feat(env): install mergify-cli from prebuilt binaries (#4)

Replace the uv + Python install path with the upstream prebuilt-binary
installer (install.sh), dropping the Python/uv dependency from agents.

install.sh is fetched from the same git ref as the requested release so
the script and the release assets always agree on the asset-naming
convention, which changed between releases (2026.6.15.1 ships unversioned
assets, 2026.6.16.1 versioned ones). "latest" uses main and lets
install.sh resolve the newest tag itself.

- hooks/environment: curl install.sh | sh, exporting MERGIFY_VERSION and
  MERGIFY_INSTALL_DIR; default bumped to 2026.6.16.1 (>= 2026.6.15.1
  required for prebuilt binaries).
- plugin.yml: drop the now-meaningless python_version; require tar.
- renovate.json: track GitHub releases instead of PyPI.
- README + tests updated accordingly.

mergify_cli_version keeps working (pinned version or "latest").

Fixes MRGFY-7661

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sileht

README.md

@@ -179,8 +179,7 @@ steps:
 | `mergify_api_url` | no | `https://api.mergify.com` | Mergify API endpoint |
 | `job_name` | no | Step label | Override job name (useful for matrix builds) |
 | `mergify_config_path` | no | — | Path to `.mergify.yml` configuration file |
-| `mergify_cli_version` | no | pinned default | Version of `mergify-cli` to install. Leave unset to use the plugin's pinned default (kept current by Renovate, see `hooks/environment`), pin an exact release (e.g. `2026.5.29.2`), or use `latest` to always install the newest released version. |
-| `python_version` | no | `3.13` | Python version for `mergify-cli`. Uses `uv` to download it if needed. Set to `system` to use the agent's system Python. |
+| `mergify_cli_version` | no | pinned default | Version of `mergify-cli` to install. Leave unset to use the plugin's pinned default (kept current by Renovate, see `hooks/environment`), pin an exact release (e.g. `2026.6.16.1`, must be `>= 2026.6.15.1`), or use `latest` to always install the newest released version. |
 
 ## Meta-data
 
@@ -199,8 +198,13 @@ The `mergify-cli` writes Buildkite annotations (context: `mergify-ci-scopes`) sh
 
 ## Requirements
 
-- Python 3.x on the Buildkite agent
-- `curl` (for installing `uv`)
+`mergify-cli` is installed as a prebuilt binary (no Python required), downloaded
+and checksum-verified by the upstream [`install.sh`](https://github.com/Mergifyio/mergify-cli/blob/main/install.sh).
+Supported platforms: Linux (x86_64, aarch64) and macOS (x86_64, aarch64).
+
+- `curl` (to download the installer and the binary)
+- `tar` (to extract the binary)
+- `sha256sum` or `shasum` (to verify the binary checksum)
 - `jq` (for JSON processing in `scopes-upload`)
 
 ## Development

hooks/environment

@@ -7,43 +7,36 @@ source "${DIR}/../lib/shared.sh"
 
 log_info "Installing mergify-cli..."
 
-# Install uv if not available
-if ! command -v uv &>/dev/null; then
-  echo "uv not found, installing..."
-  curl -LsSf https://astral.sh/uv/install.sh | sh
-  export PATH="$HOME/.local/bin:$PATH"
-fi
-
 # Default mergify-cli release installed when the plugin config doesn't request a
-# specific one. Renovate keeps this pinned version current via PRs.
-# renovate: datasource=pypi depName=mergify-cli versioning=pep440
-DEFAULT_MERGIFY_CLI_VERSION="2026.5.29.2"
+# specific one. Must be >= 2026.6.15.1 (the first release shipping the prebuilt
+# binaries and the install.sh used below). Renovate keeps this pinned current.
+# renovate: datasource=github-releases depName=Mergifyio/mergify-cli versioning=pep440
+DEFAULT_MERGIFY_CLI_VERSION="2026.6.16.1"
 
-# Resolve the requested release. An explicit "latest" installs the newest release
-# unpinned; anything else (including the default above) pins it with ==.
+# Resolve the requested release. An explicit "latest" installs the newest
+# release; anything else (including the default above) pins that exact tag.
 CLI_VERSION="$(plugin_config MERGIFY_CLI_VERSION "$DEFAULT_MERGIFY_CLI_VERSION")"
+
+# Install from the upstream prebuilt-binary installer. We fetch install.sh from
+# the same git ref as the requested release so the script and the release assets
+# always agree on the asset-naming convention (it changed across releases). For
+# "latest" we use main and let install.sh resolve the newest tag itself.
 if [[ "$CLI_VERSION" == "latest" ]]; then
-  CLI_PACKAGE="mergify-cli"
+  INSTALL_REF="main"
 else
-  CLI_PACKAGE="mergify-cli==$CLI_VERSION"
+  INSTALL_REF="$CLI_VERSION"
 fi
+export MERGIFY_VERSION="$CLI_VERSION"
 
-# Install (or upgrade) mergify-cli. --force --upgrade ensures we always pick up
-# the requested release, even when a different version is already cached on the
-# agent from a previous build. With a pinned version the == constraint keeps the
-# resolution at that exact release.
-PYTHON_VERSION="$(plugin_config PYTHON_VERSION "3.13")"
-if [[ "$PYTHON_VERSION" == "system" ]]; then
-  uv tool install --force --upgrade "$CLI_PACKAGE"
-else
-  uv tool install --force --upgrade --python "$PYTHON_VERSION" "$CLI_PACKAGE"
-fi
+# install.sh drops the binary in MERGIFY_INSTALL_DIR (default ~/.local/bin);
+# make sure it is resolvable for the rest of the build.
+export MERGIFY_INSTALL_DIR="${MERGIFY_INSTALL_DIR:-$HOME/.local/bin}"
+export PATH="$MERGIFY_INSTALL_DIR:$PATH"
+
+curl -fsSL "https://raw.githubusercontent.com/Mergifyio/mergify-cli/${INSTALL_REF}/install.sh" | sh
 
-# Verify installation
+# Verify installation (install.sh already printed the version above).
 if ! command -v mergify &>/dev/null; then
   log_error "mergify-cli installation failed."
-  log_error "Try setting python_version in the plugin config (e.g., python_version: '3.13')."
   exit 1
 fi
-
-mergify --version

plugin.yml

@@ -3,6 +3,7 @@ description: Mergify integration for Buildkite — JUnit processing, scope detec
 author: https://github.com/mergifyio
 requirements:
   - curl
+  - tar
   - bash
   - jq
 configuration:
@@ -28,8 +29,6 @@ configuration:
       type: string
     mergify_cli_version:
       type: string
-    python_version:
-      type: string
   required:
     - action
   additionalProperties: false

renovate.json

@@ -10,8 +10,8 @@
   "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
-      "matchDatasources": ["pypi"],
-      "matchPackageNames": ["mergify-cli"],
+      "matchDatasources": ["github-releases"],
+      "matchPackageNames": ["Mergifyio/mergify-cli"],
       "minimumReleaseAge": "2 days"
     }
   ],

tests/environment.bats

@@ -2,9 +2,10 @@
 
 setup() {
   load helpers/stub
-  # Stub uv (records its args) and mergify (so the post-install check passes).
-  stub_command uv 0
-  stub_command mergify 0 "mergify-cli 0.0.0-stub"
+  # Install into a throwaway dir so the hook never touches the real ~/.local/bin.
+  export MERGIFY_INSTALL_DIR="${BATS_TEST_TMPDIR}/bin"
+  # Stub curl so the hook downloads a fake install.sh instead of hitting GitHub.
+  stub_curl_install
 }
 
 @test "environment: installs the pinned default when version is unset" {
@@ -14,33 +15,41 @@ setup() {
   # Read the default straight from the hook so this stays green when Renovate
   # bumps DEFAULT_MERGIFY_CLI_VERSION.
   default="$(grep -oE 'DEFAULT_MERGIFY_CLI_VERSION="[^"]+"' hooks/environment | cut -d'"' -f2)"
-  grep -q -- "tool install --force --upgrade --python 3.13 mergify-cli==${default}$" "${BATS_TEST_TMPDIR}/uv.log"
+  grep -q -- "raw.githubusercontent.com/Mergifyio/mergify-cli/${default}/install.sh$" "${BATS_TEST_TMPDIR}/curl.log"
+  [[ "$output" == *"installed MERGIFY_VERSION=${default}"* ]]
 }
 
-@test "environment: installs latest when version is 'latest'" {
+@test "environment: installs latest from main when version is 'latest'" {
   export BUILDKITE_PLUGIN_MERGIFY_CI_MERGIFY_CLI_VERSION="latest"
 
   run bash hooks/environment
 
   [ "$status" -eq 0 ]
-  grep -q -- "tool install --force --upgrade --python 3.13 mergify-cli$" "${BATS_TEST_TMPDIR}/uv.log"
+  grep -q -- "raw.githubusercontent.com/Mergifyio/mergify-cli/main/install.sh$" "${BATS_TEST_TMPDIR}/curl.log"
+  [[ "$output" == *"installed MERGIFY_VERSION=latest"* ]]
 }
 
-@test "environment: pins the exact version when one is given" {
-  export BUILDKITE_PLUGIN_MERGIFY_CI_MERGIFY_CLI_VERSION="2026.5.5.4"
+@test "environment: pins install.sh and version to the requested release" {
+  export BUILDKITE_PLUGIN_MERGIFY_CI_MERGIFY_CLI_VERSION="2026.6.15.1"
 
   run bash hooks/environment
 
   [ "$status" -eq 0 ]
-  grep -q -- "tool install --force --upgrade --python 3.13 mergify-cli==2026.5.5.4$" "${BATS_TEST_TMPDIR}/uv.log"
+  grep -q -- "raw.githubusercontent.com/Mergifyio/mergify-cli/2026.6.15.1/install.sh$" "${BATS_TEST_TMPDIR}/curl.log"
+  [[ "$output" == *"installed MERGIFY_VERSION=2026.6.15.1"* ]]
 }
 
-@test "environment: omits --python when python_version is 'system'" {
-  export BUILDKITE_PLUGIN_MERGIFY_CI_PYTHON_VERSION="system"
-  export BUILDKITE_PLUGIN_MERGIFY_CI_MERGIFY_CLI_VERSION="2026.5.5.4"
+@test "environment: fails when the binary is not installed" {
+  # curl that downloads an installer doing nothing — no mergify binary appears.
+  cat > "${BATS_TEST_TMPDIR}/stubs/curl" <<'STUB'
+#!/bin/bash
+echo ':'
+STUB
+  chmod +x "${BATS_TEST_TMPDIR}/stubs/curl"
 
-  run bash hooks/environment
+  # Minimal PATH so a real mergify on the dev machine can't mask the failure.
+  PATH="${BATS_TEST_TMPDIR}/stubs:/usr/bin:/bin" run bash hooks/environment
 
-  [ "$status" -eq 0 ]
-  grep -q -- "tool install --force --upgrade mergify-cli==2026.5.5.4$" "${BATS_TEST_TMPDIR}/uv.log"
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"mergify-cli installation failed"* ]]
 }

tests/helpers/stub.bash

@@ -22,6 +22,31 @@ STUB
   export PATH="${stub_dir}:${PATH}"
 }
 
+# Stub `curl` for the environment hook. Records argv to curl.log, then prints a
+# fake install.sh on stdout. When the hook pipes it to `sh`, the script installs
+# a `mergify` stub into MERGIFY_INSTALL_DIR and echoes the MERGIFY_VERSION the
+# hook exported, so tests can assert both the install.sh URL and the version.
+stub_curl_install() {
+  local stub_dir="${BATS_TEST_TMPDIR}/stubs"
+  mkdir -p "$stub_dir"
+  # Fully-quoted heredoc: nothing expands at stub-creation time. The inner
+  # 'SCRIPT' heredoc keeps ${MERGIFY_*} literal on stdout so they expand only
+  # in the `sh` that consumes the piped installer.
+  cat > "${stub_dir}/curl" <<'STUB'
+#!/bin/bash
+echo "$@" >> "${BATS_TEST_TMPDIR}/curl.log"
+cat <<'SCRIPT'
+#!/bin/sh
+mkdir -p "${MERGIFY_INSTALL_DIR}"
+printf '#!/bin/bash\necho "mergify-cli 0.0.0-stub"\n' > "${MERGIFY_INSTALL_DIR}/mergify"
+chmod +x "${MERGIFY_INSTALL_DIR}/mergify"
+echo "installed MERGIFY_VERSION=${MERGIFY_VERSION}"
+SCRIPT
+STUB
+  chmod +x "${stub_dir}/curl"
+  export PATH="${stub_dir}:${PATH}"
+}
+
 # Create a buildkite-agent stub that handles meta-data set/get.
 # Meta-data is stored in files under BATS_TEST_TMPDIR/metadata/.
 stub_buildkite_agent() {