From 1b6bd339872fd5230f387c9f7a861b16dcdb8e44 Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 12:02:18 +0800
Subject: [PATCH 1/2] ci: guard shared dependency pins against drift

---
 scripts/check-dependency-pins.sh | 48 ++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 scripts/check-dependency-pins.sh

diff --git a/scripts/check-dependency-pins.sh b/scripts/check-dependency-pins.sh
new file mode 100644
index 0000000..6210ae4
--- /dev/null
+++ b/scripts/check-dependency-pins.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORKFLOWS=(
+  "$ROOT/.github/workflows/ci.yml"
+  "$ROOT/.github/workflows/acceptance.yml"
+  "$ROOT/.github/workflows/release.yml"
+)
+
+fail() {
+  echo "dependency pin preflight: $*" >&2
+  exit 1
+}
+
+env_pin() {
+  local file="$1"
+  local name="$2"
+  sed -nE "s/^[[:space:]]*${name}:[[:space:]]*([0-9a-f]{40})[[:space:]]*$/\\1/p" "$file" | head -n1
+}
+
+RIVET_PIN="$(env_pin "${WORKFLOWS[0]}" RIVET_PIN)"
+[[ -n "$RIVET_PIN" ]] || fail "missing RIVET_PIN in ci.yml"
+
+for workflow in "${WORKFLOWS[@]}"; do
+  pin="$(env_pin "$workflow" RIVET_PIN)"
+  [[ -n "$pin" ]] || fail "missing RIVET_PIN in ${workflow#"$ROOT/"}"
+  [[ "$pin" == "$RIVET_PIN" ]] ||     fail "RIVET_PIN drift: ${workflow#"$ROOT/"} has $pin, expected $RIVET_PIN"
+done
+
+while IFS= read -r action_pin; do
+  [[ "$action_pin" == "$RIVET_PIN" ]] ||     fail "setup-embed-racket ref $action_pin does not match RIVET_PIN $RIVET_PIN"
+done < <(
+  grep -h -oE 'turinglambdaai/rivet/\.github/actions/setup-embed-racket@[0-9a-f]{40}'     "${WORKFLOWS[@]}" |
+    sed -E 's/.*@//'
+)
+
+KEEL_PIN="$(env_pin "$ROOT/.github/workflows/acceptance.yml" KEEL_PIN)"
+[[ -n "$KEEL_PIN" ]] || fail "missing KEEL_PIN in acceptance.yml"
+
+while IFS= read -r keel_pin; do
+  [[ "$keel_pin" == "$KEEL_PIN" ]] ||     fail "Keel pin drift: found $keel_pin, expected $KEEL_PIN"
+done < <(
+  grep -h -oE 'turinglambdaai/keel\.git#[0-9a-f]{40}' "${WORKFLOWS[@]}" |
+    sed -E 's/.*#//'
+)
+
+echo "dependency pin preflight: aligned (Rivet $RIVET_PIN, Keel $KEEL_PIN)"

From b46ad93b1662480bca9947d37284adf7025bc22b Mon Sep 17 00:00:00 2001
From: TuringLambdaAI <jirentianxiang1024@gmail.com>
Date: Mon, 19 Oct 2026 12:02:25 +0800
Subject: [PATCH 2/2] ci: run dependency pin drift preflight

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a3d80b..7fca7a9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,8 @@ jobs:
         run: scripts/sync-i18n.sh --check
       - name: Verify release version alignment
         run: bash scripts/check-release-version.sh
+      - name: Verify dependency pins stay aligned
+        run: bash scripts/check-dependency-pins.sh
 
   core:
     name: Racket core (contract tests)