copilot-cli: `prerelease` channel uses alphabetic tag sort, resolves to v1.0.9 instead of latest

[colbylwilliams]

Summary

The copilot-cli feature's prerelease channel resolves the install candidate with git ls-remote --tags … | tail -1, which sorts tags alphabetically. As of today (2026-05-11) this picks v1.0.9 when the actual latest tag is v1.0.45 (and the latest pre-release is v1.0.45-N once one publishes). Anyone selecting version: prerelease ends up on a months-old build.

Reproduction

# What the feature picks today (alphabetic sort, current code):
git ls-remote --tags https://github.com/github/copilot-cli | tail -1 | awk -F/ '{print $NF}'
# → v1.0.9

# Actual latest semver tag:
git ls-remote --tags https://github.com/github/copilot-cli \
  | awk '{print $2}' | sed 's|refs/tags/||' \
  | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?' \
  | sort -V | tail -1
# → v1.0.45

In a real codespace this surfaces as copilot --version reporting an old release, missing newer JSON-RPC methods (e.g. session.permissions.setApproveAll only landed in v1.0.40), and hitting -32601 Method not found errors at runtime that aren't visible at install time.

Affected code

src/copilot-cli/install.sh (around the elif [ \"\${CLI_VERSION}\" = \"prerelease\" ] branch):

prerelease_version="$(git ls-remote --tags https://github.com/github/copilot-cli | tail -1 | awk -F/ '{print $NF}')"

Suggested fix

Sort by version (sort -V) and filter to well-formed vX.Y.Z[-N] tags so stray refs can't sneak through:

prerelease_version="$(
    git ls-remote --tags https://github.com/github/copilot-cli \
        | awk '{print $2}' | sed 's|refs/tags/||' \
        | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?' \
        | sort -V | tail -n1
)"

This is the same data source — just sorted correctly.

Why not use the GitHub API?

api.github.com/.../releases?per_page=1 would also work, but git ls-remote doesn't require auth and matches the pattern already in the file.

Related precedent

#1598 fixed an analogous "latest resolution" bug in the dotnet feature.