Extract shared fullsend install helpers from action.yml and install-fullsend-cli

[rh-hemartin]

Problem

action.yml (root) and .github/actions/install-fullsend-cli/action.yml duplicate several blocks of install logic verbatim:

• OS/arch normalization (runner values to Go release conventions) -- identical 11-line block in both files
• SHA-to-tag resolution -- same goal, different implementations (curl + manual pagination vs gh api --paginate)
• retry_curl -- defined twice within action.yml itself (detect step and download step)
• Source-build clone -- nearly identical shallow-fetch-with-full-clone-fallback pattern

This duplication has already caused the same bug to be patched in both places independently (the jq-injection fix in the SHA-to-tag resolution was one bug fixed twice in a prior review round of #5357).

Proposal

Create .github/scripts/fullsend-install-lib.sh exporting shared functions:

• retry_curl -- retry wrapper with exponential backoff
• resolve_runner_platform -- normalize RUNNER_OS/RUNNER_ARCH to Go conventions
• resolve_sha_to_tag -- look up a 40-char SHA in repo tags, return matching release tag
• clone_at_ref -- shallow-clone with full-clone fallback for bare SHAs

Both action files source the library instead of inlining the logic.

Align the pagination approach

action.yml uses curl with a manual max_pages=50 cap (no stated rationale for the number), while install-fullsend-cli/action.yml uses gh api --paginate with no cap. The shared resolve_sha_to_tag function should pick one strategy -- either gh api --paginate (no manual cap) or a documented cap with a clear reason for the bound.

Resolve the tag once upstream instead of per-stage-job

The six stage workflows (reusable-code/fix/triage/review/retro/prioritize.yml) each call install-fullsend-cli independently with no cache, so every job/matrix branch re-runs the SHA-to-tag lookup for the same SHA. reusable-dispatch.yml already caches its CLI install via actions/cache keyed on fullsend-cli-${mode}-${job.workflow_sha}, but the stage workflows have no equivalent. Cheap today (66 tags, fits one page) but scales poorly if tag count or fan-out grows. When extracting the shared lib, consider resolving the tag once in a shared route job (or in reusable-dispatch.yml) and passing it down to stage jobs as an input.

Blocked by

• fix(version)!: resolve CLI version from reusable workflow ref #5357 -- adds continue-on-error + source-build fallback to root action.yml, which changes the download step. This refactor should land after that PR to avoid merge conflicts.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:51 AM UTC · Completed 8:53 AM UTC
Commit: 7ada4e0 · View workflow run →

[fullsend-ai-triage]

Triage Summary

This is a well-defined refactoring proposal to extract duplicated install logic from action.yml and .github/actions/install-fullsend-cli/action.yml into a shared shell library at .github/scripts/fullsend-install-lib.sh.

The four target functions (retry_curl, resolve_runner_platform, resolve_sha_to_tag, clone_at_ref) are clearly identified with concrete duplication examples, and the motivation is sound — prior duplication already led to the same jq-injection fix needing to be applied in two places.

Blocked

This issue is blocked by PR #5357, which is still open. That PR changes the SHA-to-tag resolution and source-build fallback logic in root action.yml. Landing this refactor before #5357 merges would create merge conflicts and require rework. Once #5357 is merged, this issue is ready for implementation.

Severity: Low (code quality / maintainability improvement, no user-facing defect)
Category: Refactoring

Blocked by:

• fix(version)!: resolve CLI version from reusable workflow ref #5357

[ifireball]

@rh-hemartin can we consolidate to one installer action?

[rh-hemartin]

Yes, much better.

[rh-hemartin]

/fs-triage change the approach so we create one single installer action/script.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:59 AM UTC · Completed 9:02 AM UTC
Commit: 7ada4e0 · View workflow run →

[fullsend-ai-triage]

Triage Summary (updated)

This issue proposes eliminating duplicated install logic between action.yml and .github/actions/install-fullsend-cli/action.yml. The duplicated code (OS/arch normalization, SHA-to-tag resolution, retry_curl, source-build clone) has already caused real bugs to be fixed in two places independently.

Updated approach

Per the discussion between maintainers after the prior triage, the approach has been updated: instead of extracting a shared shell library that both action files source, the plan is now to consolidate into one single installer action/script. This simplifies the design further — rather than maintaining two consumers of a shared library, there would be one canonical installer.

Blocked

This issue remains blocked by PR #5357, which is still open. That PR modifies the SHA-to-tag resolution and adds a source-build fallback with continue-on-error to root action.yml. Landing the consolidation refactor before #5357 merges would create merge conflicts and require rework.

Once #5357 is merged, this issue is ready for implementation with the updated single-installer approach.

Severity: Low (code quality / maintainability improvement, no user-facing defect)
Category: Refactoring

Blocked by:

• fix(version)!: resolve CLI version from reusable workflow ref #5357

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 6:39 AM UTC · Completed 6:41 AM UTC
Commit: d72d648 · View workflow run →

[fullsend-ai-triage]

Re-triage update

The blocking dependency identified in the prior triage is still active — PR #5357 remains open and unmerged. That PR modifies the SHA-to-tag resolution and source-build fallback logic in root action.yml, which is exactly the code this issue proposes to consolidate. Landing this refactor before #5357 would create merge conflicts.

The updated approach (consolidate into one single installer action/script, per the maintainer discussion) is still the plan.

Once #5357 merges, this issue is ready for implementation.

Severity: Low (code quality / maintainability improvement, no user-facing defect)
Category: Refactoring

Blocked by:

• fix(version)!: resolve CLI version from reusable workflow ref #5357

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:19 AM UTC · Completed 7:21 AM UTC
Commit: d72d648 · View workflow run →

[fullsend-ai-triage]

Re-triage update

The blocking dependency identified in prior triage is still active — PR #5357 remains open and unmerged. That PR modifies the SHA-to-tag resolution and adds a source-build fallback with continue-on-error to root action.yml, which is exactly the code this issue proposes to consolidate. Landing this refactor before #5357 would create merge conflicts.

Updated approach (from maintainer discussion)

The approach was updated per the earlier discussion: instead of extracting a shared shell library sourced by both action files, the plan is to consolidate into one single installer action/script. This simplifies the design further — one canonical installer instead of two consumers of a shared library.

Scope of duplication (unchanged)

• OS/arch normalization — identical 11-line block in both files
• SHA-to-tag resolution — same goal, different implementations (curl + manual pagination vs gh api --paginate)
• retry_curl — defined twice within action.yml itself
• Source-build clone — nearly identical shallow-fetch-with-full-clone-fallback pattern

Once #5357 merges, this issue is ready for implementation with the single-installer approach.

Severity: Low (code quality / maintainability, no user-facing defect)
Category: Refactoring

Blocked by:

• fix(version)!: resolve CLI version from reusable workflow ref #5357