bug(`forge install`): inconsistent behavior of forge install

[QGarchery]

Component

Forge

Have you ensured that all of these are up to date?

• [x] Foundry
• [x] Foundryup

What version of Foundry are you on?

forge Version: 1.2.1-stable Commit SHA: 42341d5c94947d566c21a539aead92c4c53837a2 Build Timestamp: 2025-05-26T05:24:48.799227114Z (1748237088) Build Profile: maxperf

What version of Foundryup are you on?

foundryup: 1.0.0

What command(s) is the bug in?

forge install

Operating System

Linux

Describe the bug

Using forge install will sometimes point to the latest commit on the repository, and sometimes use the latest tag. After some minimal testing, it seems like:

• a tag of v1.0.0 will be used instead of the latest commit;
• a tag of v0.0.1 will not be used, the latest commit will be used instead.

Ideally the behavior of forge install would be documented to specify what branch / tag / commit it will target (depending on the setup of the repository), when no ref is given. Personally, I would find that using the same behavior as git submodule add would make it easier to use.

[zerosnacks]

This sounds like a bug

Tangentially related: https://github.com/foundry-rs/foundry/pull/9522

cc @yash-atreya

[grandizzy]

@QGarchery you can use @tag / @rev / @branch since https://github.com/foundry-rs/foundry/pull/9214 e.g.

 forge install github.com/owner/repo@branch=my-branch
 forge install github.com/owner/repo@tag=v1.1
 forge install github.com/owner/repo@rev=8e8128

[QGarchery]

Yes I see that you can use a ref to specify what it will target (issue description has a screenshot of the documentation). But as a developer of a repository, one might be interested to know what will be the default ref that will be used, to make sure that by default forge install will use the safest / most up-to-date version

[grandizzy]

@QGarchery forge install follows now foundry.lock file, please reopen if this is still an issue. thank you!