FLAG="--latest"
+          # No --latest flag: GitHub automatically marks the highest-version
+          # release as "Latest", so a back-major release (e.g. a v2 hotfix) does
+          # not steal the badge from the current major.
           gh release create "$V" \
             --title "Azure Login Action $V" \
-            --generate-notes \
-            "$LATEST_FLAG"
+            --generate-notes

.github/workflows/rollback.yml

@@ -18,10 +18,6 @@ on:
       target_version:
         description: "Known-good version to roll the major tag back to, e.g. v3.0.1 (must be an existing tag)"
         required: true
-      set_latest:
-        description: "Also reset the GitHub 'Latest' release badge to target_version"
-        type: boolean
-        default: true
 
 permissions:
   contents: write   # force-move the major tag, update the Release
@@ -102,25 +98,6 @@ jobs:
           git tag -a "$MAJOR" -m "Rollback $MAJOR to $V" "$V"
           git push origin "$MAJOR" -f
 
-      - name: Reset 'Latest' release badge to target
-        if: ${{ inputs.set_latest }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          V: ${{ inputs.target_version }}
-        run: |
-          # Point the repo's single "Latest" badge back at the good version, so
-          # the Releases page and /releases/latest stop advertising the bad one.
-          # A tag can exist without a published Release, so tolerate a missing
-          # release object: the critical tag rollback already succeeded above,
-          # and the badge is cosmetic - warn rather than fail the whole rollback.
-          if gh release view "$V" --repo "$REPO" >/dev/null 2>&1; then
-            gh release edit "$V" --latest --repo "$REPO"
-            echo "Set '$V' as the Latest release."
-          else
-            echo "::warning::No GitHub Release exists for $V, so the 'Latest' badge was not changed. The major tag rollback still succeeded. Create/publish a Release for $V if you want the badge updated."
-          fi
-
       - name: Summary
         env:
           V: ${{ inputs.target_version }}