From 6bf1d4e71ed45abcf8a638acfa773c2f49ce3ab4 Mon Sep 17 00:00:00 2001
From: Herve Labas <herve@checklyhq.com>
Date: Thu, 9 Jul 2026 13:01:20 +0200
Subject: [PATCH 1/7] Test unsupported command rejection

---
 scripts/test.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/test.sh b/scripts/test.sh
index 92cdfc9..1fa52fa 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -72,6 +72,11 @@ assert_contains "$trigger_command_output" "--tags production"
 assert_contains "$trigger_command_output" "--check-id abc\\,def"
 assert_contains "$trigger_command_output" "--no-fail-on-no-matching"
 
+assert_fails_with "Unsupported command 'deploy'" env \
+  INPUT_COMMAND=deploy \
+  CHECKLY_ACTION_DRY_RUN=1 \
+  "$ROOT_DIR/scripts/run.sh"
+
 fallback_command_output="$(
   INPUT_COMMAND=test \
   INPUT_CLI_VERSION=8.12.0 \

From a71ed00ae9b47c7e183fb8a1c2ef521770ecfa24 Mon Sep 17 00:00:00 2001
From: Herve Labas <herve@checklyhq.com>
Date: Thu, 9 Jul 2026 18:40:23 +0200
Subject: [PATCH 2/7] Add GitHub check name input

---
 README.md       |  2 ++
 action.yml      |  4 ++++
 scripts/run.sh  | 13 ++++++++++++-
 scripts/test.sh |  3 ++-
 4 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 44c2c0a..a2027df 100644
--- a/README.md
+++ b/README.md
@@ -29,6 +29,7 @@ jobs:
           install-command: npm ci
           tags: production,webapp
           grep: checkout
+          check-name: Checkly PR code checks
         env:
           CHECKLY_API_KEY: ${{ secrets.CHECKLY_API_KEY }}
           CHECKLY_ACCOUNT_ID: ${{ secrets.CHECKLY_ACCOUNT_ID }}
@@ -102,6 +103,7 @@ target URL explicitly through `env` or the workflow `env` block.
 | `fail-on-no-matching` | `trigger` only. Set to `false` to pass `--no-fail-on-no-matching`. |
 | `verbose` | Set to `true` or `false` to pass `--verbose` or `--no-verbose`. |
 | `reporting` | Where to report the Checkly result: `auto`, `github-check`, or `github-actions`. Defaults to `auto`. |
+| `check-name` | GitHub Check name used when reporting through the Checkly GitHub App. Defaults to `Checkly`. |
 
 ## Outputs
 
diff --git a/action.yml b/action.yml
index 0152635..ead5045 100644
--- a/action.yml
+++ b/action.yml
@@ -79,6 +79,9 @@ inputs:
     description: Where to report the Checkly result. Use "auto", "github-check", or "github-actions".
     required: false
     default: auto
+  check-name:
+    description: GitHub Check name to create when reporting through the Checkly GitHub App. Defaults to "Checkly".
+    required: false
 
 outputs:
   test-session-id:
@@ -117,3 +120,4 @@ runs:
         INPUT_FAIL_ON_NO_MATCHING: ${{ inputs.fail-on-no-matching }}
         INPUT_VERBOSE: ${{ inputs.verbose }}
         INPUT_REPORTING: ${{ inputs.reporting }}
+        INPUT_CHECK_NAME: ${{ inputs.check-name }}
diff --git a/scripts/run.sh b/scripts/run.sh
index 3b55a6f..e50816c 100755
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -182,6 +182,7 @@ resolve_github_sha() {
 
 clear_github_report_env() {
   unset CHECKLY_GITHUB_REPORT
+  unset CHECKLY_GITHUB_CHECK_NAME
   unset CHECKLY_GITHUB_REPOSITORY
   unset CHECKLY_GITHUB_SHA
   unset CHECKLY_GITHUB_RUN_ID
@@ -224,9 +225,14 @@ configure_deployment_environment_url() {
 configure_github_report() {
   local repository="$1"
   local sha="$2"
+  local check_name="$3"
 
   export CHECKLY_GITHUB_REPORT=true
 
+  if [[ -n "$check_name" ]]; then
+    export CHECKLY_GITHUB_CHECK_NAME="$check_name"
+  fi
+
   if [[ -n "$repository" ]]; then
     export CHECKLY_GITHUB_REPOSITORY="$repository"
   fi
@@ -300,6 +306,7 @@ const accountId = process.env.CHECKLY_ACCOUNT_ID
 const apiKey = process.env.CHECKLY_API_KEY
 
 const payload = {
+  checkName: process.env.CHECKLY_GITHUB_CHECK_NAME,
   repository: process.env.CHECKLY_GITHUB_REPOSITORY,
   sha: process.env.CHECKLY_GITHUB_SHA,
   runId: process.env.CHECKLY_GITHUB_RUN_ID,
@@ -353,6 +360,7 @@ cli_version="$(trim "${INPUT_CLI_VERSION:-latest}")"
 working_directory="$(trim "${INPUT_WORKING_DIRECTORY:-.}")"
 install_command="$(trim "${INPUT_INSTALL_COMMAND:-}")"
 reporting="$(trim "${INPUT_REPORTING:-auto}")"
+check_name="$(trim "${INPUT_CHECK_NAME:-}")"
 
 case "$command_name" in
   test|trigger) ;;
@@ -428,7 +436,7 @@ else
       echo "::warning::GitHub Check reporting needs Checkly CLI 8.12.0 or newer (cli-version is '${cli_version}'). Reporting through GitHub Actions instead. Use cli-version: latest or >= 8.12.0 to enable detached GitHub Check reporting."
     fi
   else
-    configure_github_report "$github_repository" "$github_sha"
+    configure_github_report "$github_repository" "$github_sha" "$check_name"
     preflight_result="$(github_report_preflight)" || preflight_result=$'false\tpreflight_crashed'
     IFS=$'\t' read -r github_report_available github_report_reason <<< "$preflight_result"
     github_report_reason="$(sanitize_reason "$github_report_reason")"
@@ -490,6 +498,9 @@ if [[ "${CHECKLY_ACTION_DRY_RUN:-}" == "1" || "${CHECKLY_ACTION_DRY_RUN:-}" == "
     printf 'Reporting: GitHub Actions\n'
   elif [[ "$github_check_requested" == "true" && "$github_report_available" == "true" ]]; then
     printf 'Reporting: GitHub Check'
+    if [[ -n "${CHECKLY_GITHUB_CHECK_NAME:-}" ]]; then
+      printf ' "%s"' "$CHECKLY_GITHUB_CHECK_NAME"
+    fi
     if [[ -n "${CHECKLY_GITHUB_REPOSITORY:-}" && -n "${CHECKLY_GITHUB_SHA:-}" ]]; then
       printf ' for %s@%s' "$CHECKLY_GITHUB_REPOSITORY" "$CHECKLY_GITHUB_SHA"
     fi
diff --git a/scripts/test.sh b/scripts/test.sh
index 1fa52fa..159f1f3 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -151,6 +151,7 @@ JSON
 github_report_output="$(
   INPUT_COMMAND=test \
   INPUT_REPORTING=github-check \
+  INPUT_CHECK_NAME='Checkly PR code checks' \
   CHECKLY_ACTION_GITHUB_REPORT_AVAILABLE=true \
   GITHUB_REPOSITORY=checkly/playwright-reporter-demo \
   GITHUB_SHA=merge123def456 \
@@ -168,7 +169,7 @@ github_report_output="$(
   run_dry
 )"
 
-assert_contains "$github_report_output" "Reporting: GitHub Check for checkly/playwright-reporter-demo@head123def456"
+assert_contains "$github_report_output" "Reporting: GitHub Check \"Checkly PR code checks\" for checkly/playwright-reporter-demo@head123def456"
 
 github_actions_output="$(
   INPUT_COMMAND=test \

From e93061ddd8aa183d2299565a0cd229650ec81ab6 Mon Sep 17 00:00:00 2001
From: Herve Labas <herve@checklyhq.com>
Date: Thu, 9 Jul 2026 19:01:27 +0200
Subject: [PATCH 3/7] Add GitHub reporting context metadata

---
 scripts/run.sh  | 29 +++++++++++++++++++++++++++++
 scripts/test.sh |  3 +++
 2 files changed, 32 insertions(+)

diff --git a/scripts/run.sh b/scripts/run.sh
index e50816c..201e687 100755
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -150,6 +150,8 @@ try {
   }
   if (typeof value === 'string' && value.trim() !== '') {
     process.stdout.write(value)
+  } else if (typeof value === 'number' && Number.isFinite(value)) {
+    process.stdout.write(String(value))
   }
 } catch (_) {
   process.exit(0)
@@ -182,7 +184,10 @@ resolve_github_sha() {
 
 clear_github_report_env() {
   unset CHECKLY_GITHUB_REPORT
+  unset CHECKLY_GITHUB_SOURCE
   unset CHECKLY_GITHUB_CHECK_NAME
+  unset CHECKLY_GITHUB_PULL_REQUEST_NUMBER
+  unset CHECKLY_GITHUB_ENVIRONMENT_URL
   unset CHECKLY_GITHUB_REPOSITORY
   unset CHECKLY_GITHUB_SHA
   unset CHECKLY_GITHUB_RUN_ID
@@ -228,11 +233,24 @@ configure_github_report() {
   local check_name="$3"
 
   export CHECKLY_GITHUB_REPORT=true
+  export CHECKLY_GITHUB_SOURCE=checkly-action
 
   if [[ -n "$check_name" ]]; then
     export CHECKLY_GITHUB_CHECK_NAME="$check_name"
   fi
 
+  if is_pull_request_event; then
+    local pull_request_number
+    pull_request_number="$(github_event_value "pull_request.number")"
+    if [[ -n "$pull_request_number" ]]; then
+      export CHECKLY_GITHUB_PULL_REQUEST_NUMBER="$pull_request_number"
+    fi
+  fi
+
+  if [[ -n "${ENVIRONMENT_URL:-}" ]]; then
+    export CHECKLY_GITHUB_ENVIRONMENT_URL="$ENVIRONMENT_URL"
+  fi
+
   if [[ -n "$repository" ]]; then
     export CHECKLY_GITHUB_REPOSITORY="$repository"
   fi
@@ -306,7 +324,10 @@ const accountId = process.env.CHECKLY_ACCOUNT_ID
 const apiKey = process.env.CHECKLY_API_KEY
 
 const payload = {
+  source: process.env.CHECKLY_GITHUB_SOURCE,
   checkName: process.env.CHECKLY_GITHUB_CHECK_NAME,
+  pullRequestNumber: process.env.CHECKLY_GITHUB_PULL_REQUEST_NUMBER,
+  environmentUrl: process.env.CHECKLY_GITHUB_ENVIRONMENT_URL,
   repository: process.env.CHECKLY_GITHUB_REPOSITORY,
   sha: process.env.CHECKLY_GITHUB_SHA,
   runId: process.env.CHECKLY_GITHUB_RUN_ID,
@@ -505,6 +526,14 @@ if [[ "${CHECKLY_ACTION_DRY_RUN:-}" == "1" || "${CHECKLY_ACTION_DRY_RUN:-}" == "
       printf ' for %s@%s' "$CHECKLY_GITHUB_REPOSITORY" "$CHECKLY_GITHUB_SHA"
     fi
     printf '\n'
+    printf 'GitHub metadata: source=%s' "${CHECKLY_GITHUB_SOURCE:-}"
+    if [[ -n "${CHECKLY_GITHUB_PULL_REQUEST_NUMBER:-}" ]]; then
+      printf ' pullRequestNumber=%s' "$CHECKLY_GITHUB_PULL_REQUEST_NUMBER"
+    fi
+    if [[ -n "${CHECKLY_GITHUB_ENVIRONMENT_URL:-}" ]]; then
+      printf ' environmentUrl=%s' "$CHECKLY_GITHUB_ENVIRONMENT_URL"
+    fi
+    printf '\n'
   elif [[ "$github_check_requested" == "true" ]]; then
     printf 'Reporting: GitHub Actions (GitHub Check unavailable: %s)\n' "$github_report_reason"
   else
diff --git a/scripts/test.sh b/scripts/test.sh
index 159f1f3..9f8613c 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -138,6 +138,7 @@ trap 'rm -f "$github_event_path"' EXIT
 cat > "$github_event_path" <<'JSON'
 {
   "pull_request": {
+    "number": 5,
     "head": {
       "sha": "head123def456",
       "repo": {
@@ -166,10 +167,12 @@ github_report_output="$(
   GITHUB_HEAD_REF=herve/test-checkly-action \
   GITHUB_BASE_REF=main \
   GITHUB_SERVER_URL=https://github.com \
+  ENVIRONMENT_URL=https://preview.example.com \
   run_dry
 )"
 
 assert_contains "$github_report_output" "Reporting: GitHub Check \"Checkly PR code checks\" for checkly/playwright-reporter-demo@head123def456"
+assert_contains "$github_report_output" "GitHub metadata: source=checkly-action pullRequestNumber=5 environmentUrl=https://preview.example.com"
 
 github_actions_output="$(
   INPUT_COMMAND=test \

From 4dfe5fa8e7b1ce086e688a4d729373e661d64890 Mon Sep 17 00:00:00 2001
From: Herve Labas <herve@checklyhq.com>
Date: Thu, 9 Jul 2026 19:05:59 +0200
Subject: [PATCH 4/7] Clarify GitHub Check name input

---
 README.md       |  4 ++--
 action.yml      |  4 ++--
 scripts/run.sh  | 12 ++++++------
 scripts/test.sh |  2 +-
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index a2027df..980dd82 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ jobs:
           install-command: npm ci
           tags: production,webapp
           grep: checkout
-          check-name: Checkly PR code checks
+          github-check-name: Checkly PR code checks
         env:
           CHECKLY_API_KEY: ${{ secrets.CHECKLY_API_KEY }}
           CHECKLY_ACCOUNT_ID: ${{ secrets.CHECKLY_ACCOUNT_ID }}
@@ -103,7 +103,7 @@ target URL explicitly through `env` or the workflow `env` block.
 | `fail-on-no-matching` | `trigger` only. Set to `false` to pass `--no-fail-on-no-matching`. |
 | `verbose` | Set to `true` or `false` to pass `--verbose` or `--no-verbose`. |
 | `reporting` | Where to report the Checkly result: `auto`, `github-check`, or `github-actions`. Defaults to `auto`. |
-| `check-name` | GitHub Check name used when reporting through the Checkly GitHub App. Defaults to `Checkly`. |
+| `github-check-name` | GitHub Check name used when reporting through the Checkly GitHub App. Defaults to `Checkly`. |
 
 ## Outputs
 
diff --git a/action.yml b/action.yml
index ead5045..35708a5 100644
--- a/action.yml
+++ b/action.yml
@@ -79,7 +79,7 @@ inputs:
     description: Where to report the Checkly result. Use "auto", "github-check", or "github-actions".
     required: false
     default: auto
-  check-name:
+  github-check-name:
     description: GitHub Check name to create when reporting through the Checkly GitHub App. Defaults to "Checkly".
     required: false
 
@@ -120,4 +120,4 @@ runs:
         INPUT_FAIL_ON_NO_MATCHING: ${{ inputs.fail-on-no-matching }}
         INPUT_VERBOSE: ${{ inputs.verbose }}
         INPUT_REPORTING: ${{ inputs.reporting }}
-        INPUT_CHECK_NAME: ${{ inputs.check-name }}
+        INPUT_GITHUB_CHECK_NAME: ${{ inputs.github-check-name }}
diff --git a/scripts/run.sh b/scripts/run.sh
index 201e687..f6d725c 100755
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -230,13 +230,13 @@ configure_deployment_environment_url() {
 configure_github_report() {
   local repository="$1"
   local sha="$2"
-  local check_name="$3"
+  local github_check_name="$3"
 
   export CHECKLY_GITHUB_REPORT=true
   export CHECKLY_GITHUB_SOURCE=checkly-action
 
-  if [[ -n "$check_name" ]]; then
-    export CHECKLY_GITHUB_CHECK_NAME="$check_name"
+  if [[ -n "$github_check_name" ]]; then
+    export CHECKLY_GITHUB_CHECK_NAME="$github_check_name"
   fi
 
   if is_pull_request_event; then
@@ -325,7 +325,7 @@ const apiKey = process.env.CHECKLY_API_KEY
 
 const payload = {
   source: process.env.CHECKLY_GITHUB_SOURCE,
-  checkName: process.env.CHECKLY_GITHUB_CHECK_NAME,
+  githubCheckName: process.env.CHECKLY_GITHUB_CHECK_NAME,
   pullRequestNumber: process.env.CHECKLY_GITHUB_PULL_REQUEST_NUMBER,
   environmentUrl: process.env.CHECKLY_GITHUB_ENVIRONMENT_URL,
   repository: process.env.CHECKLY_GITHUB_REPOSITORY,
@@ -381,7 +381,7 @@ cli_version="$(trim "${INPUT_CLI_VERSION:-latest}")"
 working_directory="$(trim "${INPUT_WORKING_DIRECTORY:-.}")"
 install_command="$(trim "${INPUT_INSTALL_COMMAND:-}")"
 reporting="$(trim "${INPUT_REPORTING:-auto}")"
-check_name="$(trim "${INPUT_CHECK_NAME:-}")"
+github_check_name="$(trim "${INPUT_GITHUB_CHECK_NAME:-}")"
 
 case "$command_name" in
   test|trigger) ;;
@@ -457,7 +457,7 @@ else
       echo "::warning::GitHub Check reporting needs Checkly CLI 8.12.0 or newer (cli-version is '${cli_version}'). Reporting through GitHub Actions instead. Use cli-version: latest or >= 8.12.0 to enable detached GitHub Check reporting."
     fi
   else
-    configure_github_report "$github_repository" "$github_sha" "$check_name"
+    configure_github_report "$github_repository" "$github_sha" "$github_check_name"
     preflight_result="$(github_report_preflight)" || preflight_result=$'false\tpreflight_crashed'
     IFS=$'\t' read -r github_report_available github_report_reason <<< "$preflight_result"
     github_report_reason="$(sanitize_reason "$github_report_reason")"
diff --git a/scripts/test.sh b/scripts/test.sh
index 9f8613c..9d54403 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -152,7 +152,7 @@ JSON
 github_report_output="$(
   INPUT_COMMAND=test \
   INPUT_REPORTING=github-check \
-  INPUT_CHECK_NAME='Checkly PR code checks' \
+  INPUT_GITHUB_CHECK_NAME='Checkly PR code checks' \
   CHECKLY_ACTION_GITHUB_REPORT_AVAILABLE=true \
   GITHUB_REPOSITORY=checkly/playwright-reporter-demo \
   GITHUB_SHA=merge123def456 \

From 8fae2884680256cd790e15ba18aedd3237effaa7 Mon Sep 17 00:00:00 2001
From: Herve Labas <herve@checklyhq.com>
Date: Fri, 10 Jul 2026 11:05:17 +0200
Subject: [PATCH 5/7] Harden action compatibility and CI

---
 .github/workflows/test.yml        |  65 ++++++++++++-
 AGENTS.md                         |  72 ++++++++++++++
 README.md                         |  12 ++-
 action.yml                        |   2 +-
 scripts/run.sh                    |  30 +++++-
 scripts/test-integration.sh       | 155 ++++++++++++++++++++++++++++++
 scripts/test-preflight-server.cjs |  39 ++++++++
 scripts/test.sh                   |   8 ++
 8 files changed, 371 insertions(+), 12 deletions(-)
 create mode 100644 AGENTS.md
 create mode 100755 scripts/test-integration.sh
 create mode 100644 scripts/test-preflight-server.cjs

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b827d49..9175175 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,12 +5,67 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: test-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  shell:
+  harness:
+    name: Harness / ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+
+      - name: Validate syntax
+        run: |
+          bash -n scripts/*.sh
+          node --check scripts/test-preflight-server.cjs
+
+      - name: Run ShellCheck
+        if: runner.os == 'Linux'
+        run: shellcheck scripts/*.sh
+
+      - name: Run actionlint
+        if: runner.os == 'Linux'
+        run: >-
+          docker run --rm -v "$PWD:/repo" -w /repo
+          rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
+
+      - name: Run command behavior tests
+        run: ./scripts/test.sh
+
+      - name: Run integration tests
+        run: ./scripts/test-integration.sh
+
+  composite-action:
+    name: Composite action contract
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - run: bash -n scripts/run.sh
-      - run: bash -n scripts/test.sh
-      - run: ./scripts/test.sh
+      - uses: actions/checkout@v6
+
+      - name: Invoke the local Action
+        uses: ./
+        env:
+          CHECKLY_ACTION_DRY_RUN: "1"
+          CHECKLY_ACTION_GITHUB_REPORT_AVAILABLE: "true"
+        with:
+          command: test
+          cli-version: 8.15.0
+          reporting: github-check
+          github-check-name: Checkly action contract
+          tags: smoke
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..f2e4863
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,72 @@
+# Checkly GitHub Action
+
+This repository publishes a composite GitHub Action. There is no build step or
+generated distribution bundle: consumers execute `action.yml` and
+`scripts/run.sh` directly from the selected Git ref.
+
+## Source Of Truth
+
+- `action.yml` is the public input/output contract.
+- `scripts/run.sh` validates inputs, selects the reporting mode, performs the
+  preflight request, invokes the Checkly CLI, and writes Action outputs.
+- `README.md` documents the public contract and must stay aligned with
+  `action.yml`.
+- `scripts/test.sh` covers validation and command construction through the
+  script's public environment-variable interface.
+- `scripts/test-integration.sh` covers the real preflight, CLI invocation,
+  working directory, install command, outputs, summaries, and exit codes using
+  local fakes. It must never require Checkly or GitHub credentials.
+
+## Product Invariants
+
+- Only `checkly test` and `checkly trigger` are supported. Do not turn `command`
+  into an arbitrary shell or CLI escape hatch.
+- CLI options remain separate Action inputs so workflows do not need to build
+  command strings.
+- `reporting: auto` detaches only after the backend preflight confirms GitHub
+  Check writeback is available. Otherwise it waits and reports through GitHub
+  Actions.
+- `reporting: github-check` fails before scheduling checks when writeback is not
+  available. `reporting: github-actions` never detaches.
+- Core GitHub Check reporting requires Checkly CLI `8.12.0` or newer.
+- `github-check-name` requires Checkly CLI `8.15.0` or newer. A pinned older
+  stable version must fail rather than silently create the default `Checkly`
+  check and leave a required custom check pending.
+- Exact stable semver pins are compared against compatibility floors. Dist-tags,
+  ranges, canaries, and prereleases are allowed because they may identify a
+  compatible build before the next stable release.
+- Repository and SHA values sent by the Action are hints, not authorization.
+  The Checkly backend must continue verifying account-scoped GitHub App access.
+- Never print API keys or other secrets. Sanitize backend-provided values before
+  placing them in GitHub workflow commands or summaries.
+
+## Verification
+
+Run all of these before pushing:
+
+```bash
+bash -n scripts/*.sh
+node --check scripts/test-preflight-server.cjs
+shellcheck scripts/*.sh
+docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
+./scripts/test.sh
+./scripts/test-integration.sh
+```
+
+CI runs the harness on Linux and macOS and invokes the composite Action itself
+to catch drift between `action.yml` and `scripts/run.sh`.
+
+When adding behavior, add a failing public-behavior test first, make the minimum
+implementation change, then run the complete verification set. Keep tests
+deterministic and local; production API calls belong in a separate canary, not
+the PR gate.
+
+## Releases
+
+- Do not publish or move release tags from a PR workflow.
+- Use immutable full-version tags for releases.
+- Only move a major convenience tag such as `v1` after the corresponding full
+  release has been verified.
+- Coordinate Action features that depend on new CLI metadata with the CLI
+  release. The Action must not advertise a pinned CLI version that silently
+  drops a requested public input.
diff --git a/README.md b/README.md
index 980dd82..10aa362 100644
--- a/README.md
+++ b/README.md
@@ -103,7 +103,7 @@ target URL explicitly through `env` or the workflow `env` block.
 | `fail-on-no-matching` | `trigger` only. Set to `false` to pass `--no-fail-on-no-matching`. |
 | `verbose` | Set to `true` or `false` to pass `--verbose` or `--no-verbose`. |
 | `reporting` | Where to report the Checkly result: `auto`, `github-check`, or `github-actions`. Defaults to `auto`. |
-| `github-check-name` | GitHub Check name used when reporting through the Checkly GitHub App. Defaults to `Checkly`. |
+| `github-check-name` | GitHub Check name used when reporting through the Checkly GitHub App. Requires Checkly CLI `8.15.0` or newer and defaults to `Checkly`. |
 
 ## Outputs
 
@@ -112,8 +112,16 @@ target URL explicitly through `env` or the workflow `env` block.
 | `test-session-id` | Checkly test session ID, when detected from CLI output. |
 | `test-session-url` | Checkly test session URL, when detected from CLI output. |
 
-## Local test
+## Development
+
+The test harness does not need Checkly or GitHub credentials. It uses a local
+preflight server and a fake CLI process to exercise the complete Action flow.
 
 ```sh
+shellcheck scripts/*.sh
 ./scripts/test.sh
+./scripts/test-integration.sh
 ```
+
+See `AGENTS.md` for the repository invariants, complete verification commands,
+and release guidance.
diff --git a/action.yml b/action.yml
index 35708a5..2e83704 100644
--- a/action.yml
+++ b/action.yml
@@ -80,7 +80,7 @@ inputs:
     required: false
     default: auto
   github-check-name:
-    description: GitHub Check name to create when reporting through the Checkly GitHub App. Defaults to "Checkly".
+    description: GitHub Check name to create when reporting through the Checkly GitHub App. Requires Checkly CLI 8.15.0 or newer. Defaults to "Checkly".
     required: false
 
 outputs:
diff --git a/scripts/run.sh b/scripts/run.sh
index f6d725c..0ae8ed3 100755
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -81,18 +81,26 @@ add_positional_from_lines() {
   done <<< "$values"
 }
 
-cli_version_supports_github_report() {
+cli_version_supports_floor() {
   local version
   version="$(trim "${1:-}")"
+  local floor_major="$2"
+  local floor_minor="$3"
+  local floor_patch="$4"
 
-  # Only exact pinned stable semver is comparable against the 8.12.0 floor.
+  # Only exact pinned stable semver is comparable against a compatibility floor.
   # Dist-tags, ranges, canaries, and prereleases pass because they may point
   # at compatible builds before a stable release exists.
-  if [[ "$version" =~ ^v?([0-9]+)\.([0-9]+)\.[0-9]+$ ]]; then
+  if [[ "$version" =~ ^v?([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
     local major="${BASH_REMATCH[1]}"
     local minor="${BASH_REMATCH[2]}"
+    local patch="${BASH_REMATCH[3]}"
 
-    if (( major < 8 || (major == 8 && minor < 12) )); then
+    if ((
+      major < floor_major
+      || (major == floor_major && minor < floor_minor)
+      || (major == floor_major && minor == floor_minor && patch < floor_patch)
+    )); then
       return 1
     fi
   fi
@@ -100,6 +108,14 @@ cli_version_supports_github_report() {
   return 0
 }
 
+cli_version_supports_github_report() {
+  cli_version_supports_floor "$1" 8 12 0
+}
+
+cli_version_supports_github_check_name() {
+  cli_version_supports_floor "$1" 8 15 0
+}
+
 # Reasons are interpolated into ::warning:: workflow commands and the step
 # summary; constrain them to a safe charset so a malformed or hostile
 # preflight response can never inject workflow commands or extra lines.
@@ -399,6 +415,12 @@ case "$reporting" in
     ;;
 esac
 
+if [[ "$reporting" != "github-actions" && -n "$github_check_name" ]] \
+  && ! cli_version_supports_github_check_name "$cli_version"; then
+  echo "::error::Custom GitHub Check names need Checkly CLI 8.15.0 or newer (cli-version is '${cli_version}'). Use cli-version: latest or >= 8.15.0, remove github-check-name, or set reporting: github-actions." >&2
+  exit 1
+fi
+
 if [[ "$command_name" == "trigger" && -n "$(trim "${INPUT_GREP:-}")" ]]; then
   echo "::error::Input 'grep' is only supported with command=test." >&2
   exit 1
diff --git a/scripts/test-integration.sh b/scripts/test-integration.sh
new file mode 100755
index 0000000..3e6014d
--- /dev/null
+++ b/scripts/test-integration.sh
@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TEST_DIR="$(mktemp -d)"
+SERVER_PID=""
+
+cleanup() {
+  if [[ -n "$SERVER_PID" ]]; then
+    kill "$SERVER_PID" 2>/dev/null || true
+    wait "$SERVER_PID" 2>/dev/null || true
+  fi
+  rm -rf "$TEST_DIR"
+}
+trap cleanup EXIT
+
+assert_file_contains() {
+  local file="$1"
+  local expected="$2"
+  if ! grep -Fq -- "$expected" "$file"; then
+    echo "Expected $file to contain: $expected" >&2
+    echo "Actual contents:" >&2
+    cat "$file" >&2
+    exit 1
+  fi
+}
+
+FAKE_BIN="$TEST_DIR/bin"
+PROJECT_DIR="$TEST_DIR/project"
+READY_FILE="$TEST_DIR/preflight-port"
+REQUEST_FILE="$TEST_DIR/preflight-request.json"
+ARGS_FILE="$TEST_DIR/npx-args"
+CWD_FILE="$TEST_DIR/npx-cwd"
+INSTALL_MARKER="$TEST_DIR/installed"
+OUTPUT_FILE="$TEST_DIR/github-output"
+SUMMARY_FILE="$TEST_DIR/github-summary"
+
+mkdir -p "$FAKE_BIN" "$PROJECT_DIR"
+touch "$OUTPUT_FILE" "$SUMMARY_FILE"
+
+cat > "$FAKE_BIN/npx" <<'FAKE_NPX'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+printf '%s\n' "$@" > "$FAKE_NPX_ARGS_FILE"
+printf '%s\n' "$PWD" > "$FAKE_NPX_CWD_FILE"
+printf 'Test session ID: test-session-123\n'
+printf 'Open session: https://app.checklyhq.com/accounts/account-1/test-sessions/test-session-123\n'
+exit "${FAKE_NPX_EXIT_CODE:-0}"
+FAKE_NPX
+chmod +x "$FAKE_BIN/npx"
+
+node "$ROOT_DIR/scripts/test-preflight-server.cjs" "$READY_FILE" "$REQUEST_FILE" &
+SERVER_PID="$!"
+
+for _ in $(seq 1 100); do
+  if [[ -s "$READY_FILE" ]]; then
+    break
+  fi
+  if ! kill -0 "$SERVER_PID" 2>/dev/null; then
+    echo "Preflight test server exited before becoming ready." >&2
+    exit 1
+  fi
+  sleep 0.05
+done
+
+if [[ ! -s "$READY_FILE" ]]; then
+  echo "Preflight test server did not become ready." >&2
+  exit 1
+fi
+
+preflight_port="$(cat "$READY_FILE")"
+# INSTALL_MARKER is intentionally expanded by run.sh's install-command shell.
+# shellcheck disable=SC2016
+install_command='printf installed > "$INSTALL_MARKER"'
+
+PATH="$FAKE_BIN:$PATH" \
+CHECKLY_API_URL="http://127.0.0.1:${preflight_port}" \
+CHECKLY_API_KEY=test-api-key \
+CHECKLY_ACCOUNT_ID=account-1 \
+GITHUB_OUTPUT="$OUTPUT_FILE" \
+GITHUB_STEP_SUMMARY="$SUMMARY_FILE" \
+GITHUB_REPOSITORY=checkly/checkly-action \
+GITHUB_SHA=0123456789abcdef0123456789abcdef01234567 \
+GITHUB_RUN_ID=123456 \
+GITHUB_RUN_ATTEMPT=2 \
+GITHUB_WORKFLOW=Test \
+GITHUB_JOB=integration \
+GITHUB_EVENT_NAME=push \
+GITHUB_REF=refs/heads/main \
+GITHUB_SERVER_URL=https://github.com \
+FAKE_NPX_ARGS_FILE="$ARGS_FILE" \
+FAKE_NPX_CWD_FILE="$CWD_FILE" \
+INSTALL_MARKER="$INSTALL_MARKER" \
+INPUT_COMMAND=test \
+INPUT_CLI_VERSION=8.15.0 \
+INPUT_REPORTING=github-check \
+INPUT_GITHUB_CHECK_NAME='Checkly action integration' \
+INPUT_WORKING_DIRECTORY="$PROJECT_DIR" \
+INPUT_INSTALL_COMMAND="$install_command" \
+INPUT_TAGS='smoke' \
+"$ROOT_DIR/scripts/run.sh"
+
+[[ "$(cat "$CWD_FILE")" == "$PROJECT_DIR" ]]
+[[ "$(cat "$INSTALL_MARKER")" == "installed" ]]
+assert_file_contains "$ARGS_FILE" "--yes"
+assert_file_contains "$ARGS_FILE" "checkly@8.15.0"
+assert_file_contains "$ARGS_FILE" "test"
+assert_file_contains "$ARGS_FILE" "--detach"
+assert_file_contains "$ARGS_FILE" "--tags"
+assert_file_contains "$ARGS_FILE" "smoke"
+assert_file_contains "$OUTPUT_FILE" "test-session-id=test-session-123"
+assert_file_contains "$OUTPUT_FILE" "test-session-url=https://app.checklyhq.com/accounts/account-1/test-sessions/test-session-123"
+assert_file_contains "$SUMMARY_FILE" "Test session ID: \`test-session-123\`"
+assert_file_contains "$SUMMARY_FILE" "GitHub Check reporting is enabled for this run."
+
+node - "$REQUEST_FILE" <<'NODE'
+const fs = require('node:fs')
+const assert = require('node:assert/strict')
+
+const request = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'))
+assert.equal(request.method, 'POST')
+assert.equal(request.url, '/next/test-sessions/github-checks/preflight')
+assert.equal(request.headers.authorization, 'Bearer test-api-key')
+assert.equal(request.headers['x-checkly-account'], 'account-1')
+assert.equal(request.headers['x-checkly-operator'], 'github-actions')
+assert.equal(request.body.source, 'checkly-action')
+assert.equal(request.body.githubCheckName, 'Checkly action integration')
+assert.equal(request.body.repository, 'checkly/checkly-action')
+assert.equal(request.body.sha, '0123456789abcdef0123456789abcdef01234567')
+assert.equal(request.body.runId, '123456')
+assert.equal(request.body.runAttempt, '2')
+assert.equal(request.body.workflow, 'Test')
+assert.equal(request.body.job, 'integration')
+assert.equal(request.body.eventName, 'push')
+NODE
+
+set +e
+PATH="$FAKE_BIN:$PATH" \
+FAKE_NPX_ARGS_FILE="$ARGS_FILE" \
+FAKE_NPX_CWD_FILE="$CWD_FILE" \
+FAKE_NPX_EXIT_CODE=17 \
+INPUT_COMMAND=trigger \
+INPUT_CLI_VERSION=8.15.0 \
+INPUT_REPORTING=github-actions \
+INPUT_WORKING_DIRECTORY="$PROJECT_DIR" \
+"$ROOT_DIR/scripts/run.sh" >/dev/null 2>&1
+status="$?"
+set -e
+
+if [[ "$status" -ne 17 ]]; then
+  echo "Expected the CLI exit code 17 to propagate, got $status." >&2
+  exit 1
+fi
+
+echo "All integration tests passed."
diff --git a/scripts/test-preflight-server.cjs b/scripts/test-preflight-server.cjs
new file mode 100644
index 0000000..e15cf61
--- /dev/null
+++ b/scripts/test-preflight-server.cjs
@@ -0,0 +1,39 @@
+const fs = require('node:fs')
+const http = require('node:http')
+
+const [readyFile, requestFile] = process.argv.slice(2)
+
+if (!readyFile || !requestFile) {
+  throw new Error('Usage: node test-preflight-server.cjs <ready-file> <request-file>')
+}
+
+const server = http.createServer((request, response) => {
+  const chunks = []
+
+  request.on('data', (chunk) => chunks.push(chunk))
+  request.on('end', () => {
+    const rawBody = Buffer.concat(chunks).toString('utf8')
+    fs.writeFileSync(
+      requestFile,
+      JSON.stringify({
+        method: request.method,
+        url: request.url,
+        headers: request.headers,
+        body: rawBody ? JSON.parse(rawBody) : null,
+      }),
+    )
+
+    response.writeHead(200, { 'content-type': 'application/json' })
+    response.end(JSON.stringify({ available: true, reason: 'available' }))
+  })
+})
+
+server.listen(0, '127.0.0.1', () => {
+  const address = server.address()
+  if (!address || typeof address === 'string') {
+    throw new Error('Unable to determine preflight server port')
+  }
+  fs.writeFileSync(readyFile, String(address.port))
+})
+
+process.on('SIGTERM', () => server.close())
diff --git a/scripts/test.sh b/scripts/test.sh
index 9d54403..d53f0a4 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -116,6 +116,14 @@ assert_fails_with "GitHub Check reporting needs Checkly CLI 8.12.0 or newer" env
   CHECKLY_ACTION_DRY_RUN=1 \
   "$ROOT_DIR/scripts/run.sh"
 
+assert_fails_with "Custom GitHub Check names need Checkly CLI 8.15.0 or newer" env \
+  INPUT_COMMAND=test \
+  INPUT_CLI_VERSION=8.14.1 \
+  INPUT_REPORTING=github-check \
+  INPUT_GITHUB_CHECK_NAME='Checkly PR code checks' \
+  CHECKLY_ACTION_DRY_RUN=1 \
+  "$ROOT_DIR/scripts/run.sh"
+
 assert_fails_with "Checkly GitHub Check reporting is unavailable (github_app_not_connected)" env \
   INPUT_COMMAND=test \
   INPUT_REPORTING=github-check \

From 4a85b4417a7f2e6db2d1024cc03596277e844d24 Mon Sep 17 00:00:00 2001
From: Herve Labas <herve@checklyhq.com>
Date: Fri, 10 Jul 2026 11:07:17 +0200
Subject: [PATCH 6/7] Add stable CI gate

---
 .github/workflows/test.yml | 18 ++++++++++++++++++
 AGENTS.md                  |  5 +++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9175175..c11b06a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -69,3 +69,21 @@ jobs:
           reporting: github-check
           github-check-name: Checkly action contract
           tags: smoke
+
+  ci:
+    name: CI
+    if: always()
+    needs:
+      - harness
+      - composite-action
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify required jobs
+        env:
+          HARNESS_RESULT: ${{ needs.harness.result }}
+          COMPOSITE_ACTION_RESULT: ${{ needs.composite-action.result }}
+        run: |
+          if [[ "$HARNESS_RESULT" != "success" || "$COMPOSITE_ACTION_RESULT" != "success" ]]; then
+            echo "Required CI failed: harness=$HARNESS_RESULT composite-action=$COMPOSITE_ACTION_RESULT"
+            exit 1
+          fi
diff --git a/AGENTS.md b/AGENTS.md
index f2e4863..3fc00a8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -53,8 +53,9 @@ docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint@sha256:887a259a5a534f3
 ./scripts/test-integration.sh
 ```
 
-CI runs the harness on Linux and macOS and invokes the composite Action itself
-to catch drift between `action.yml` and `scripts/run.sh`.
+CI runs the harness on Linux and macOS, invokes the composite Action itself to
+catch drift between `action.yml` and `scripts/run.sh`, and exposes the stable
+`CI` aggregator check for branch protection.
 
 When adding behavior, add a failing public-behavior test first, make the minimum
 implementation change, then run the complete verification set. Keep tests

From 0ee0d77d4bf3f79429496276c5b43ab21f24bbb1 Mon Sep 17 00:00:00 2001
From: Herve Labas <herve@checklyhq.com>
Date: Fri, 10 Jul 2026 11:14:55 +0200
Subject: [PATCH 7/7] Require Checkly CLI 8.15

---
 AGENTS.md       |  8 +++----
 README.md       |  4 ++--
 action.yml      |  4 ++--
 scripts/run.sh  | 60 +++++++++++++------------------------------------
 scripts/test.sh | 37 +++++++-----------------------
 5 files changed, 31 insertions(+), 82 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 3fc00a8..e5132c8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -28,11 +28,9 @@ generated distribution bundle: consumers execute `action.yml` and
   Actions.
 - `reporting: github-check` fails before scheduling checks when writeback is not
   available. `reporting: github-actions` never detaches.
-- Core GitHub Check reporting requires Checkly CLI `8.12.0` or newer.
-- `github-check-name` requires Checkly CLI `8.15.0` or newer. A pinned older
-  stable version must fail rather than silently create the default `Checkly`
-  check and leave a required custom check pending.
-- Exact stable semver pins are compared against compatibility floors. Dist-tags,
+- The Action requires Checkly CLI `8.15.0` or newer. A pinned older stable
+  version must fail before running or performing a preflight request.
+- Exact stable semver pins are compared against the minimum version. Dist-tags,
   ranges, canaries, and prereleases are allowed because they may identify a
   compatible build before the next stable release.
 - Repository and SHA values sent by the Action are hints, not authorization.
diff --git a/README.md b/README.md
index 10aa362..6b5119a 100644
--- a/README.md
+++ b/README.md
@@ -82,7 +82,7 @@ target URL explicitly through `env` or the workflow `env` block.
 | Input | Description |
 | --- | --- |
 | `command` | `test` for local constructs or `trigger` for deployed checks. Defaults to `test`. |
-| `cli-version` | Checkly CLI npm version. Defaults to `latest`. GitHub Check reporting needs `8.12.0` or newer. Dist-tags, canaries, and prereleases are assumed compatible. |
+| `cli-version` | Checkly CLI npm version. Requires `8.15.0` or newer and defaults to `latest`. Dist-tags, ranges, canaries, and prereleases are assumed compatible. |
 | `working-directory` | Directory where the CLI command should run. Defaults to `.`. |
 | `install-command` | Optional command to run before the Checkly CLI command, inside `working-directory`. |
 | `tags` | One `--tags` filter per line. Each line can contain comma-separated tags. |
@@ -103,7 +103,7 @@ target URL explicitly through `env` or the workflow `env` block.
 | `fail-on-no-matching` | `trigger` only. Set to `false` to pass `--no-fail-on-no-matching`. |
 | `verbose` | Set to `true` or `false` to pass `--verbose` or `--no-verbose`. |
 | `reporting` | Where to report the Checkly result: `auto`, `github-check`, or `github-actions`. Defaults to `auto`. |
-| `github-check-name` | GitHub Check name used when reporting through the Checkly GitHub App. Requires Checkly CLI `8.15.0` or newer and defaults to `Checkly`. |
+| `github-check-name` | GitHub Check name used when reporting through the Checkly GitHub App. Defaults to `Checkly`. |
 
 ## Outputs
 
diff --git a/action.yml b/action.yml
index 2e83704..02724e5 100644
--- a/action.yml
+++ b/action.yml
@@ -12,7 +12,7 @@ inputs:
     required: false
     default: test
   cli-version:
-    description: Checkly CLI npm version to run. GitHub Check reporting needs 8.12.0 or newer.
+    description: Checkly CLI npm version to run. Requires 8.15.0 or newer.
     required: false
     default: latest
   working-directory:
@@ -80,7 +80,7 @@ inputs:
     required: false
     default: auto
   github-check-name:
-    description: GitHub Check name to create when reporting through the Checkly GitHub App. Requires Checkly CLI 8.15.0 or newer. Defaults to "Checkly".
+    description: GitHub Check name to create when reporting through the Checkly GitHub App. Defaults to "Checkly".
     required: false
 
 outputs:
diff --git a/scripts/run.sh b/scripts/run.sh
index 0ae8ed3..48bb430 100755
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -81,26 +81,18 @@ add_positional_from_lines() {
   done <<< "$values"
 }
 
-cli_version_supports_floor() {
+cli_version_is_supported() {
   local version
   version="$(trim "${1:-}")"
-  local floor_major="$2"
-  local floor_minor="$3"
-  local floor_patch="$4"
 
-  # Only exact pinned stable semver is comparable against a compatibility floor.
+  # Only exact pinned stable semver is comparable against the 8.15.0 floor.
   # Dist-tags, ranges, canaries, and prereleases pass because they may point
   # at compatible builds before a stable release exists.
-  if [[ "$version" =~ ^v?([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+  if [[ "$version" =~ ^v?([0-9]+)\.([0-9]+)\.[0-9]+$ ]]; then
     local major="${BASH_REMATCH[1]}"
     local minor="${BASH_REMATCH[2]}"
-    local patch="${BASH_REMATCH[3]}"
 
-    if ((
-      major < floor_major
-      || (major == floor_major && minor < floor_minor)
-      || (major == floor_major && minor == floor_minor && patch < floor_patch)
-    )); then
+    if (( major < 8 || (major == 8 && minor < 15) )); then
       return 1
     fi
   fi
@@ -108,14 +100,6 @@ cli_version_supports_floor() {
   return 0
 }
 
-cli_version_supports_github_report() {
-  cli_version_supports_floor "$1" 8 12 0
-}
-
-cli_version_supports_github_check_name() {
-  cli_version_supports_floor "$1" 8 15 0
-}
-
 # Reasons are interpolated into ::warning:: workflow commands and the step
 # summary; constrain them to a safe charset so a malformed or hostile
 # preflight response can never inject workflow commands or extra lines.
@@ -415,9 +399,8 @@ case "$reporting" in
     ;;
 esac
 
-if [[ "$reporting" != "github-actions" && -n "$github_check_name" ]] \
-  && ! cli_version_supports_github_check_name "$cli_version"; then
-  echo "::error::Custom GitHub Check names need Checkly CLI 8.15.0 or newer (cli-version is '${cli_version}'). Use cli-version: latest or >= 8.15.0, remove github-check-name, or set reporting: github-actions." >&2
+if ! cli_version_is_supported "$cli_version"; then
+  echo "::error::The Checkly Action needs Checkly CLI 8.15.0 or newer (cli-version is '${cli_version}'). Use cli-version: latest or >= 8.15.0." >&2
   exit 1
 fi
 
@@ -469,31 +452,20 @@ if [[ "$reporting" == "github-actions" ]]; then
   clear_github_report_env
 else
   github_check_requested=true
-  if ! cli_version_supports_github_report "$cli_version"; then
-    github_report_reason="cli_version_too_old"
+  configure_github_report "$github_repository" "$github_sha" "$github_check_name"
+  preflight_result="$(github_report_preflight)" || preflight_result=$'false\tpreflight_crashed'
+  IFS=$'\t' read -r github_report_available github_report_reason <<< "$preflight_result"
+  github_report_reason="$(sanitize_reason "$github_report_reason")"
+  if [[ "$github_report_available" == "true" ]]; then
+    detach_run=true
+    github_reporter_run=false
+  else
     clear_github_report_env
     if [[ "$reporting" == "github-check" ]]; then
-      echo "::error::GitHub Check reporting needs Checkly CLI 8.12.0 or newer (cli-version is '${cli_version}'). Use cli-version: latest or >= 8.12.0, or set reporting: github-actions to wait for the result in this workflow." >&2
+      echo "::error::Checkly GitHub Check reporting is unavailable (${github_report_reason}). Install the Checkly GitHub App on this repository to run detached and receive a Checkly GitHub Check: ${CHECKLY_GITHUB_APP_URL}" >&2
       exit 1
     elif [[ "${GITHUB_ACTIONS:-}" == "true" ]]; then
-      echo "::warning::GitHub Check reporting needs Checkly CLI 8.12.0 or newer (cli-version is '${cli_version}'). Reporting through GitHub Actions instead. Use cli-version: latest or >= 8.12.0 to enable detached GitHub Check reporting."
-    fi
-  else
-    configure_github_report "$github_repository" "$github_sha" "$github_check_name"
-    preflight_result="$(github_report_preflight)" || preflight_result=$'false\tpreflight_crashed'
-    IFS=$'\t' read -r github_report_available github_report_reason <<< "$preflight_result"
-    github_report_reason="$(sanitize_reason "$github_report_reason")"
-    if [[ "$github_report_available" == "true" ]]; then
-      detach_run=true
-      github_reporter_run=false
-    else
-      clear_github_report_env
-      if [[ "$reporting" == "github-check" ]]; then
-        echo "::error::Checkly GitHub Check reporting is unavailable (${github_report_reason}). Install the Checkly GitHub App on this repository to run detached and receive a Checkly GitHub Check: ${CHECKLY_GITHUB_APP_URL}" >&2
-        exit 1
-      elif [[ "${GITHUB_ACTIONS:-}" == "true" ]]; then
-        echo "::warning::Checkly GitHub Check reporting is unavailable (${github_report_reason}). Reporting through GitHub Actions instead, so this job waits for the Checkly test session result. Install the Checkly GitHub App on this repository to run detached and receive a Checkly GitHub Check: ${CHECKLY_GITHUB_APP_URL}"
-      fi
+      echo "::warning::Checkly GitHub Check reporting is unavailable (${github_report_reason}). Reporting through GitHub Actions instead, so this job waits for the Checkly test session result. Install the Checkly GitHub App on this repository to run detached and receive a Checkly GitHub Check: ${CHECKLY_GITHUB_APP_URL}"
     fi
   fi
 fi
diff --git a/scripts/test.sh b/scripts/test.sh
index d53f0a4..39f8ac4 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -37,7 +37,7 @@ assert_fails_with() {
 
 test_command_output="$(
   INPUT_COMMAND=test \
-  INPUT_CLI_VERSION=8.12.0 \
+  INPUT_CLI_VERSION=8.15.0 \
   CHECKLY_ACTION_GITHUB_REPORT_AVAILABLE=true \
   INPUT_TAGS=$'production,webapp\nproduction,backend' \
   INPUT_GREP='checkout' \
@@ -50,7 +50,7 @@ test_command_output="$(
 )"
 
 assert_contains "$test_command_output" "Install command: npm ci"
-assert_contains "$test_command_output" "checkly@8.12.0 test --detach"
+assert_contains "$test_command_output" "checkly@8.15.0 test --detach"
 assert_contains "$test_command_output" "--tags production\\,webapp --tags production\\,backend"
 assert_contains "$test_command_output" "--grep checkout"
 assert_contains "$test_command_output" "--update-snapshots"
@@ -79,48 +79,27 @@ assert_fails_with "Unsupported command 'deploy'" env \
 
 fallback_command_output="$(
   INPUT_COMMAND=test \
-  INPUT_CLI_VERSION=8.12.0 \
+  INPUT_CLI_VERSION=8.15.0 \
   CHECKLY_ACTION_GITHUB_REPORT_AVAILABLE=false \
   CHECKLY_ACTION_GITHUB_REPORT_REASON=github_app_not_connected \
   GITHUB_ACTIONS=true \
   run_dry
 )"
 
-assert_contains "$fallback_command_output" "checkly@8.12.0 test --reporter=github"
+assert_contains "$fallback_command_output" "checkly@8.15.0 test --reporter=github"
 assert_contains "$fallback_command_output" "Reporting: GitHub Actions (GitHub Check unavailable: github_app_not_connected)"
 assert_contains "$fallback_command_output" "Install the Checkly GitHub App on this repository to run detached and receive a Checkly GitHub Check: https://github.com/apps/checkly"
 
-# An old pinned CLI must fall back (skipping the preflight entirely), not fail
-# the job: CHECKLY_ACTION_GITHUB_REPORT_AVAILABLE=true would force the detached
-# path if the preflight were still consulted.
-old_cli_fallback_output="$(
-  INPUT_COMMAND=test \
-  INPUT_CLI_VERSION=8.11.9 \
-  CHECKLY_ACTION_GITHUB_REPORT_AVAILABLE=true \
-  run_dry
-)"
-
-assert_contains "$old_cli_fallback_output" "checkly@8.11.9 test --reporter=github"
-assert_contains "$old_cli_fallback_output" "Reporting: GitHub Actions (GitHub Check unavailable: cli_version_too_old)"
-
 assert_fails_with "Unsupported reporting 'banana'" env \
   INPUT_COMMAND=test \
   INPUT_REPORTING=banana \
   CHECKLY_ACTION_DRY_RUN=1 \
   "$ROOT_DIR/scripts/run.sh"
 
-assert_fails_with "GitHub Check reporting needs Checkly CLI 8.12.0 or newer" env \
-  INPUT_COMMAND=test \
-  INPUT_CLI_VERSION=8.11.9 \
-  INPUT_REPORTING=github-check \
-  CHECKLY_ACTION_DRY_RUN=1 \
-  "$ROOT_DIR/scripts/run.sh"
-
-assert_fails_with "Custom GitHub Check names need Checkly CLI 8.15.0 or newer" env \
+assert_fails_with "The Checkly Action needs Checkly CLI 8.15.0 or newer" env \
   INPUT_COMMAND=test \
   INPUT_CLI_VERSION=8.14.1 \
-  INPUT_REPORTING=github-check \
-  INPUT_GITHUB_CHECK_NAME='Checkly PR code checks' \
+  INPUT_REPORTING=github-actions \
   CHECKLY_ACTION_DRY_RUN=1 \
   "$ROOT_DIR/scripts/run.sh"
 
@@ -184,7 +163,7 @@ assert_contains "$github_report_output" "GitHub metadata: source=checkly-action
 
 github_actions_output="$(
   INPUT_COMMAND=test \
-  INPUT_CLI_VERSION=8.11.9 \
+  INPUT_CLI_VERSION=8.15.0 \
   INPUT_REPORTING=github-actions \
   CHECKLY_GITHUB_REPORT=true \
   CHECKLY_GITHUB_REPOSITORY=spoofed/repository \
@@ -195,7 +174,7 @@ github_actions_output="$(
 )"
 
 assert_contains "$github_actions_output" "Reporting: GitHub Actions"
-assert_contains "$github_actions_output" "checkly@8.11.9 test --reporter=github"
+assert_contains "$github_actions_output" "checkly@8.15.0 test --reporter=github"
 
 deployment_event_path="$(mktemp)"
 trap 'rm -f "$github_event_path" "$deployment_event_path"' EXIT