Merge pull request 'ci: pin the platform harness to the released Core v0.2.5' (#21) from ci/pin-platform-v0.2.5 into main

Reviewed-on: #21
Reviewed-by: Zayin_Admin <[email protected]>

.gitea/workflows/ci.yml

@@ -3,7 +3,7 @@ name: CI
 # Signage is a standalone repository: every job installs it with --frozen-lockfile from its own
 # pnpm-lock.yaml and takes Ekklesia's module-development packages (@ekklesia/*) from Ekklesia's
 # public package registry (.npmrc; platform ADRs 0053 and 0054). Only the integration job fetches
-# Core source: one immutable commit through the pinned Gitea pull ref in ci/platform.env, used as the
+# Core source: one immutable commit through the pinned Gitea ref in ci/platform.env, used as the
 # generic deployment harness and image source, never as a workspace dependency.
 #
 # The same trust rules as the platform's own CI (docs/development/security.md there):

ci/check-cleanup.sh

@@ -40,9 +40,9 @@ check '[[ -n "$own" && -n "$run" ]] && ((own > run)) && ((own > last_step))' \
 check 'sed -n "${last_step},\$p" <<<"$job" | grep -q "if: always()"' "that last step always runs"
 check 'grep -q "EKKLESIA_SMOKE_MODULE_RELEASE_DIR" "$root/ci/integration.sh" && grep -q "bash scripts/smoke-deploy.sh" "$root/ci/integration.sh"' \
   "the integration delegates its external package to the platform smoke"
-check 'grep -Eq "^EKKLESIA_PLATFORM_REF=refs/(pull/[0-9]+/head|heads/main)$" "$root/ci/platform.env" && grep -Eq "^EKKLESIA_PLATFORM_COMMIT=[0-9a-f]{40}$" "$root/ci/platform.env"' \
+check 'grep -Eq "^EKKLESIA_PLATFORM_REF=refs/(pull/[0-9]+/head|heads/main|tags/v[0-9]+\.[0-9]+\.[0-9]+)$" "$root/ci/platform.env" && grep -Eq "^EKKLESIA_PLATFORM_COMMIT=[0-9a-f]{40}$" "$root/ci/platform.env"' \
   "the platform harness is pinned by full ref and commit"
-check 'grep -q "rev-parse refs/remotes/pinned" "$root/ci/fetch-platform.sh" && grep -q "does not resolve to EKKLESIA_PLATFORM_COMMIT" "$root/ci/fetch-platform.sh"' \
+check 'grep -qF "rev-parse \"refs/remotes/pinned^{commit}\"" "$root/ci/fetch-platform.sh" && grep -q "does not resolve to EKKLESIA_PLATFORM_COMMIT" "$root/ci/fetch-platform.sh"' \
   "the fetch verifies that the pinned ref resolves to the pinned commit"
 
 # Normal CI builds the canonical archive once and hands those exact bytes to integration through a

ci/fetch-platform.sh

@@ -32,7 +32,7 @@ git -C "$out" init --quiet
 git -C "$out" remote add origin "$repository"
 git -C "$out" fetch --quiet --no-tags --depth=1 origin "+${ref}:refs/remotes/pinned" ||
   fail "cannot fetch the pinned platform ref."
-[[ "$(git -C "$out" rev-parse refs/remotes/pinned)" == "$commit" ]] ||
+[[ "$(git -C "$out" rev-parse "refs/remotes/pinned^{commit}")" == "$commit" ]] ||
   fail "the pinned ref does not resolve to EKKLESIA_PLATFORM_COMMIT."
 git -C "$out" -c advice.detachedHead=false checkout --quiet --detach "$commit"
 rm -rf "$out/.git"

ci/platform.env

@@ -1,5 +1,6 @@
-# The companion Core harness Signage uses to install and run its real external package. The pull ref
+# The companion Core harness Signage uses to install and run its real external package: a released
-# remains reachable after its branch is deleted; the full commit pin makes the checkout immutable.
+# Core, by its tag. A pull request's ref (refs/pull/N/head) is used only while Signage depends on a
+# Core change still in review. The full commit pin makes the checkout immutable either way.
 EKKLESIA_PLATFORM_REPOSITORY=https://git.zayin.net/Zayin/Ekklesia.git
-EKKLESIA_PLATFORM_REF=refs/pull/92/head
+EKKLESIA_PLATFORM_REF=refs/tags/v0.2.5
-EKKLESIA_PLATFORM_COMMIT=5e9433d96b413117374a6132d89400867414c2c8
+EKKLESIA_PLATFORM_COMMIT=437720f2286e962829f2ec8c1c6137ea24f87b9f