From efde1eb920a535c414d6d55c30779e0d87aac6e9 Mon Sep 17 00:00:00 2001
From: LinzLos <223187540+LinzLos@users.noreply.github.com>
Date: Mon, 28 Sep 2026 20:08:12 +0000
Subject: [PATCH] Add CI drift check for vendored Tiny Wire tokens

Runs scripts/check-tinywire-drift.sh on every push and PR: checks out
tiny-wire at the tag matching src/lib/.tinywire-version and verifies the
pin and vendored files match the pinned release byte for byte.
---
 .github/workflows/tinywire-drift.yml | 32 ++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/tinywire-drift.yml

diff --git a/.github/workflows/tinywire-drift.yml b/.github/workflows/tinywire-drift.yml
new file mode 100644
index 0000000..a8daa7d
--- /dev/null
+++ b/.github/workflows/tinywire-drift.yml
@@ -0,0 +1,32 @@
+name: Tiny Wire drift check
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  drift:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Read Tiny Wire version pin
+        id: pin
+        run: echo "version=$(tr -d '[:space:]' < src/lib/.tinywire-version)" >> "$GITHUB_OUTPUT"
+
+      # Tiny Wire tags releases as vX.Y, so check out the tag matching this
+      # repo's pin. That verifies the vendored files in src/lib/ are
+      # byte-identical to the pinned release. If the pin ever names a version
+      # with no matching tag, this step fails — also a drift signal: fix the
+      # pin or tag the release upstream.
+      - name: Check out Tiny Wire at pinned version
+        uses: actions/checkout@v4
+        with:
+          repository: LinzLos/tiny-wire
+          ref: v${{ steps.pin.outputs.version }}
+          path: tiny-wire
+
+      # The script defaults to a sibling ../tiny-wire checkout; in Actions the
+      # source lives inside the workspace instead, so point TW_REPO_DIR at it.
+      - name: Run drift check
+        run: TW_REPO_DIR="$GITHUB_WORKSPACE/tiny-wire" ./scripts/check-tinywire-drift.sh