Bug: Composite action 'Resolve cora-cli version' step crashes with KeyError on API failure #102

Bug Description

The composite action step "Resolve cora-cli version" in .github/actions/cora-review/action.yml crashes with KeyError: 'tag_name' when the GitHub API request to api.github.com/repos/ajianaz/cora-cli/releases/latest fails or returns unexpected data.

Root Cause

VERSION=$(curl -sL https://api.github.com/repos/ajianaz/cora-cli/releases/latest | python3 -c "import sys,json; print(json.load(sys.stdin)['tag_name'])")

Problems:

1. curl -sL without -f — silently accepts HTTP error pages (404, 403, 429 rate limit). curl returns the HTML error body, not JSON.
2. No error handling — if the API response is not JSON (rate limit HTML, network error), json.load() will either throw json.JSONDecodeError or succeed but ["tag_name"] throws KeyError.
3. No retry — single attempt, no fallback.

Steps to Reproduce

1. Trigger a PR on any repo using the cora-review composite action
2. If GitHub API rate limits or returns non-JSON response, the step crashes
3. Observed in uteke PR release: v0.1.8 #111: KeyError: 'tag_name' → step exit 1 → PR blocked

Expected Behavior

• Graceful fallback: if API fails, use a hardcoded fallback version or retry
• Step should not crash the entire CI pipeline

Suggested Fix

if [ "${{ inputs.cora-version }}" = "latest" ]; then
  # Try up to 3 times with 5s delay
  for i in 1 2 3; do
    VERSION=$(curl -sfL --retry 3 --retry-delay 2 --connect-timeout 10 \
      https://api.github.com/repos/ajianaz/cora-cli/releases/latest \
      | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tag_name', ''))" 2>/dev/null)
    if [ -n "$VERSION" ]; then
      break
    fi
    echo "Attempt $i failed, retrying..."
    sleep 5
  done
  # Fallback to a known good version if all retries fail
  if [ -z "$VERSION" ]; then
    echo "::warning::Failed to resolve latest cora-cli version from GitHub API, using fallback"
    VERSION="v0.1.6"  # Update this as new releases ship
  fi
else
  VERSION="${{ inputs.cora-version }}"
fi
echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
echo "Resolved cora-cli version: $VERSION"

Severity

High — breaks CI on any repo using the composite action when GitHub API is rate-limited or returns errors.

Environment

• Composite action: .github/actions/cora-review/action.yml (used in uteke, cora-cli itself)
• GitHub Actions runner: ubuntu-latest
• Observed: uteke PR release: v0.1.8 #111 (2026-06-01) — KeyError: 'tag_name' causing Cora Review step to fail