Pin the MEOS source commit for provision-meos

.github/workflows/deploy_javadoc.yml

@@ -22,14 +22,21 @@ jobs:
       - name: Set up Maven
         run: mvn -B wrapper:wrapper
 
-      # Derive the MEOS catalog from MobilityDB in CI — it is no longer committed.
-      # Catalog-only (build-libmeos: false): javadoc compiles the sources but never
-      # runs them, so the native libmeos is not needed here.
+      - name: Resolve the MEOS source commit
+        id: meos
+        # The MEOS catalog is derived from one upstream MobilityDB commit, recorded once
+        # in tools/meos-source-commit.txt (the same pin the build workflow uses), so both
+        # workflows stay in lockstep — bumping the surface is a single edit there.
+        run: echo "sha=$(tr -d '[:space:]' < tools/meos-source-commit.txt)" >> "$GITHUB_OUTPUT"
+
+      # Derive the MEOS catalog from the pinned MobilityDB commit in CI — it is not
+      # committed. Catalog-only (build-libmeos: false): javadoc compiles the sources but
+      # never runs them, so the native libmeos is not needed here.
       - name: Provision MEOS catalog
         id: provision
         uses: MobilityDB/MEOS-API/.github/actions/provision-meos@master
         with:
-          mobilitydb-ref: master
+          mobilitydb-ref: ${{ steps.meos.outputs.sha }}
           build-libmeos: "false"
 
       # Stage the derived catalog where FunctionsGenerator reads it at build time.

.github/workflows/maven.yml

@@ -42,17 +42,24 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-maven-
 
+      - name: Resolve the MEOS source commit
+        id: meos
+        # The MEOS catalog (meos-idl.json) and the libmeos build are derived from one
+        # upstream MobilityDB commit, recorded once in tools/meos-source-commit.txt. CI
+        # reads it so the derived catalog and the native library stay in lockstep with
+        # the pinned surface — bumping the surface is a single edit there, no SHA duplicated.
+        run: echo "sha=$(tr -d '[:space:]' < tools/meos-source-commit.txt)" >> "$GITHUB_OUTPUT"
+
       # Derive the MEOS catalog (meos-idl.json via run.py) and build+install the
-      # all-families libmeos.so from MobilityDB master, through the shared composite
-      # action. It does the full libmeos provisioning itself (PostgreSQL purge, PGDG,
-      # PG17, build deps, cmake, install under /usr/local), so no inline apt/PG/cmake
-      # steps are needed here. Tracking master keeps the derived catalog and the
-      # libmeos build in lockstep with the same upstream commit — drift-free.
+      # all-families libmeos.so from the pinned MobilityDB commit, through the shared
+      # composite action. It does the full libmeos provisioning itself (PostgreSQL purge,
+      # PGDG, PG17, build deps, cmake, install under /usr/local), so no inline apt/PG/cmake
+      # steps are needed here.
       - name: Provision MEOS catalog + libmeos
         id: provision
         uses: MobilityDB/MEOS-API/.github/actions/provision-meos@master
         with:
-          mobilitydb-ref: master
+          mobilitydb-ref: ${{ steps.meos.outputs.sha }}
           build-libmeos: "true"
 
       # Stage the derived catalog where FunctionsGenerator reads it at build time.

tools/meos-source-commit.txt

@@ -0,0 +1 @@
+21eb87481e000b52f5136979d0396f81fbfd2a1b