fix(ci): install gitsemver from its raw release binary

[piontec]

Part of giantswarm/giantswarm#37347 — Lack of schema testing in github-workflows lets bugs pass

Pre-emptive fix for the same bug that broke giantswarm/schemalint's action at v2.6.2 — found while investigating that outage (#262).

What actually caused the schemalint outage

Not the install-binary-action bump, and not really schemalint. The legacy
<repo>-v<version>-<platform>.tar.gz release assets are built by this repo, in
create-release.yaml's create_and_upload_build_artifacts job — which only runs when the caller
passes build-release-artifacts: true.

The chore: align files according to platform standards template drops that input. Every repo
it touches silently stops publishing tarballs at its next release, while install-binary-action's
default download_url (and every explicit tarball URL) still asks for them by name:

repo	build-release-artifacts	align-files PR that dropped it	released since?
schemalint	absent	giantswarm/schemalint#319 (2026-07-29)	yes → broke at v2.6.2
gitsemver	absent	giantswarm/gitsemver#260 (2026-06-11)	no — not yet
architect	absent	giantswarm/architect#1325 (2026-06-17)	yes, v8.3.0 is raw-binary-only
helm-values-gen	true	—	—
apptestctl	true	—	—

Why this matters here

We pin gitsemver-v${version}-linux-amd64.tar.gz in four places. It resolves today only because
the pinned v2.0.1 (2026-06-08) predates align-files #260 and therefore ships both asset
names. The next gitsemver release ships raw binaries only — and then create-release.yaml and
create-release-pr.yaml 404 for every repo in the org, since they are consumed at @main.

That is a much bigger blast radius than the schemalint incident, and it is armed right now.

The change

Four Install gitsemver steps switch to the raw asset and drop tarball_binary_path
(extension-less URLs skip unarchiving — install-binary-action >= v3.1.0):

-          download_url: ".../${version}/${binary}-${version}-linux-amd64.tar.gz"
-          tarball_binary_path: "*/${binary}"
+          download_url: ".../${version}/${binary}-linux-amd64"

create-release-pr.yaml already installs architect this way, so this just makes gitsemver
consistent with it.

Verification

No-op today, correct tomorrow — both asset names exist at the pinned v2.0.1:

$ curl -sSfL -o gsv https://github.com/giantswarm/gitsemver/releases/download/v2.0.1/gitsemver-linux-amd64
$ ./gsv --version
gitsemver version 2.0.1 (git: 31e7ecfa63d24e71f199d338d1ad0a6bfd0bb7fb, built: 2026-06-08T14:19:45Z)

The smoke_test is unchanged and still passes on the raw binary.

Not changed

apptestctl (gitops-validate.yaml) keeps its tarball URL — it still passes
build-release-artifacts: true, so its tarball is correct today. It becomes wrong the day
align-files reaches it. The durable fix belongs in the align-files template and in
install-binary-action's default URL; both are being raised upstream.

🤖 Generated with Claude Code