From f07fe20d3eaffa8f203c3d86d8c47c812e9fc164 Mon Sep 17 00:00:00 2001
From: Joris Wouter Jonkers <info@jorisjonkers.dev>
Date: Thu, 20 Aug 2026 17:42:11 +0200
Subject: [PATCH] refactor(platform): derive the checker version from the
 workflow pin

The wrapper hardcoded deploy-check 0.15.0, which is the same mistake the
400-line copy made with its schema version and context digest -- and 0.15.0
turned out to carry a context-resolution bug fixed in 0.15.1.

deploy-check is released from the same repository as the reusable workflows,
so the version comment on the deploy-validate (or deploy-artifact) pin is the
version to run. The wrapper reads it from there, leaving nothing about the
checker restated in this repository.

The github-workflows pins move to v0.15.1 accordingly. Both reusable
workflow interfaces are unchanged across the versions involved -- same
inputs, same required flags -- so no caller change is needed.
---
 .github/workflows/publish.yml |  2 +-
 platform/render-local.sh      | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 14e7ab8..09cee66 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -135,7 +135,7 @@ jobs:
   # -- 3. Render and publish the deploy artifact ----------------------------
   publish-deploy-artifact:
     needs: [resolve-image-lock]
-    uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@ea7a9a1c52870c2ae3db08cd077d54dbef48aa3d # v0.14.0
+    uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@5b5e93dc81846cac4e13118e7280fd81a143685e # v0.15.1
     with:
       ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }}
       artifact-name: knowledge
diff --git a/platform/render-local.sh b/platform/render-local.sh
index 85f933a..890fd29 100755
--- a/platform/render-local.sh
+++ b/platform/render-local.sh
@@ -20,7 +20,6 @@
 # NODE_AUTH_TOKEN) first: export GITHUB_TOKEN="$(gh auth token)".
 set -euo pipefail
 
-DEPLOY_CHECK_VERSION="0.15.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 cd "$REPO_ROOT"
@@ -45,6 +44,18 @@ value_from_workflows() {
     | awk '{print $2}' | sort -u | head -1
 }
 
+# deploy-check ships from the same repository as the reusable workflows and is
+# released with them, so the version comment on the deploy-validate pin is the
+# version to run. Hardcoding it here is what let the previous copy rot.
+DEPLOY_CHECK_VERSION="$(
+  grep -rhoE 'github-workflows/\.github/workflows/deploy-(validate|artifact)\.yml@[0-9a-f]{40} # v[0-9]+\.[0-9]+\.[0-9]+' \
+    .github/workflows/*.yml 2>/dev/null \
+    | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+$' | tr -d v \
+    | sort -t. -k1,1n -k2,2n -k3,3n | tail -1
+)"
+[ -n "$DEPLOY_CHECK_VERSION" ] \
+  || fail "no '# vX.Y.Z' comment on a deploy-validate/deploy-artifact pin in .github/workflows/*.yml"
+
 SCHEMA_VERSION="$(value_from_workflows 'schema-version')"
 CONTEXT_REF="$(value_from_workflows 'context-ref')"
 [ -n "$SCHEMA_VERSION" ] || fail "no schema-version found in .github/workflows/*.yml"