fix(action): Resolve major tag to matching binary (#889)

## Summary
- Resolve moving action refs such as `getsentry/craft@v2` to the release
version recorded in that action revision’s `package.json`. The current
`v2` ref points to 2.33.0, but no GitHub release named `v2` exists, so
the action previously downloaded the latest release instead.
- Fail closed if the major tag points to a prerelease or different
major, or if the matching release asset is missing. Keep explicit
`craft_version` and `latest` support.

## Validation
- A regression failed before the fix. Focused action tests: 37 passed.
Full Vitest: 1,242 passed, 1 skipped across 62 files.
- Typecheck, lint (0 errors, 7 existing warnings), format, build, and
shell syntax checks passed.
- Verified `v2` and `2.33.0` tags point to the same release commit and
`v2` contains package version 2.33.0.

Co-authored-by: GPT-6 Sol (OpenAI) <agent@openai.com>

Author: BYK

.github/scripts/resolve-craft-version.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 3 ]]; then
+  echo "Expected the requested version, action ref, and action path" >&2
+  exit 1
+fi
+
+version="$1"
+if [[ -z "$version" ]]; then
+  version="$2"
+fi
+
+if [[ "$version" =~ ^v([1-9][0-9]*)$ ]]; then
+  major="${BASH_REMATCH[1]}"
+  version="$(jq -er '.version | select(type == "string")' "$3/package.json")"
+  if [[ ! "$version" =~ ^${major}\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+    echo "The v${major} action ref does not point to a published v${major} version" >&2
+    exit 1
+  fi
+fi
+
+if [[ -z "$version" ]]; then
+  version="latest"
+fi
+
+if [[ ! "$version" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; then
+  echo "Invalid Craft release tag" >&2
+  exit 1
+fi
+
+printf '%s\n' "$version"

action.yml

@@ -41,7 +41,8 @@ inputs:
   craft_version:
     description: >
       Version of Craft to install (tag or "latest").
-      Defaults to the action ref (e.g., "v2") if not specified.
+      Defaults to the action ref; major refs such as "v2" select the
+      corresponding version from the action's package.json.
     required: false
     default: ''
 
@@ -130,6 +131,7 @@ runs:
       env:
         CRAFT_VERSION_INPUT: ${{ inputs.craft_version }}
         ACTION_REF: ${{ github.action_ref }}
+        ACTION_PATH: ${{ github.action_path }}
       run: |
         set -euo pipefail
 
@@ -138,25 +140,19 @@ runs:
           sudo install -m 755 /tmp/craft-artifact/dist/craft /usr/local/bin/craft
         else
           # Download from release (for external repos or if artifact unavailable)
-          # Use explicit craft_version input if provided, otherwise fall back to ACTION_REF
-          CRAFT_VERSION="$CRAFT_VERSION_INPUT"
-          if [[ -z "$CRAFT_VERSION" ]]; then
-            CRAFT_VERSION="$ACTION_REF"
-          fi
+          CRAFT_VERSION="$(bash "$ACTION_PATH/.github/scripts/resolve-craft-version.sh" "$CRAFT_VERSION_INPUT" "$ACTION_REF" "$ACTION_PATH")"
 
-          if [[ "$CRAFT_VERSION" == "latest" || -z "$CRAFT_VERSION" ]]; then
+          if [[ "$CRAFT_VERSION" == "latest" ]]; then
             echo "Downloading latest Craft release..."
             CRAFT_URL=$(curl -fsSL "https://api.github.com/repos/getsentry/craft/releases/latest" \
               | jq -r '.assets[] | select(.name == "craft") | .browser_download_url')
           else
             CRAFT_URL="https://github.com/getsentry/craft/releases/download/${CRAFT_VERSION}/craft"
             echo "Downloading Craft ${CRAFT_VERSION} from: ${CRAFT_URL}"
 
-            # Fallback to latest if specified version doesn't have a release
             if ! curl -sfI "$CRAFT_URL" >/dev/null 2>&1; then
-              echo "Release not found for version '${CRAFT_VERSION}', falling back to latest..."
-              CRAFT_URL=$(curl -fsSL "https://api.github.com/repos/getsentry/craft/releases/latest" \
-                | jq -r '.assets[] | select(.name == "craft") | .browser_download_url')
+              echo "::error::Craft release '${CRAFT_VERSION}' has no downloadable binary."
+              exit 1
             fi
           fi
 

src/__tests__/action.test.ts

@@ -159,6 +159,104 @@ test('forwards workspace input to every Craft command', () => {
   );
 });
 
+test('resolves a moving major action tag to its matching release', () => {
+  const environment = createActionEnvironment();
+  writeFileSync(
+    join(environment.directory, 'package.json'),
+    JSON.stringify({ version: '2.33.0' }),
+  );
+
+  const result = spawnSync(
+    'bash',
+    [
+      join(__dirname, '../../.github/scripts/resolve-craft-version.sh'),
+      '',
+      'v2',
+      environment.directory,
+    ],
+    { encoding: 'utf8' },
+  );
+
+  expect(result.status).toBe(0);
+  expect(result.stdout.trim()).toBe('2.33.0');
+});
+
+test.each(['3.0.0', '2.34.0-dev.0', 'not-a-version'])(
+  'refuses a v2 action tag pointing at %s instead of using latest',
+  version => {
+    const environment = createActionEnvironment();
+    writeFileSync(
+      join(environment.directory, 'package.json'),
+      JSON.stringify({ version }),
+    );
+
+    const result = spawnSync(
+      'bash',
+      [
+        join(__dirname, '../../.github/scripts/resolve-craft-version.sh'),
+        '',
+        'v2',
+        environment.directory,
+      ],
+      { encoding: 'utf8' },
+    );
+
+    expect(result.status).not.toBe(0);
+    expect(result.stdout).toBe('');
+  },
+);
+
+test('does not install the latest release when a major-tagged binary is missing', () => {
+  const environment = createActionEnvironment();
+  const curlCalls = join(environment.directory, 'curl-calls');
+  const scriptsDirectory = join(environment.directory, '.github/scripts');
+  mkdirSync(scriptsDirectory, { recursive: true });
+  writeFileSync(
+    join(scriptsDirectory, 'resolve-craft-version.sh'),
+    readFileSync(
+      join(__dirname, '../../.github/scripts/resolve-craft-version.sh'),
+    ),
+  );
+  writeFileSync(
+    join(environment.directory, 'package.json'),
+    JSON.stringify({ version: '2.33.0' }),
+  );
+  writeFileSync(curlCalls, '');
+  writeFileSync(
+    join(environment.binDirectory, 'curl'),
+    '#!/usr/bin/env bash\nprintf "%s\\n" "$*" >> "$CURL_CALLS"\nexit 22\n',
+  );
+  writeFileSync(
+    join(environment.binDirectory, 'sudo'),
+    '#!/usr/bin/env bash\nexit 99\n',
+  );
+  chmodSync(join(environment.binDirectory, 'curl'), 0o755);
+  chmodSync(join(environment.binDirectory, 'sudo'), 0o755);
+
+  const result = spawnSync(
+    'bash',
+    ['-e', '-c', getActionStep('Install Craft from artifact or release').run!],
+    {
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        ACTION_PATH: environment.directory,
+        ACTION_REF: 'v2',
+        CRAFT_VERSION_INPUT: '',
+        CURL_CALLS: curlCalls,
+        PATH: `${environment.binDirectory}:${process.env.PATH}`,
+      },
+    },
+  );
+
+  expect(result.status).toBe(1);
+  expect(result.stdout).toContain("Craft release '2.33.0'");
+  expect(readFileSync(curlCalls, 'utf8')).toContain(
+    '/releases/download/2.33.0/craft',
+  );
+  expect(readFileSync(curlCalls, 'utf8')).not.toContain('/releases/latest');
+});
+
 test.each([
   ['control', 'cli\tnext'],
   ['format', 'cli\u202enext'],