fix(release): pin Ghostty source revision

.github/workflows/release-macos-app.yml

@@ -146,15 +146,25 @@ jobs:
 
           VENDOR_DIR="apps/macos/vendor/ghostty"
           BRIDGE_DIR="apps/macos/Experiments/GhosttyVTBridge"
+          REVISION_FILE="$BRIDGE_DIR/GHOSTTY_REVISION"
           OUT_DIR="apps/macos/App/GhosttyVT/ghostty/lib"
           OUT_LIB="$OUT_DIR/libhack_ghostty_vt.dylib"
+          GHOSTTY_REVISION="$(tr -d '[:space:]' < "$REVISION_FILE")"
 
           if [ ! -d "$VENDOR_DIR" ]; then
             mkdir -p "$(dirname "$VENDOR_DIR")"
-            git clone --depth 1 https://github.com/ghostty-org/ghostty "$VENDOR_DIR"
+            git clone --filter=blob:none --no-checkout https://github.com/ghostty-org/ghostty "$VENDOR_DIR"
           fi
 
-          git -C "$VENDOR_DIR" rev-parse --short HEAD
+          git -C "$VENDOR_DIR" fetch --depth 1 origin "$GHOSTTY_REVISION"
+          git -C "$VENDOR_DIR" checkout --detach --force FETCH_HEAD
+
+          ACTUAL_GHOSTTY_REVISION="$(git -C "$VENDOR_DIR" rev-parse HEAD)"
+          if [ "$ACTUAL_GHOSTTY_REVISION" != "$GHOSTTY_REVISION" ]; then
+            echo "Expected Ghostty $GHOSTTY_REVISION, checked out $ACTUAL_GHOSTTY_REVISION"
+            exit 1
+          fi
+          echo "Ghostty revision: $ACTUAL_GHOSTTY_REVISION"
 
           mkdir -p "$OUT_DIR"
 

apps/macos/Experiments/GhosttyVTBridge/GHOSTTY_REVISION

@@ -0,0 +1 @@
+53bd14fecfd68c6c0ab64d37b5943247299e2b40

apps/macos/README.md

@@ -95,7 +95,9 @@ bun run macos:ghostty:setup
 
 This script:
 
-- clones the Ghostty repo into `apps/macos/vendor/ghostty`
+- checks out the pinned Ghostty revision from
+  `apps/macos/Experiments/GhosttyVTBridge/GHOSTTY_REVISION` into
+  `apps/macos/vendor/ghostty`
 - builds the VT bridge via Zig
 - installs `libhack_ghostty_vt.dylib` into:
   `~/Library/Application Support/Hack/ghostty/lib`

scripts/macos-ghostty-bundle.ts

@@ -7,6 +7,10 @@ import { $ } from "bun";
 const repoRoot = path.resolve(import.meta.dir, "..");
 const vendorDir = path.join(repoRoot, "apps/macos/vendor/ghostty");
 const bridgeDir = path.join(repoRoot, "apps/macos/Experiments/GhosttyVTBridge");
+const ghosttyRevision = readFileSync(
+  path.join(bridgeDir, "GHOSTTY_REVISION"),
+  "utf8"
+).trim();
 const outDir = path.join(repoRoot, "apps/macos/App/GhosttyVT/ghostty/lib");
 const outLib = path.join(outDir, "libhack_ghostty_vt.dylib");
 
@@ -75,6 +79,21 @@ const main = async (): Promise<void> => {
     );
   }
 
+  if (!/^[0-9a-f]{40}$/.test(ghosttyRevision)) {
+    throw new Error("GHOSTTY_REVISION must contain one full Git commit SHA");
+  }
+
+  const checkedOutRevision = (
+    await $`git -C ${vendorDir} rev-parse HEAD`.text()
+  ).trim();
+  if (checkedOutRevision !== ghosttyRevision) {
+    throw new Error(
+      `Ghostty ${checkedOutRevision} is checked out; expected ${ghosttyRevision}. Run \`bun run macos:ghostty:setup\` to restore the pinned revision.`
+    );
+  }
+
+  await $`git -C ${vendorDir} reset --hard ${ghosttyRevision}`;
+
   const minVersionMatch = readFileSync(
     path.join(vendorDir, "build.zig.zon"),
     "utf8"

scripts/macos-ghostty-setup.ts

@@ -7,6 +7,10 @@ import { $ } from "bun";
 const repoRoot = path.resolve(import.meta.dir, "..");
 const vendorDir = path.join(repoRoot, "apps/macos/vendor/ghostty");
 const bridgeDir = path.join(repoRoot, "apps/macos/Experiments/GhosttyVTBridge");
+const ghosttyRevision = readFileSync(
+  path.join(bridgeDir, "GHOSTTY_REVISION"),
+  "utf8"
+).trim();
 const installDir = path.join(
   process.env.HOME ?? "",
   "Library/Application Support/Hack/ghostty/lib"
@@ -44,11 +48,24 @@ const _isAtLeast = (
   return current.patch >= min.patch;
 };
 
-if (existsSync(vendorDir)) {
-  await $`git -C ${vendorDir} fetch --depth 1 origin main`;
-  await $`git -C ${vendorDir} reset --hard origin/main`;
-} else {
-  await $`git clone --depth 1 https://github.com/ghostty-org/ghostty ${vendorDir}`;
+if (!/^[0-9a-f]{40}$/.test(ghosttyRevision)) {
+  throw new Error("GHOSTTY_REVISION must contain one full Git commit SHA");
+}
+
+if (!existsSync(vendorDir)) {
+  await $`git clone --filter=blob:none --no-checkout https://github.com/ghostty-org/ghostty ${vendorDir}`;
+}
+
+await $`git -C ${vendorDir} fetch --depth 1 origin ${ghosttyRevision}`;
+await $`git -C ${vendorDir} checkout --detach --force FETCH_HEAD`;
+
+const checkedOutRevision = (
+  await $`git -C ${vendorDir} rev-parse HEAD`.text()
+).trim();
+if (checkedOutRevision !== ghosttyRevision) {
+  throw new Error(
+    `Expected Ghostty ${ghosttyRevision}, checked out ${checkedOutRevision}`
+  );
 }
 
 const minVersionMatch = readFileSync(

tests/macos-ghostty-source.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+
+const repoRoot = path.resolve(import.meta.dir, "..");
+const bridgeDir = path.join(repoRoot, "apps/macos/Experiments/GhosttyVTBridge");
+
+describe("Ghostty source pin", () => {
+  test("uses one immutable revision in local and release builds", async () => {
+    const revision = (
+      await Bun.file(path.join(bridgeDir, "GHOSTTY_REVISION")).text()
+    ).trim();
+    const setupScript = await Bun.file(
+      path.join(repoRoot, "scripts/macos-ghostty-setup.ts")
+    ).text();
+    const bundleScript = await Bun.file(
+      path.join(repoRoot, "scripts/macos-ghostty-bundle.ts")
+    ).text();
+    const releaseWorkflow = await Bun.file(
+      path.join(repoRoot, ".github/workflows/release-macos-app.yml")
+    ).text();
+
+    expect(revision).toMatch(/^[0-9a-f]{40}$/);
+    expect(setupScript).toContain('path.join(bridgeDir, "GHOSTTY_REVISION")');
+    expect(bundleScript).toContain('path.join(bridgeDir, "GHOSTTY_REVISION")');
+    expect(bundleScript).toContain("git -C ${vendorDir} rev-parse HEAD");
+    expect(bundleScript).toContain(
+      "git -C ${vendorDir} reset --hard ${ghosttyRevision}"
+    );
+    expect(releaseWorkflow).toContain(
+      'REVISION_FILE="$BRIDGE_DIR/GHOSTTY_REVISION"'
+    );
+    expect(setupScript).not.toContain("fetch --depth 1 origin main");
+    expect(releaseWorkflow).not.toContain(
+      "git clone --depth 1 https://github.com/ghostty-org/ghostty"
+    );
+  });
+});