From 6088e55c841d2f5cf40fbbd354e397d589f88d52 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 27 Jul 2026 14:41:23 +0100
Subject: [PATCH 1/2] fix(ci): make the toolchain version asserts diagnosable

`idris2 --version | grep -Fx 'Idris 2, version 0.7.0'` failed the job with no
output whatsoever: the pipeline swallowed the version, grep matched nothing,
and `set -o pipefail` ended the step before anything was printed. The log gave
no clue what version was actually installed.

Capture the version, echo it, then assert. The Idris2 check now matches on the
release ("0.7.0") rather than the whole string, since the digest-pinned
idris2-pack image reports a build suffix. The Zig check keeps its exact
equality but now reports what it found when it fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d2d5e2..3c18f2b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,14 +47,25 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          idris2 --version | grep -Fx 'Idris 2, version 0.7.0'
+          # Print the version before asserting on it: piping straight into
+          # `grep -Fx` under `pipefail` made a mismatch fail with no output at
+          # all, which is what happened here. The pinned image reports a build
+          # suffix, so match on the release rather than the whole string.
+          ver="$(idris2 --version)"
+          echo "idris2 --version -> ${ver}"
+          case "$ver" in
+            *"0.7.0"*) ;;
+            *) echo "::error::expected Idris 2 0.7.0, got: ${ver}"; exit 1 ;;
+          esac
           idris2 --typecheck abi.ipkg
 
       - name: Compile and test the Zig FFI
         shell: bash
         run: |
           set -euo pipefail
-          test "$(zig version)" = '0.15.2'
+          zver="$(zig version)"
+          echo "zig version -> ${zver}"
+          test "$zver" = '0.15.2' || { echo "::error::expected Zig 0.15.2, got: ${zver}"; exit 1; }
           zig fmt --check \
             src/interface/ffi/build.zig \
             src/interface/ffi/src/main.zig \

From 9d3170f405348d1059ef48a77387dc8c23cf49a5 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 27 Jul 2026 14:45:36 +0100
Subject: [PATCH 2/2] fix(ci): align the Idris2 version assert with the pinned
 image (0.8.0)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With the assert made diagnosable, the actual mismatch is visible:

    idris2 --version -> Idris 2, version 0.8.0-6ca00e72e
    ::error::expected Idris 2 0.7.0

The digest-pinned idris2-pack image ships 0.8.0, so the 0.7.0 assertion could
never have matched and this job has never passed on its own terms.

Nothing in the repository actually requires 0.7.0: abi.ipkg declares no version
constraint (it depends only on `base`), and the `idris2 0.7.0` line in
.tool-versions is commented out, so it pins nothing. The only 0.7.0 references
were the workflow asserts and their comments — stale documentation that drifted
from the digest.

The immutable digest is the authority, so the version notes are brought into
step with it rather than the other way round. The typecheck now actually runs.

Also fixes the identical brittle assert in release.yml, which piped
`idris2 --version` into `grep -Fx` under pipefail exactly as ci.yml did.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml      | 7 ++++---
 .github/workflows/release.yml | 8 +++++++-
 .tool-versions                | 2 +-
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c18f2b..b048d00 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     container:
-      # Idris 2 0.7.0, pinned by immutable image digest.
+      # Idris 2 0.8.0, pinned by immutable image digest.
+      # The digest is the authority; keep the version note in step with it.
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:de9781906050dc44704ec6de0108c86f899ef17b2642932b79e00245d613b8ad
     steps:
       - name: Checkout
@@ -54,8 +55,8 @@ jobs:
           ver="$(idris2 --version)"
           echo "idris2 --version -> ${ver}"
           case "$ver" in
-            *"0.7.0"*) ;;
-            *) echo "::error::expected Idris 2 0.7.0, got: ${ver}"; exit 1 ;;
+            *"0.8.0"*) ;;
+            *) echo "::error::expected Idris 2 0.8.0, got: ${ver}"; exit 1 ;;
           esac
           idris2 --typecheck abi.ipkg
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 23c62e2..88e7eec 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,7 +34,13 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          idris2 --version | grep -Fx 'Idris 2, version 0.7.0'
+          # Same fix as ci.yml: never assert through a pipe under pipefail.
+          ver="$(idris2 --version)"
+          echo "idris2 --version -> ${ver}"
+          case "$ver" in
+            *"0.8.0"*) ;;
+            *) echo "::error::expected Idris 2 0.8.0, got: ${ver}"; exit 1 ;;
+          esac
           idris2 --typecheck abi.ipkg
           (
             cd src/interface/ffi
diff --git a/.tool-versions b/.tool-versions
index ce60c32..f7b2c5e 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -6,5 +6,5 @@
 # elixir 1.18.0
 # erlang 27.2
 # zig 0.14.0
-# idris2 0.7.0
+# idris2 0.8.0
 rust nightly