Check for a newer Sume CLI release in CI without auto-upgrading

sume update --check tells you whether a newer GitHub Release exists and, per the install docs, it does not modify local files. In CI, run it on a schedule, save the text, and treat an upgrade as a deliberate change to the tag you pin.

What is documented

The docs do not specify the output format or an exit code for the "newer release exists" case, so do not build a gate on parsing it. Use it as a notification and keep the pin as the source of truth.

A scheduled report

A nightly job can write both outputs to one file that your team reads or diffs. It never installs anything.

set -euo pipefail
{
  echo "installed: $(sume version)"
  echo "check:"
  sume update --check
} | tee cli-version-report.txt

Scope of the job

The report step runs only sume version and sume update --check, both listed in the CLI command reference as plain commands with no job submit or confirm flag, so it triggers no paid generation.

How to upgrade

When the report shows a newer release, open a pull request that edits the pinned tag in your install step. The checksum and pin recipe covers the verification side. Re-run sume doctor --agent --json after the bump.