[rgarcia]

Summary

Fixes for the CLI coverage updater, found while reviewing the Node SDK's docs updater (kernel-node-sdk#225).

• It ran before the release was tagged. The workflow triggered on push to main, which happens before release-please creates the tag and GitHub release. On 2026-10-30 the run started at 06:02:31, and v0.138.0 was tagged at 06:03:04. git describe found no tag, so the version fell back to the commit SHA, and CLI: Update Go SDK to 738369d524a3806832577f6793dde7eaf15c5725 cli#304 is titled CLI: Update Go SDK to 738369d5…. Had go get run before the tag existed, it would have pinned a pseudo-version. The workflow now triggers on release: published, like the Node SDK's MCP updater, and takes the version from the release tag. Non-release pushes to main, such as workflow changes, no longer start a full agent run.
• The PR description only covered the latest release. The baseline SDK version was read from the evergreen branch's go.mod, so each run diffed only since the previous bot commit, and the PR body was replaced with that increment's report. CLI: Update Go SDK to 738369d524a3806832577f6793dde7eaf15c5725 cli#304 holds bumps from v0.131.0 through v0.138.0. The baseline now comes from CLI origin/main's go.mod, so each run audits every release since main. The prompt tells the agent to keep earlier coverage on the branch and to describe the whole PR in its report.
• The spec can be ahead of the SDK. The spec is fetched from the API's main branch at release time. The prompt now says the SDK defines what exists, and the spec is only used for the meaning of things the SDK has.

Testing

• actionlint passes. Shellcheck only reports the same info-level SC2086 findings as main.
• Checked locally that go mod edit -json on git show origin/main:go.mod from kernel/cli returns the pinned SDK version (v0.131.0).
• The updated workflow hasn't run in Actions yet. It will first run on the next Go SDK release, or now via workflow_dispatch.

[rgarcia]

Closing: custom code goes through the staging SDK repo. Will reopen there.