build: pin the pg-ffi release version in one file

[dobby-coder]

Both workflows resolved the newest pg-ffi-* release at run time, so a new pg-ffi release changed what shipped with the next NuGet publish without any commit here.

The pinned tag now lives in one file, .github/pg-ffi-version. It currently holds pg-ffi-v0.1.2, which is the release both workflows were already resolving to, so the build output does not change today. Bumping that one line moves both workflows.

The workflow half needs a maintainer. The Dobby App cannot push .github/workflows/, so the two workflow steps are in a PR comment below. Committing that patch onto this branch completes the change; without it the pin file is inert.

In the commit:

• .github/pg-ffi-version with the pinned tag.
• PgFfiVersionTests: the file holds exactly one line matching pg-ffi-vX.Y.Z. A malformed pin is worse than a broken build, because gh release download "" falls back to downloading from the newest release, which is the behaviour this issue is about.
• README: one line pointing local pg-ffi builds at the pinned tag.
• CLAUDE.md: where the pin lives, and not to reintroduce a newest-release lookup.

Checked locally: both patched download steps run against the pinned tag, build.yml pulling linux-x64 and delivery.yml pulling all five targets. A bad tag and an empty pin file both fail the step. Test suite passes on net10.0 (84 tests); the workspace has no net8.0 runtime, so CI covers that target.

Renovate is not configured in this repo, so bumping the pin is a manual edit for now.

Refs #50. Once the workflow patch is applied and merged, #50 can be closed.
Part of encryption4all/postguard#247 (workstream F).

[dobby-coder]

The workflow half of this change. The Dobby App has no workflows permission, so this cannot go in the branch:

! [remote rejected] refusing to allow a GitHub App to create or update workflow `.github/workflows/build.yml` without `workflows` permission

Apply it on top of build/pin-pg-ffi-version with git apply (or paste it in by hand) and the change is complete.

build.yml also loses the build-from-source fallback: it only existed because the newest-release lookup could come back empty. With a pinned tag, a failed download means the pin is wrong, and compiling postguard HEAD instead would hide that while shipping binaries the delivery workflow never publishes.

Patch (git apply)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e8a8e28..e5901c6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,22 +20,18 @@ jobs:
             8.0.x
             10.0.x
 
-      # Download pre-built native library for CI
+      # Download the pinned pre-built native library for CI
       - name: Download pg-ffi native library
         run: |
-          TAG=$(gh release list --repo encryption4all/postguard --json tagName -q '[.[] | select(.tagName | startswith("pg-ffi-"))][0].tagName' 2>/dev/null || true)
-          if [ -n "$TAG" ]; then
-            mkdir -p src/runtimes/linux-x64/native
-            gh release download "$TAG" --repo encryption4all/postguard --pattern "pg-ffi-linux-x64.tar.gz" --dir /tmp
-            tar xzf /tmp/pg-ffi-linux-x64.tar.gz -C src/runtimes/linux-x64/native
-          else
-            echo "::warning::No pg-ffi release found. Building from source."
-            rustup default stable
-            git clone --depth 1 https://github.com/encryption4all/postguard.git /tmp/postguard
-            cargo build --release -p pg-ffi --manifest-path /tmp/postguard/Cargo.toml
-            mkdir -p src/runtimes/linux-x64/native
-            cp /tmp/postguard/target/release/libpg_ffi.so src/runtimes/linux-x64/native/
+          TAG=$(tr -d '[:space:]' < .github/pg-ffi-version)
+          if [ -z "$TAG" ]; then
+            echo "::error::.github/pg-ffi-version is empty or missing"
+            exit 1
           fi
+          echo "Using release: $TAG"
+          mkdir -p src/runtimes/linux-x64/native
+          gh release download "$TAG" --repo encryption4all/postguard --pattern "pg-ffi-linux-x64.tar.gz" --dir /tmp
+          tar xzf /tmp/pg-ffi-linux-x64.tar.gz -C src/runtimes/linux-x64/native
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/delivery.yml b/.github/workflows/delivery.yml
index 98f8e30..4d17434 100644
--- a/.github/workflows/delivery.yml
+++ b/.github/workflows/delivery.yml
@@ -54,13 +54,13 @@ jobs:
             8.0.x
             10.0.x
 
-      # Download native libraries for all platforms from the postguard repo
+      # Download the pinned native libraries for all platforms from the postguard repo
       - name: Download pg-ffi native libraries
         run: |
           RUNTIMES_DIR="src/runtimes"
-          TAG=$(gh release list --repo encryption4all/postguard --json tagName -q '[.[] | select(.tagName | startswith("pg-ffi-"))][0].tagName')
+          TAG=$(tr -d '[:space:]' < .github/pg-ffi-version)
           if [ -z "$TAG" ]; then
-            echo "::error::No pg-ffi release found"
+            echo "::error::.github/pg-ffi-version is empty or missing"
             exit 1
           fi
           echo "Using release: $TAG"

[dobby-coder]

VERDICT: approve

Rule sweep and review are both clean. No blocking findings.

Two nits came out of the review. One is fixed on the branch, the other is a note for whoever applies the workflow patch.

Fixed in 151f9d2. PgFfiVersionTests filtered blank lines with line.Trim().Length > 0 but matched lines[0] untrimmed, so a pin written as pg-ffi-v0.1.2 failed the test even though the workflow's tr -d '[:space:]' resolves it fine. The assertion now trims. Re-checked by mutation: leading and trailing whitespace now pass; empty, whitespace-only, two-line, v0.1.2, pg-ffi-v0.1, pg-ffi-v0.1.2-rc1 and an internal space all still fail. Full suite green, 84 tests on net10.0.

Not fixed, a note for the workflow patch. Both build.yml and delivery.yml read the pin like this:

TAG=$(tr -d '[:space:]' < .github/pg-ffi-version)
if [ -z "$TAG" ]; then
  echo "::error::.github/pg-ffi-version is empty or missing"

Under the Actions default bash -e, a missing file makes the command substitution fail and the step aborts on the raw tr: No such file or directory before reaching that line, so the "or missing" half of the message never prints. Verified locally on bash 5.2: missing exits 1 on the shell error, empty and whitespace-only both print the annotation and exit 1. It fails closed either way, so no wrong binary can ship and this is not worth blocking on. Putting [ -f .github/pg-ffi-version ] || { echo '::error::...'; exit 1; } ahead of the read would make the message say what it means.

Worth restating from the PR body: the pin file is inert until the workflow patch in the comment above is committed onto this branch. Merging this branch on its own does not change what CI downloads.

Flipping out of draft.