fix: default the /dismiss workflow to the latest engine

templates/dismiss.yml defaulted ECR_VERSION to '^0.2.3'. On 0.x a caret
range only matches its own minor, so every scaffolded /dismiss ran 0.2.3.
That engine writes back only { review, dismissed }, silently dropping
feedback, pins, scopes and inline links from the comment state, and it
would throw on any severity it doesn't know. Default to 'latest' like the
other templates, and test that every template does.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/__tests__/init-scaffold.test.ts

@@ -305,6 +305,22 @@ test("every `uses:` in templates/*.yml is pinned by 40-hex commit SHA with a ver
   expect(usesLines).toBeGreaterThanOrEqual(7);
 });
 
+test("every templates/*.yml defaults ECR_VERSION to latest", async () => {
+  // A range like `^0.2.3` resolves to 0.2.3 itself on 0.x, so a workflow that
+  // defaulted to one would run an engine too old to read the comment state the
+  // review workflows write.
+  const files = (await readdir(TEMPLATES_DIR)).filter((f) => f.endsWith(".yml"));
+  expect(files).toContain("dismiss.yml");
+  for (const file of files) {
+    const yml = await readFile(path.join(TEMPLATES_DIR, file), "utf8");
+    const defaults = [...yml.matchAll(/^\s*ECR_VERSION: (.*)$/gm)].map((m) => m[1]);
+    expect({ file, defaults }).toEqual({
+      file,
+      defaults: ["${{ vars.ECR_VERSION || 'latest' }}"],
+    });
+  }
+});
+
 // @ref LLP 0012#what-gets-scanned [constrained-by] — a scaffold must pass `ecr ref-check` on day one
 test("a freshly scaffolded repo passes ref-check", async () => {
   const root = await freshRepo();

templates/dismiss.yml

@@ -18,9 +18,10 @@ permissions:
   issues: write
 
 env:
-  # Published reviewer run via npx (override with repo variable ECR_VERSION).
-  # Floor at 0.2.3 — the first version that ships `ecr dismiss`/`undismiss`.
-  ECR_VERSION: ${{ vars.ECR_VERSION || '^0.2.3' }}
+  # Published reviewer run via npx (override with repo variable ECR_VERSION; pin to
+  # a specific version to freeze it). Defaults to `latest` like the review workflows:
+  # /dismiss rewrites the comment state they write, so it must understand all of it.
+  ECR_VERSION: ${{ vars.ECR_VERSION || 'latest' }}
 
 concurrency:
   group: ai-code-review-dismiss-${{ github.event.issue.number }}