fix(build): order canary builds by commit time

[armando-navarro]

Fixes #3771

Canary builds are named after their commit's UTC time as well as its hash, so npm ranks them by age, and an all-digit hash keeps its leading zero.

Changes

• tools/build.sh names a canary <version>-canary.<YYYYMMDDHHmmss>.sha-<short sha>, for example 21.0.0-canary.20260924201718.sha-a2662fe, instead of 21.0.0-canary.a2662fe.
  • The time is the commit's, in UTC, so the weekday scheduled rebuild of an unchanged main gets the same name and publishes nothing new.
  • The sha- prefix keeps the hash a text identifier.
• Tagged releases are named exactly as before.
• The new names rank below 21.0.0-canary.a2662fe, the one 21.0.0 canary published under the old naming, because a number ranks below text. Nothing installs differently: the canary dist-tag is set at each publish, and Canary builds are ordered by commit hash, not by time, and an all-digit hash loses its leading zero #3771's Scope covers version ranges.

Verification

Run in a depth-1 clone like the workflow's checkout, with npm run build stubbed:

• A push to main names the canary 21.0.0-canary.20260924201718.sha-a2662fe on the canary tag, the commit's UTC time on a runner set to another time zone.
• Building the same commit twice gives the same name.
• The tags 21.0.0-rc.2 and 21.0.0 still publish those versions on next and latest.
• With a prerelease left in package.json, the canary is still named after 21.0.0.
• npm version keeps sha-0123456 intact.
• Among the new names, order follows commit time regardless of hash.

[tyler-reitz]

Approving. I ran the behaviour rather than reading it: the git show in a --depth 1 clone and under TZ=Asia/Tokyo, twice on the same commit, and 21.0.0-canary.20260925120000.sha-0123456 through npm version. UTC, deterministic, leading zero intact. Bare 0123456 is genuinely invalid semver, so the sha- prefix is load-bearing and the comment saying so should stay.

One line worth adding to the description. A numeric first identifier always loses to an alphanumeric one, so the new names rank below the old ones:

21.0.0-canary.20260925120000.sha-0123456
21.0.0-canary.a2662fe

That is the whole affected set: a2662fe is the only published 21.0.0-canary.*, so it outranks every canary built from now until 21.0.0 ships. Nothing installs differently, since canary is a dist-tag set at publish time and #3771's Scope covers the ranges. But "Names sort by time regardless of hash" reads as global when it only holds among the new names.

[armando-navarro]

Thanks. I've updated the description: the ordering bullet now says it holds among the new names, and a new line notes that they rank below 21.0.0-canary.a2662fe.