From 7b0740bf5736bc4ef10d63e06f7bf661ea396a03 Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Tue, 20 Oct 2026 12:38:29 +0300
Subject: [PATCH 1/7] feat: Download prebuilt plugin binaries instead of
 building with Go

---
 README.md        | 10 +++++--
 env0.plugin.yaml | 74 ++++++++++++++++++++++++++++++++++++++++++------
 2 files changed, 73 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index db641c7..b81dbb7 100644
--- a/README.md
+++ b/README.md
@@ -57,7 +57,13 @@ The plugin uses the env0 API to fetch the output values from another environment
 
 ## Inputs
 
-N/A
+* `version` (optional): The release tag of the plugin binary to use, for example `0.5.0`. If you do not set it, the plugin uses the latest release.
+
+## How the plugin installs
+
+The plugin downloads a prebuilt binary for the agent architecture (`amd64` or `arm64`) from the [GitHub releases](https://github.com/env0/env0-import-variable-plugin/releases) and verifies its SHA-256 checksum. It does not install Go. If the download fails, the plugin installs Go and builds the binary from source.
+
+Use `use: https://github.com/env0/env0-import-variable-plugin` in your custom flow to get this behavior. If you copied the old plugin script into your `env0.yaml`, replace it with `use:`.
 
 ## Example Usage
 
@@ -70,7 +76,7 @@ deploy:
     terraformPlan:
       before:
         - name: Import Variables # The name that will be presented in the UI for this step
-          use: https://github.com/env0/env0-import-variable-plugin@0.4.4
+          use: https://github.com/env0/env0-import-variable-plugin
           inputs: {}
 
 ```
diff --git a/env0.plugin.yaml b/env0.plugin.yaml
index bd35f01..5f274ed 100644
--- a/env0.plugin.yaml
+++ b/env0.plugin.yaml
@@ -1,16 +1,72 @@
 name: Variable Helper
 icon: https://assets-global.website-files.com/5ceab5395d0f478e169de7c0/5fdf4acfdb893538adabd1ab_Code%20automation%402x.png
-inputs: {}
+inputs:
+  version:
+    description: Release tag of the plugin binary to use (for example 0.5.0). Defaults to the latest release.
+    required: false
 run:
   exec: |
-    sudo apk add go
-    rm -rf env0-import-variable-plugin
-    git clone --depth=1 --single-branch https://github.com/env0/env0-import-variable-plugin
-    cd env0-import-variable-plugin
-    #cat main.go
-    go build -o ./bin/import-variable-plugin main.go 
-    mv ./bin/import-variable-plugin /opt
-    mv ./importVariables.sh /opt/importEnvVariables
+    PLUGIN_REPO=https://github.com/env0/env0-import-variable-plugin
+    PLUGIN_VERSION='${inputs.version}'
+    if [[ "$PLUGIN_VERSION" == *'{inputs.'* ]]; then
+      PLUGIN_VERSION=""
+    fi
+
+    plugin_arch() {
+      case "$(uname -m)" in
+        x86_64|amd64) echo amd64 ;;
+        aarch64|arm64) echo arm64 ;;
+        *) return 1 ;;
+      esac
+    }
+
+    release_url() {
+      if [[ -n "$PLUGIN_VERSION" ]]; then
+        echo "$PLUGIN_REPO/releases/download/$PLUGIN_VERSION/$1"
+      else
+        echo "$PLUGIN_REPO/releases/latest/download/$1"
+      fi
+    }
+
+    verify_checksum() {
+      local expected actual
+      expected="$(awk -v name="$2" '$2 == name { print $1 }' "$1/checksums.txt")"
+      actual="$(sha256sum "$1/$2" | awk '{ print $1 }')"
+      [[ -n "$expected" && "$expected" == "$actual" ]]
+    }
+
+    install_prebuilt() {
+      local arch binary download_dir
+      arch="$(plugin_arch)" || return 1
+      binary="import-variable-plugin_linux_$arch"
+      download_dir="$(mktemp -d)"
+      curl -fsSL --retry 3 -o "$download_dir/$binary" "$(release_url "$binary")" &&
+        curl -fsSL --retry 3 -o "$download_dir/importVariables.sh" "$(release_url importVariables.sh)" &&
+        curl -fsSL --retry 3 -o "$download_dir/checksums.txt" "$(release_url checksums.txt)" &&
+        verify_checksum "$download_dir" "$binary" &&
+        verify_checksum "$download_dir" importVariables.sh &&
+        chmod +x "$download_dir/$binary" "$download_dir/importVariables.sh" &&
+        mv "$download_dir/$binary" /opt/import-variable-plugin &&
+        mv "$download_dir/importVariables.sh" /opt/importEnvVariables
+      local result=$?
+      rm -rf "$download_dir"
+      return $result
+    }
+
+    build_from_source() {
+      sudo apk add go
+      rm -rf env0-import-variable-plugin
+      git clone --depth=1 --single-branch ${PLUGIN_VERSION:+--branch "$PLUGIN_VERSION"} "$PLUGIN_REPO"
+      cd env0-import-variable-plugin
+      go build -o ./bin/import-variable-plugin main.go
+      mv ./bin/import-variable-plugin /opt
+      mv ./importVariables.sh /opt/importEnvVariables
+    }
+
+    if ! install_prebuilt; then
+      echo "Could not download the prebuilt plugin binary, building it from source"
+      build_from_source
+    fi
     cd $ENV0_TEMPLATE_DIR
     import-variable-plugin
     importEnvVariables

From 33b1251bf46af5ffec480b442142d9e2d7b59ebe Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Tue, 20 Oct 2026 16:31:00 +0300
Subject: [PATCH 2/7] chore: Run the plugin from this branch in the test flow

---
 test/env0.yaml | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/test/env0.yaml b/test/env0.yaml
index be6d659..c3a7ae0 100644
--- a/test/env0.yaml
+++ b/test/env0.yaml
@@ -5,17 +5,9 @@ deploy:
     setupVariables:
       after:
         - name: Import Variables
-          run: |
-            sudo apk add go
-            git clone --depth=1 --single-branch https://github.com/env0/env0-import-variable-plugin --branch ${REF:-main}
-            cd env0-import-variable-plugin
-            cat main.go
-            go build -o ./bin/import-variable-plugin main.go 
-            mv ./bin/import-variable-plugin /opt
-            mv ./importVariables.sh /opt/importEnvVariables
-            cd $ENV0_TEMPLATE_DIR
-            import-variable-plugin
-            importEnvVariables
+          use: https://github.com/env0/env0-import-variable-plugin@claude/modest-maxwell-462744
+          inputs:
+            version: 0.5.0-rc.1
     terraformOutput:
       after:
         - name: Test Outputs

From 4de4f174905dc17f920b3f37be48c385a2b3062f Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Tue, 20 Oct 2026 17:34:15 +0300
Subject: [PATCH 3/7] chore: Test the build from source fallback in the test
 flow

---
 test/env0.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/env0.yaml b/test/env0.yaml
index c3a7ae0..4b608e3 100644
--- a/test/env0.yaml
+++ b/test/env0.yaml
@@ -7,7 +7,7 @@ deploy:
         - name: Import Variables
           use: https://github.com/env0/env0-import-variable-plugin@claude/modest-maxwell-462744
           inputs:
-            version: 0.5.0-rc.1
+            version: 0.0.0-missing
     terraformOutput:
       after:
         - name: Test Outputs

From fd0aff8d2e1ca83ede73d6a7b3fc2768889e3cda Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Tue, 20 Oct 2026 17:35:40 +0300
Subject: [PATCH 4/7] fix: Clone the default branch when the version tag does
 not exist

---
 env0.plugin.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/env0.plugin.yaml b/env0.plugin.yaml
index 5f274ed..2378eed 100644
--- a/env0.plugin.yaml
+++ b/env0.plugin.yaml
@@ -56,7 +56,8 @@ run:
     build_from_source() {
       sudo apk add go
       rm -rf env0-import-variable-plugin
-      git clone --depth=1 --single-branch ${PLUGIN_VERSION:+--branch "$PLUGIN_VERSION"} "$PLUGIN_REPO"
+      git clone --depth=1 --single-branch ${PLUGIN_VERSION:+--branch "$PLUGIN_VERSION"} "$PLUGIN_REPO" ||
+        git clone --depth=1 --single-branch "$PLUGIN_REPO"
       cd env0-import-variable-plugin
       go build -o ./bin/import-variable-plugin main.go
       mv ./bin/import-variable-plugin /opt

From c5dffd02cb56dd510ebdedd978b8331a505e6f4a Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Tue, 20 Oct 2026 17:37:09 +0300
Subject: [PATCH 5/7] chore: Run the published plugin in the test flow

---
 test/env0.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/test/env0.yaml b/test/env0.yaml
index 4b608e3..1a0167d 100644
--- a/test/env0.yaml
+++ b/test/env0.yaml
@@ -5,9 +5,7 @@ deploy:
     setupVariables:
       after:
         - name: Import Variables
-          use: https://github.com/env0/env0-import-variable-plugin@claude/modest-maxwell-462744
-          inputs:
-            version: 0.0.0-missing
+          use: https://github.com/env0/env0-import-variable-plugin
     terraformOutput:
       after:
         - name: Test Outputs

From 87bd900577f2cde19077762b55d309aba479f0aa Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Tue, 20 Oct 2026 18:03:51 +0300
Subject: [PATCH 6/7] chore: Trigger env0 PR plan


From 8bb79676e0b39889bf9a1de89113470aa62e6158 Mon Sep 17 00:00:00 2001
From: erezrokah <erezrokah@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:03:05 +0300
Subject: [PATCH 7/7] fix: Use the binary that matches the plugin version by
 default

---
 .github/workflows/release.yml | 13 +++++++++++++
 README.md                     |  2 +-
 env0.plugin.yaml              | 15 ++++++---------
 3 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7bfe7be..4305b59 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,6 +28,19 @@ jobs:
           ref: ${{ inputs.tag }}
           persist-credentials: false
 
+      - name: Check the tag matches the plugin default version
+        if: github.event_name != 'pull_request'
+        env:
+          TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          default_version="$(sed -n 's/^ *PLUGIN_DEFAULT_VERSION=//p' env0.plugin.yaml)"
+          if [[ "$TAG" == *-* ]]; then
+            echo "Prerelease $TAG, PLUGIN_DEFAULT_VERSION is $default_version"
+          elif [[ "$TAG" != "$default_version" ]]; then
+            echo "::error::Tag $TAG does not match PLUGIN_DEFAULT_VERSION=$default_version in env0.plugin.yaml"
+            exit 1
+          fi
+
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
diff --git a/README.md b/README.md
index b81dbb7..a183c23 100644
--- a/README.md
+++ b/README.md
@@ -57,7 +57,7 @@ The plugin uses the env0 API to fetch the output values from another environment
 
 ## Inputs
 
-* `version` (optional): The release tag of the plugin binary to use, for example `0.5.0`. If you do not set it, the plugin uses the latest release.
+* `version` (optional): The release tag of the plugin binary to use, for example `0.5.0`. If you do not set it, the plugin uses the release that matches the plugin version in `use:` (for example `@0.5.0` uses the `0.5.0` binary).
 
 ## How the plugin installs
 
diff --git a/env0.plugin.yaml b/env0.plugin.yaml
index 2378eed..9df53e6 100644
--- a/env0.plugin.yaml
+++ b/env0.plugin.yaml
@@ -2,14 +2,15 @@ name: Variable Helper
 icon: https://assets-global.website-files.com/5ceab5395d0f478e169de7c0/5fdf4acfdb893538adabd1ab_Code%20automation%402x.png
 inputs:
   version:
-    description: Release tag of the plugin binary to use (for example 0.5.0). Defaults to the latest release.
+    description: Release tag of the plugin binary to use (for example 0.5.0). Defaults to the release that matches this plugin version.
     required: false
 run:
   exec: |
     PLUGIN_REPO=https://github.com/env0/env0-import-variable-plugin
+    PLUGIN_DEFAULT_VERSION=0.5.0
     PLUGIN_VERSION='${inputs.version}'
-    if [[ "$PLUGIN_VERSION" == *'{inputs.'* ]]; then
-      PLUGIN_VERSION=""
+    if [[ -z "$PLUGIN_VERSION" || "$PLUGIN_VERSION" == *'{inputs.'* ]]; then
+      PLUGIN_VERSION="$PLUGIN_DEFAULT_VERSION"
     fi
 
     plugin_arch() {
@@ -21,11 +22,7 @@ run:
     }
 
     release_url() {
-      if [[ -n "$PLUGIN_VERSION" ]]; then
-        echo "$PLUGIN_REPO/releases/download/$PLUGIN_VERSION/$1"
-      else
-        echo "$PLUGIN_REPO/releases/latest/download/$1"
-      fi
+      echo "$PLUGIN_REPO/releases/download/$PLUGIN_VERSION/$1"
     }
 
     verify_checksum() {
@@ -56,7 +53,7 @@ run:
     build_from_source() {
       sudo apk add go
       rm -rf env0-import-variable-plugin
-      git clone --depth=1 --single-branch ${PLUGIN_VERSION:+--branch "$PLUGIN_VERSION"} "$PLUGIN_REPO" ||
+      git clone --depth=1 --single-branch --branch "$PLUGIN_VERSION" "$PLUGIN_REPO" ||
         git clone --depth=1 --single-branch "$PLUGIN_REPO"
       cd env0-import-variable-plugin
       go build -o ./bin/import-variable-plugin main.go