From 7d730db54f875bc4b6c60b3a9606ed13d61ba8d3 Mon Sep 17 00:00:00 2001
From: lr00rl <lidongguinb@gmail.com>
Date: Tue, 28 Jul 2026 03:07:40 -0700
Subject: [PATCH] Run the pasteable-version check on a schedule, not in the
 deploy

athena built the check and asked where it should be wired; both options were one
file, so the reasoning is the deliverable.

Not in pages.yml: the drift is caused by an event in ANOTHER repo - a stable release
being cut - and this repo receives no push when that happens. A push-triggered check
cannot see the failure it exists for; only the schedule can. Wiring it into the deploy
would also let an API hiccup block publishing docs, and would surface the failure while
someone is shipping something unrelated.

Push trigger is kept for the other direction: an edit to the guide that breaks the pin
fails immediately rather than up to a day later.
---
 .github/workflows/release-pins.yml | 39 ++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/release-pins.yml

diff --git a/.github/workflows/release-pins.yml b/.github/workflows/release-pins.yml
new file mode 100644
index 0000000..b90f8f4
--- /dev/null
+++ b/.github/workflows/release-pins.yml
@@ -0,0 +1,39 @@
+name: release-pins
+
+# Why this is NOT a step in pages.yml, which was the other option on the table:
+#
+# The drift this catches is caused by an event in a DIFFERENT repository — a stable
+# release being cut in lattice-node-agent. This repo gets no push when that happens,
+# so a push-triggered check can never see the failure it exists for. Only the schedule
+# can. That makes the schedule the point, not a belt-and-braces extra.
+#
+# Putting it in the deploy would also (a) let a GitHub API hiccup block publishing
+# documentation, and (b) deliver the failure at the worst possible moment — while
+# someone is trying to ship an unrelated page. A docs deploy should not depend on a
+# moving external fact; a scheduled check should.
+on:
+  schedule:
+    - cron: "17 6 * * *"
+  push:
+    paths:
+      - "docs/guide/**"
+      - "scripts/check-release-pins.mjs"
+      - ".github/workflows/release-pins.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pins:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Documented install versions match their releases
+        env:
+          # Raises the releases-API rate limit; the script works unauthenticated too.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: node scripts/check-release-pins.mjs