What happened
The scribe4jira repo's _reusable-scribe.yml used fullsend-ai/fullsend@3cfa255... (v0.32.0) with agent: __install_only__ but no explicit version input. The action resolved the CLI binary to latest (v0.39.0), creating a version matrix mismatch: the action SHA implied v0.32.0 behavior (openshell 0.0.83), but the CLI expected openshell 0.0.111+. PR #51 fixed this by adding version: v0.32.0 explicitly. The fact that SHA-pinning the action does not pin the CLI version is non-obvious and creates a latent failure mode.
What could go better
Users SHA-pin the action for reproducibility, but __install_only__ mode silently resolves the CLI to latest, undermining that intent. When a breaking change lands in a newer CLI version (like #6691's --detach requirement), repos with old SHA pins but no explicit version break without warning. This is a class of failure, not a one-off — any repo using __install_only__ without version is vulnerable to the next breaking CLI change. Medium-high confidence: the root cause is clear, but I am uncertain whether the action has access to its own version tag at runtime (SHA-referenced actions may not know their release version).
Proposed change
In the fullsend install action (action.yml), when agent is set to __install_only__ and version is not provided, either: (a) emit a prominent warning in the workflow log stating that the CLI will resolve to latest and recommending explicit version pinning, or (b) require version as a mandatory input when agent: __install_only__ is used (failing the action with a clear error if omitted). Option (a) is lower friction; option (b) prevents the failure entirely. If the action can determine its own release version from the checked-out ref, a third option is to default version to match the action's release tag.
Validation criteria
When the fullsend install action is invoked with agent: __install_only__ and no version input: (a) a warning or error appears in the workflow log mentioning the latest resolution risk, or (b) the action fails with a message directing the user to set version explicitly. Verify by creating a test workflow with agent: __install_only__ and no version input.
Generated by retro agent from https://github.com/konflux-ci/scribe4jira/pull/51
What happened
The scribe4jira repo's
_reusable-scribe.ymlusedfullsend-ai/fullsend@3cfa255...(v0.32.0) withagent: __install_only__but no explicitversioninput. The action resolved the CLI binary tolatest(v0.39.0), creating a version matrix mismatch: the action SHA implied v0.32.0 behavior (openshell 0.0.83), but the CLI expected openshell 0.0.111+. PR #51 fixed this by addingversion: v0.32.0explicitly. The fact that SHA-pinning the action does not pin the CLI version is non-obvious and creates a latent failure mode.What could go better
Users SHA-pin the action for reproducibility, but
__install_only__mode silently resolves the CLI tolatest, undermining that intent. When a breaking change lands in a newer CLI version (like #6691's--detachrequirement), repos with old SHA pins but no explicitversionbreak without warning. This is a class of failure, not a one-off — any repo using__install_only__withoutversionis vulnerable to the next breaking CLI change. Medium-high confidence: the root cause is clear, but I am uncertain whether the action has access to its own version tag at runtime (SHA-referenced actions may not know their release version).Proposed change
In the fullsend install action (
action.yml), whenagentis set to__install_only__andversionis not provided, either: (a) emit a prominent warning in the workflow log stating that the CLI will resolve tolatestand recommending explicit version pinning, or (b) requireversionas a mandatory input whenagent: __install_only__is used (failing the action with a clear error if omitted). Option (a) is lower friction; option (b) prevents the failure entirely. If the action can determine its own release version from the checked-out ref, a third option is to defaultversionto match the action's release tag.Validation criteria
When the fullsend install action is invoked with
agent: __install_only__and noversioninput: (a) a warning or error appears in the workflow log mentioning thelatestresolution risk, or (b) the action fails with a message directing the user to setversionexplicitly. Verify by creating a test workflow withagent: __install_only__and noversioninput.Generated by retro agent from https://github.com/konflux-ci/scribe4jira/pull/51