From 83194395e5b6429e9c2a0d4de6981ee908842c6f Mon Sep 17 00:00:00 2001
From: Taras Mankovski <74687+taras@users.noreply.github.com>
Date: Sat, 18 Jul 2026 21:29:55 -0400
Subject: [PATCH] release: deno task bump also moves the CI binary pins
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The XMD_VERSION pins in review.yml and repo-analysis.yml now travel with the
manifests in one bump, closing the last lockstep gap — and the current pins
catch up from v0.3.0 to the released v0.3.1.
---
 .github/workflows/repo-analysis.yml |  2 +-
 .github/workflows/review.yml        |  2 +-
 scripts/bump-version.ts             | 15 +++++++++++++++
 specs/release-process-spec.md       |  3 ++-
 4 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/repo-analysis.yml b/.github/workflows/repo-analysis.yml
index be42361..f01536d 100644
--- a/.github/workflows/repo-analysis.yml
+++ b/.github/workflows/repo-analysis.yml
@@ -33,7 +33,7 @@ jobs:
       # analysis behavior; bump the pin as part of each release.
       - name: Install xmd release binary
         run: |
-          curl -fsSL https://executable.md/install.sh | XMD_VERSION=v0.3.0 sh
+          curl -fsSL https://executable.md/install.sh | XMD_VERSION=v0.3.1 sh
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Run repo analysis
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index b076e74..1b5af3e 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -19,7 +19,7 @@ jobs:
       # PR-review behavior; bump the pin as part of each release.
       - name: Install xmd release binary
         run: |
-          curl -fsSL https://executable.md/install.sh | XMD_VERSION=v0.3.0 sh
+          curl -fsSL https://executable.md/install.sh | XMD_VERSION=v0.3.1 sh
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Run review
diff --git a/scripts/bump-version.ts b/scripts/bump-version.ts
index c2e4373..6a19e24 100644
--- a/scripts/bump-version.ts
+++ b/scripts/bump-version.ts
@@ -60,5 +60,20 @@ await main(function* (args) {
     }
   }
 
+  // CI installs the released binary by pinned version; the pins move in
+  // lockstep with the manifests so reviews run the release being cut.
+  for (const workflow of [".github/workflows/review.yml", ".github/workflows/repo-analysis.yml"]) {
+    const url = new URL(workflow, repoRoot);
+    const text = yield* readTextFile(url);
+    const updated = text.replace(/XMD_VERSION=v\S+/, `XMD_VERSION=v${version}`);
+    if (updated === text) {
+      console.error(`no XMD_VERSION pin found in ${workflow}`);
+      yield* exit(1);
+      return;
+    }
+    yield* writeTextFile(url, updated);
+    console.log(`pinned ${workflow} -> v${version}`);
+  }
+
   console.log(`done — commit, merge, then publish the draft release as v${version}`);
 });
diff --git a/specs/release-process-spec.md b/specs/release-process-spec.md
index 2746673..6dba543 100644
--- a/specs/release-process-spec.md
+++ b/specs/release-process-spec.md
@@ -55,7 +55,8 @@ are the single source. The npm version derives from the tag, and both
 workflows refuse a tag the manifests do not declare, so the two cannot
 diverge.
 
-To cut a release: run `deno task bump <version>` (stamps every manifest),
+To cut a release: run `deno task bump <version>` (stamps every manifest and
+the `XMD_VERSION` binary pins in the review/analysis workflows),
 merge to `main`, then publish the draft release — its tag follows the
 manifests (§3).