release: deno task bump also moves the CI binary pins

.github/workflows/repo-analysis.yml

@@ -33,7 +33,7 @@ jobs:
       # analysis behavior; bump the pin as part of each release.
       - name: Install xmd release binary
         run: |
-          curl -fsSL https://executable.md/install.sh | XMD_VERSION=v0.3.0 sh
+          curl -fsSL https://executable.md/install.sh | XMD_VERSION=v0.3.1 sh
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Run repo analysis

.github/workflows/review.yml

@@ -19,7 +19,7 @@ jobs:
       # PR-review behavior; bump the pin as part of each release.
       - name: Install xmd release binary
         run: |
-          curl -fsSL https://executable.md/install.sh | XMD_VERSION=v0.3.0 sh
+          curl -fsSL https://executable.md/install.sh | XMD_VERSION=v0.3.1 sh
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Run review

scripts/bump-version.ts

@@ -60,5 +60,20 @@ await main(function* (args) {
     }
   }
 
+  // CI installs the released binary by pinned version; the pins move in
+  // lockstep with the manifests so reviews run the release being cut.
+  for (const workflow of [".github/workflows/review.yml", ".github/workflows/repo-analysis.yml"]) {
+    const url = new URL(workflow, repoRoot);
+    const text = yield* readTextFile(url);
+    const updated = text.replace(/XMD_VERSION=v\S+/, `XMD_VERSION=v${version}`);
+    if (updated === text) {
+      console.error(`no XMD_VERSION pin found in ${workflow}`);
+      yield* exit(1);
+      return;
+    }
+    yield* writeTextFile(url, updated);
+    console.log(`pinned ${workflow} -> v${version}`);
+  }
+
   console.log(`done — commit, merge, then publish the draft release as v${version}`);
 });

specs/release-process-spec.md

@@ -55,7 +55,8 @@ are the single source. The npm version derives from the tag, and both
 workflows refuse a tag the manifests do not declare, so the two cannot
 diverge.
 
-To cut a release: run `deno task bump <version>` (stamps every manifest),
+To cut a release: run `deno task bump <version>` (stamps every manifest and
+the `XMD_VERSION` binary pins in the review/analysis workflows),
 merge to `main`, then publish the draft release — its tag follows the
 manifests (§3).