- cli-release.yml: workflow_dispatch/workflow_call/repository_dispatch/tag
triggers; version sourced from cli/package.json (not the trigger). Split into
validate + release jobs with an idempotency guard (gh release view) and a
tag-vs-manifest match guard so a difyctl-v* tag push must equal the manifest
version (prevents a dangling/mismatched tag). Releases may be cut from any
branch. Concurrency serialized (fixed group, cancel-in-progress: false) so
releases never double-publish.
- install-cli.sh: tokenless resolution via git/matching-refs, channel-aware
(stable/rc) selection, fail-closed sha256 verification; distinguishes a fetch
failure (network / API rate limit) from "no release found".
- install.ps1: Windows installer at parity with install-cli.sh.
- install-cli.test.ts: resolver unit tests (rc ordering, channel filter).
- .bun-version: pin Bun 1.3.11 for reproducible --compile builds.
