ci: test latest published release before cut

.github/workflows/windows-build.yml

@@ -40,7 +40,7 @@ jobs:
 
       - name: Test Desktop security (live release)
         env:
-          SMM_TEST_RELEASE_TAG: v0.1.0-alpha.20
+          SMM_TEST_RELEASE_TAG: ${{ vars.SMM_TEST_RELEASE_TAG || 'v0.1.0-alpha.20' }}
         run: dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release -p:RestoreLockedMode=true --filter Category=LiveRelease
 
       - name: Build test-signed MSIX installer

tests/bootstrap/test-release-version-consistency.sh

@@ -19,7 +19,11 @@ grep -Fq "SMM_TAG         Release tag (default: $default_tag)" "$setup" || {
     exit 1
 }
 
-windows_tag="$(sed -n 's/^[[:space:]]*SMM_TEST_RELEASE_TAG:[[:space:]]*\([^[:space:]]*\)$/\1/p' "$windows_workflow")"
+windows_tag="$(
+    grep -E '^[[:space:]]*SMM_TEST_RELEASE_TAG:' "$windows_workflow" \
+        | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?' \
+        | sort -u
+)"
 [[ "$windows_tag" == "$default_tag" ]] || {
     printf 'Windows live-release tag %s does not match %s\n' "$windows_tag" "$default_tag" >&2
     exit 1