Pin the installer script and declare the CLI version

[jlaneve]

Description

Install Astro CLI fetched godownloader.sh from astronomer/astro-cli@main and piped it to bash. main is mutable, so a merge there changes what runs in a caller's CI. A security review at a prospect flagged the same line in deploy-action, which shipped the fix in v0.15.0; this is the matching change here.

The URL now names a commit. It appears twice, so it moved into GODOWNLOADER_URL. A commit and not a tag for two reasons: a tag can be moved and GitHub resolves it at fetch time, so the bytes can change under a fixed URL; and astro-cli's copy at a release tag names the release before it, because the bump PR targets main while GA tags are cut from release-X.Y branches that never receive it.

version also picks up a real default. "" did not mean "latest" — it meant the installer chose, and the installer read a hardcoded constant on astro-cli's main that only catches up when a human merges the post-release bump PR. That lag has run from 9 minutes to 13 days: v1.41.0 shipped on 31 March and the constant was not bumped until 13 April, so for two weeks an unset version installed 1.40.1 while logging Using Latest(v1.40.1). Pinning the script alone would have frozen that at the pinned commit's 1.44.0. The version belongs on the input, where it shows in a diff and reads as a version rather than a hash.

1.45.0 is what an unset version installs today, so nobody's CLI moves. Anyone wanting to track the newest has no option in this change — version: latest is the follow-up, and it needs astro-cli v1.46.0 first, since it reads the install.sh asset that astronomer/astro-cli#2252 publishes and no released version carries one yet.

Call-stack diff

  Install Astro CLI                        action.yaml
  └─ INPUT_VERSION=${{ inputs.version }}
+    │                                     # now "1.45.0", not ""
     ├─ astro already on PATH?             # unchanged, short circuits
     ├─ download-url set?                  # unchanged, short circuits
     └─ curl installer | bash
-       └─ raw/astro-cli/main/godownloader.sh
+       └─ raw/astro-cli/0dfc4bff/godownloader.sh

Unchanged: the install directory, both outputs, and the two download-url paths.

🎟 Issue(s)

Related: astronomer/deploy-action#160

🧪 Functional Testing

The three existing jobs cover the already-in-PATH skip and both download-url paths. None of them touched the installer, which is the only path this changes — so this adds two that do:

• default version installs what the input declares — reads inputs.version.default out of action.yaml, installs with no inputs, and asserts astro version matches. A pin naming a version that does not exist now fails CI instead of shipping.
• explicit version is honoured — installs 1.44.0 and asserts it.

The first is the one worth having. It follows the default automatically, so it keeps checking the pin after someone bumps it.

Run by hand before pushing, since the workflow only runs on push:

$ curl -sSL raw.../astro-cli/0dfc4bff.../godownloader.sh | bash -s -- -b /tmp/bin v1.45.0
checking GitHub for tag 'v1.45.0'
found version: 1.45.0 for v1.45.0/linux/arm64
Astro CLI Version: 1.45.0

yamllint passes on both files with the repo config, reporting only the pre-existing on: truthy warning.

One behaviour note for review: with an explicit version, godownloader.sh resolves the tag through api.github.com, which it skipped when the version was empty and it used its own constant. That is an unauthenticated call, 60/hour per IP, and runners share addresses. It is the same path every existing caller of version: already takes, but it is now the default path. The install.sh follow-up removes it, since a stamped installer needs no lookup.

📸 Screenshots

N/A.

📋 Checklist

• Rebased from the main (or release if patching) branch (before testing)
• Ran make test before taking out of draft — no Go code; this repo has no Makefile
• Ran make lint before taking out of draft — ran yamllint with the repo config instead
• Added/updated applicable tests — two new jobs covering the installer path
• Tested against Astro-API (if necessary).
• Tested against Houston-API and Astronomer (if necessary).
• Communicated to/tagged owners of respective clients potentially impacted by these changes. — callers pin @v0.0.1, so nothing on main reaches them until a new tag is cut; the README still points at @v0.0.1 and should be bumped with that release
• Updated any related documentation — README input table