From f4d816d72027cbaae12228844613a52859b31c65 Mon Sep 17 00:00:00 2001
From: Esteban Zimanyi <estebanzimanyi@gmail.com>
Date: Wed, 15 Jul 2026 08:27:35 +0200
Subject: [PATCH] Pin the MEOS source commit for provision-meos
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Record the upstream MobilityDB commit in tools/meos-source-commit.txt and
have CI read it to feed provision-meos, so the derived catalog and the
libmeos build stay in lockstep with one pinned surface. This matches the
Spark/Flink/Kafka bindings, giving every provision-meos consumer the same
way to select the MEOS source — a single-file edit to bump it.
---
 .github/workflows/deploy_javadoc.yml | 15 +++++++++++----
 .github/workflows/maven.yml          | 19 +++++++++++++------
 tools/meos-source-commit.txt         |  1 +
 3 files changed, 25 insertions(+), 10 deletions(-)
 create mode 100644 tools/meos-source-commit.txt

diff --git a/.github/workflows/deploy_javadoc.yml b/.github/workflows/deploy_javadoc.yml
index 2a276fc8..9820ed58 100644
--- a/.github/workflows/deploy_javadoc.yml
+++ b/.github/workflows/deploy_javadoc.yml
@@ -22,14 +22,21 @@ jobs:
       - name: Set up Maven
         run: mvn -B wrapper:wrapper
 
-      # Derive the MEOS catalog from MobilityDB in CI — it is no longer committed.
-      # Catalog-only (build-libmeos: false): javadoc compiles the sources but never
-      # runs them, so the native libmeos is not needed here.
+      - name: Resolve the MEOS source commit
+        id: meos
+        # The MEOS catalog is derived from one upstream MobilityDB commit, recorded once
+        # in tools/meos-source-commit.txt (the same pin the build workflow uses), so both
+        # workflows stay in lockstep — bumping the surface is a single edit there.
+        run: echo "sha=$(tr -d '[:space:]' < tools/meos-source-commit.txt)" >> "$GITHUB_OUTPUT"
+
+      # Derive the MEOS catalog from the pinned MobilityDB commit in CI — it is not
+      # committed. Catalog-only (build-libmeos: false): javadoc compiles the sources but
+      # never runs them, so the native libmeos is not needed here.
       - name: Provision MEOS catalog
         id: provision
         uses: MobilityDB/MEOS-API/.github/actions/provision-meos@master
         with:
-          mobilitydb-ref: master
+          mobilitydb-ref: ${{ steps.meos.outputs.sha }}
           build-libmeos: "false"
 
       # Stage the derived catalog where FunctionsGenerator reads it at build time.
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index ce7194cb..560ffb10 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -42,17 +42,24 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-maven-
 
+      - name: Resolve the MEOS source commit
+        id: meos
+        # The MEOS catalog (meos-idl.json) and the libmeos build are derived from one
+        # upstream MobilityDB commit, recorded once in tools/meos-source-commit.txt. CI
+        # reads it so the derived catalog and the native library stay in lockstep with
+        # the pinned surface — bumping the surface is a single edit there, no SHA duplicated.
+        run: echo "sha=$(tr -d '[:space:]' < tools/meos-source-commit.txt)" >> "$GITHUB_OUTPUT"
+
       # Derive the MEOS catalog (meos-idl.json via run.py) and build+install the
-      # all-families libmeos.so from MobilityDB master, through the shared composite
-      # action. It does the full libmeos provisioning itself (PostgreSQL purge, PGDG,
-      # PG17, build deps, cmake, install under /usr/local), so no inline apt/PG/cmake
-      # steps are needed here. Tracking master keeps the derived catalog and the
-      # libmeos build in lockstep with the same upstream commit — drift-free.
+      # all-families libmeos.so from the pinned MobilityDB commit, through the shared
+      # composite action. It does the full libmeos provisioning itself (PostgreSQL purge,
+      # PGDG, PG17, build deps, cmake, install under /usr/local), so no inline apt/PG/cmake
+      # steps are needed here.
       - name: Provision MEOS catalog + libmeos
         id: provision
         uses: MobilityDB/MEOS-API/.github/actions/provision-meos@master
         with:
-          mobilitydb-ref: master
+          mobilitydb-ref: ${{ steps.meos.outputs.sha }}
           build-libmeos: "true"
 
       # Stage the derived catalog where FunctionsGenerator reads it at build time.
diff --git a/tools/meos-source-commit.txt b/tools/meos-source-commit.txt
new file mode 100644
index 00000000..92f7d248
--- /dev/null
+++ b/tools/meos-source-commit.txt
@@ -0,0 +1 @@
+21eb87481e000b52f5136979d0396f81fbfd2a1b