refactor: centralize release-tool version pin

Centralize the default release-tool PHAR version inside setup-release-tool, keep version as an optional override, remove stale internal pins, and preserve checksum verification.

Signed-off-by: Vitor Mattos <vitor@php.rio>

Author: vitormattos

actions/release-plan/action.yml

@@ -61,8 +61,6 @@ runs:
     - id: setup
       name: Setup release-tool
       uses: $/actions/setup-release-tool
-      with:
-        version: '0.2.0'
 
     - id: plan
       name: Build ReleasePlan v1

actions/setup-release-tool/action.yml

@@ -5,8 +5,9 @@ name: Setup release-tool
 description: Install an exact LibreCode release-tool PHAR release and verify its published SHA-256.
 inputs:
   version:
-    description: Exact release-tool semantic version, without a leading v.
-    required: true
+    description: Optional exact release-tool semantic version override, without a leading v.
+    required: false
+    default: ''
 outputs:
   path:
     description: Absolute path to the verified release-tool PHAR.

actions/setup-release-tool/release-tool-version

@@ -0,0 +1 @@
+0.5.0

actions/setup-release-tool/release-tool-version.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+SPDX-License-Identifier: AGPL-3.0-or-later

actions/setup-release-tool/setup.sh

@@ -4,7 +4,11 @@
 
 set -euo pipefail
 
-version="${RELEASE_TOOL_VERSION:?release-tool version is required}"
+version="${RELEASE_TOOL_VERSION:-}"
+if [[ -z "${version}" ]]; then
+	version_file="${GITHUB_ACTION_PATH:?github action path is required}/release-tool-version"
+	version="$(tr -d '[:space:]' < "${version_file}")"
+fi
 
 if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
 	echo "::error::release-tool version must be an exact semantic version, got '${version}'"

tests/test_release_plan_action.py

@@ -14,7 +14,7 @@ def test_action_uses_exact_verified_release_tool(self) -> None:
         content = ACTION.read_text(encoding="utf-8")
 
         self.assertIn("uses: $/actions/setup-release-tool", content)
-        self.assertIn("version: '0.2.0'", content)
+        self.assertNotIn("with:\n        version:", content)
         self.assertIn("release:plan", content)
         self.assertIn("--release-version", content)
         self.assertNotIn("python3", content)

tests/test_setup_release_tool_action.py

@@ -10,12 +10,13 @@
 ROOT = Path(__file__).resolve().parents[1]
 SCRIPT = ROOT / "actions" / "setup-release-tool" / "setup.sh"
 ACTION = ROOT / "actions" / "setup-release-tool" / "action.yml"
+VERSION = ROOT / "actions" / "setup-release-tool" / "release-tool-version"
 
 
 class SetupReleaseToolActionTest(unittest.TestCase):
     def run_script(
         self,
-        version: str,
+        version: str | None,
         *,
         fake_download: bool = False,
         checksum_mismatch: bool = False,
@@ -26,12 +27,15 @@ def run_script(
             output = root / "output"
             path_file = root / "path"
             env = os.environ | {
-                "RELEASE_TOOL_VERSION": version,
+                "GITHUB_ACTION_PATH": str(SCRIPT.parent),
                 "RUNNER_TEMP": str(root),
                 "GITHUB_OUTPUT": str(output),
                 "GITHUB_PATH": str(path_file),
             }
 
+            if version is not None:
+                env["RELEASE_TOOL_VERSION"] = version
+
             if fake_download:
                 fake_bin = root / "bin"
                 fake_bin.mkdir()
@@ -87,13 +91,21 @@ def run_script(
                 path_file.read_text(encoding="utf-8") if path_file.exists() else "",
             )
 
-    def test_action_exposes_only_exact_version_input(self) -> None:
+    def test_action_exposes_optional_exact_version_override(self) -> None:
         content = ACTION.read_text(encoding="utf-8")
 
         self.assertIn("version:", content)
-        self.assertNotIn("latest", content.lower())
+        self.assertIn("required: false", content)
+        self.assertIn("default: ''", content)
         self.assertIn("setup.sh", content)
 
+    def test_default_version_is_centralized_in_action_directory(self) -> None:
+        result, output, path_file = self.run_script(None, fake_download=True)
+
+        self.assertEqual(0, result.returncode, result.stderr)
+        self.assertIn("version=0.5.0", output)
+        self.assertIn("librecode-release-tool/0.5.0", path_file)
+
     def test_rejects_latest_before_network_access(self) -> None:
         result, _, _ = self.run_script("latest")
 
@@ -141,6 +153,7 @@ def test_script_downloads_phar_and_published_checksum_from_same_exact_tag(self)
         self.assertIn("releases/download/v${version}", content)
         self.assertIn("release-tool.phar.sha256", content)
         self.assertIn("sha256sum", content)
+        self.assertEqual("0.5.0", VERSION.read_text(encoding="utf-8").strip())
 
 
 if __name__ == "__main__":