Deletion of 4.10.0 tag causing any workflow referencing this tag to not work

[frank-qcd-qk]

Describe the bug

As part of #333, the 4.10.0 tag was removed entirely. In my opinion this is excessive and introduces new issues, because any recently developed workflows that reference 4.10.0 are now broken.

The original concern was that the v4 tag should not include the 4.10.0 change. Addressing that doesn’t require deleting the 4.10.0 tag itself. A less disruptive fix would have been to point v4 back to the 4.9.x release and re-tag 4.10.0 to the previous 4.9.1 commit so that the tag remains available and existing workflows continue to work.

Current behavior

Error: Unable to resolve action `jfrog/setup-jfrog-cli@v4.10.0`, unable to find version `v4.10.0`

Reproduction steps

No response

Expected behavior

No response

Setup JFrog CLI version

4.10.0

JFrog CLI version

N/A

Workflow operating system type and version

Linux

JFrog Artifactory version (if relevant)

No response

JFrog Xray version (if relevant)

No response

[frank-qcd-qk]

CC @MaorEJFrog on this issue who supported the fix.

[ytausch]

+1, we pinned our actions with

uses: jfrog/setup-jfrog-cli@86dacb6974c66cc99e7651e1205f6581aaddba9a # v4.10.0

Since you deleted the v4.10.0 tag, Dependabot now breaks and tries to update to

// incorrect!
uses: jfrog/setup-jfrog-cli@fd83e886ae9f3eb231639555770350520afcb9c3 # v4.10.0

which is incorrect.

It is a known issue with Dependabot that it behaves incorrectly if there is a mismatch between the tag and the hash.

Please do not move or delete tags once released. A better fix would have been to release 4.10.1, which reverts the breaking change you introduced.

[MaorEJFrog]

Thanks for letting me know. @frank-qcd-qk @ytausch

I've addressed this with the following changes:

• Restored the v4.10.0 tag - workflows pinned to @v4.10.0 or the SHA 86dacb6... will resolve again. This should also fix the Dependabot SHA mismatch.

• Released v4.10.1 - this keeps the non-breaking changes from v4.10.0 (CLI upgrade to 2.91.0, test fixes) but reverts the node runtime to node20.

• Updated the v4 floating tag to point to v4.10.1, so @v4 users now get node20 + CLI 2.91.0.

• Node24 is available as v5.0.0 for users whose environments support it.

We apologize for the disruption. The lesson learned: tags should not be deleted once released - patch releases are the correct approach. Thank you again, guys.

If anything else comes up - please tag me.

[ytausch]

Thank you!