From 26d257fee712176b103d1771ad72c746d314c86c Mon Sep 17 00:00:00 2001
From: sunrisepeak <speakshen@163.com>
Date: Sun, 3 May 2026 07:02:07 +0800
Subject: [PATCH] ci: pin bootstrap xlings to v0.4.13 (was unpinned, followed
 latest)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add explicit XLINGS_VERSION env so quick_install pins to v0.4.13.
Without a pin, the workflow tracks latest released xlings — fine in
steady state, but cascades surprise breakage when an in-flight xlings
release ships a regression (e.g. 0.4.11's elfpatch self-patch
broke libxpkg CI for hours until 0.4.12 hotfix shipped).

Bump in lockstep with libxpkg releases that exercise new xlings
features.
---
 .github/workflows/ci.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ec32b5..6835bde 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,13 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  # Pin xlings bootstrap to the version we develop libxpkg against. Bumping
+  # together with code changes that depend on the new release. Without a
+  # pin, quick_install.sh follows latest — fine in steady state, risky when
+  # an in-flight xlings release breaks something we use.
+  XLINGS_VERSION: v0.4.13
+
 jobs:
   build-linux:
     runs-on: ubuntu-latest
@@ -27,9 +34,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y build-essential
 
-      - name: Install Xlings
+      - name: Install Xlings (pinned ${{ env.XLINGS_VERSION }})
         env:
           XLINGS_NON_INTERACTIVE: 1
+          XLINGS_VERSION: ${{ env.XLINGS_VERSION }}
         run: |
           curl -fsSL https://raw.githubusercontent.com/d2learn/xlings/refs/heads/main/tools/other/quick_install.sh | bash
           echo "PATH=$HOME/.xlings/subos/current/bin:$PATH" >> "$GITHUB_ENV"