From 588f5c3184715973f944ad949f9d3902b9659113 Mon Sep 17 00:00:00 2001
From: Ryan Scott <rscott@galois.com>
Date: Thu, 2 Jun 2022 10:24:49 -0400
Subject: [PATCH 1/2] Always embed git commit into --version output

Previously, we attempted to scrub out `git` commits from release binaries using
a `sed` invocation in the `cry` script, but as was observed in #1353, this
ended up scrubbing out `git` commits on all builds, not just release ones. We
have decided that we should just include `git` commits on all builds, so we can
fix the issue by removing the buggy use of `sed`.

Unfortunately, `cabal`'s recompilation logic is not smart enough to always
rebuild `GitRev.hs` on every new commit, even though it should. For this
reason, we make the `./cry build` command temporarily dirty the `GitRev.hs`
file so that it is forcibly rebuilt, then revert the change to `GitRev.hs` and
rebuild. It's rather heavy-handed, but it works.

Fixes #1353.
---
 cry | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/cry b/cry
index d2436b3f2..63964cbc4 100755
--- a/cry
+++ b/cry
@@ -44,25 +44,17 @@ case $COMMAND in
     # XXX: This is a workaround the fact that currently Cabal
     # will not rebuild this file, even though it has TH code, that
     # depends on the environment.  For now, we temporarily modify the
-    # file, then build, then revert it back after build.
+    # file, then build, then revert it back, then build once more.
 
     dirty_string="-- Last build $(date)"
     echo "$dirty_string" >> src/GitRev.hs
 
-    if [[ -n "$RELEASE" ]]; then
-      sed -i.bak -e 's/^commitShortHash = .*$/commitShortHash = "UNKNOWN"/' \
-        -e 's/^commitHash = .*$/commitHash = "UNKNOWN"/' \
-        -e 's/^commitBranch = .*$/commitBranch = "UNKNOWN"/' \
-        -e 's/^commitDirty = .*$/commitDirty = False/' \
-        -e '/import qualified GitRev/d' \
-        src/Cryptol/Version.hs
-      rm -f src/Cryptol/Version.hs.bak
-    fi
-
     cabal v2-build "$@" exe:cryptol
 
     sed -i.bak "/^-- Last build/d" src/GitRev.hs
     rm -f src/GitRev.hs.bak
+
+    cabal v2-build "$@" exe:cryptol
     ;;
 
   haddock) echo Building Haddock documentation && cabal v2-haddock ;;

From 3b05551ebcb0aa484972659315e9a4042e81f506 Mon Sep 17 00:00:00 2001
From: Ryan Scott <rscott@galois.com>
Date: Tue, 25 Jul 2023 11:00:04 -0400
Subject: [PATCH 2/2] CI: Checkout out PR HEAD commit instead of merge commit

The `checkout` action's default behavior is to create a merge commit during CI
that merges the changes from the PR branch, but this will cause `cryptol
--version` to print the SHA of the merge commit rather than the most recent
HEAD commit, which is what users and developers actually care about. This
commit follows the advice from
https://github.com/actions/checkout/tree/96f53100ba2a5449eb71d2e6604bbcd94b9449b5#checkout-pull-request-head-commit-instead-of-merge-commit
to change `checkout`'s behavior to use the HEAD commit instead.
---
 .github/workflows/ci.yml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b14461814..ebad5bec0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,9 +35,10 @@ jobs:
       release: ${{ steps.config.outputs.release }}
       retention-days: ${{ steps.config.outputs.retention-days }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: config
         id: config
@@ -88,9 +89,10 @@ jobs:
       VERSION: ${{ needs.config.outputs.version }}
       RELEASE: ${{ needs.config.outputs.release }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           submodules: true
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - uses: actions/setup-python@v2
         with:
@@ -262,9 +264,10 @@ jobs:
           #  os: windows-2019
           #  continue-on-error: true  # TODO: get Python client to work on Windows
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           submodules: true
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - uses: haskell/actions/setup@v2
         with:
@@ -423,7 +426,9 @@ jobs:
           cache-to: type=registry,ref=${{ matrix.cache }}:cache-${{ steps.common-tag.outputs.common-tag }},mode=max
 
       - if: matrix.image == 'ghcr.io/galoisinc/cryptol-remote-api'
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - if: matrix.image == 'ghcr.io/galoisinc/cryptol-remote-api'
         uses: actions/setup-python@v2