From f4348e7be7282e1d2e9c806fd3d68d0698405c04 Mon Sep 17 00:00:00 2001
From: Tom Proctor <tomhjp@users.noreply.github.com>
Date: Thu, 10 Sep 2026 10:10:03 +0100
Subject: [PATCH] .github,update-sqlite.sh: add CI check to verify updates

To make it easier to review version bumps, add some automation that
verifies the cgosqlite folder updates, leaving reviewers with just the
trivial bits to review manually.

Updates #cleanup

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
---
 .github/workflows/check-sqlite-update.yml | 34 +++++++++++++++++++++++
 README.md                                 |  3 +-
 update-sqlite.sh                          | 19 ++++++++++---
 version-url.txt                           |  1 +
 4 files changed, 52 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/check-sqlite-update.yml
 create mode 100644 version-url.txt

diff --git a/.github/workflows/check-sqlite-update.yml b/.github/workflows/check-sqlite-update.yml
new file mode 100644
index 0000000..1cbc09d
--- /dev/null
+++ b/.github/workflows/check-sqlite-update.yml
@@ -0,0 +1,34 @@
+name: check-sqlite-update
+
+# Re-runs update-sqlite.sh against the URL recorded in version-url.txt and
+# checks that it reproduces exactly what is checked in.
+
+on:
+  pull_request:
+    paths:
+      - check-sqlite-update.yml
+      - version-url.txt
+      - update-sqlite.sh
+      - cgosqlite/**
+
+permissions:
+  contents: read
+
+jobs:
+  reproducible:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Run update-sqlite.sh
+      run: ./update-sqlite.sh
+
+    - name: Check the working tree is unchanged
+      run: |
+        if [[ -n "$(git status --porcelain)" ]]; then
+          echo "::error::update-sqlite.sh did not reproduce the checked-in files"
+          git status --porcelain
+          git diff --stat
+          echo "::error::Please update version-url.txt and/or run update-sqlite.sh and commit the changes."
+          exit 1
+        fi
diff --git a/README.md b/README.md
index d944265..52d3549 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,8 @@ Work in progress. Nothing to see here.
 ## Updating SQLite
 
 The script `update-sqlite.sh` at the top of the repository partially automates
-this process. It expects a SQLite amalgamation URL as the first argument:
+this process. It accepts a SQLite amalgamation URL as the first argument, or
+otherwise uses the URL recorded in [version-url.txt](./version-url.txt):
 
 ```
 ./update-sqlite.sh https://sqlite.org/2024/sqlite-amalgamation-3460100.zip
diff --git a/update-sqlite.sh b/update-sqlite.sh
index e22a3a9..4dfd0e0 100755
--- a/update-sqlite.sh
+++ b/update-sqlite.sh
@@ -1,11 +1,17 @@
 #!/bin/bash
 
+repodir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
 usage() {
 	echo "$0 [sqlite-amalgamation-url]"
 	echo
 	echo "Lookup the URL to a SQLite amalgamation zip on https://sqlite.org"
 	echo "Pass that URL to this tool, e.g."
 	echo "  $0 https://sqlite.org/2024/sqlite-amalgamation-3460100.zip"
+	echo
+	echo "With no argument, re-runs against the URL already recorded in"
+	echo "version-url.txt, which should leave the tree unchanged. CI does"
+	echo "this to prove the vendored files are exactly the script's output."
 }
 
 fatal() {
@@ -14,7 +20,13 @@ fatal() {
 }
 
 case "$1" in
-	https://sqlite.org/*) ;;
+	https://sqlite.org/*)
+		url="$1"
+		;;
+	"")
+		url=$(tr -d '[:space:]' < "$repodir/version-url.txt") || exit 1
+		echo "$url"
+		;;
 	-h|--help|help)
 		usage
 		exit
@@ -25,9 +37,8 @@ case "$1" in
 		;;
 esac
 
-cd "$( dirname "${BASH_SOURCE[0]}" )"/cgosqlite || fatal "Not in correct directory"
+cd "$repodir/cgosqlite" || fatal "Not in correct directory"
 
-url="$1"
 filename=$(basename "$url")
 dirname=$(basename -s .zip "$filename")
 [[ -n "$filename" ]] || fatal "Could not extract filename from $url"
@@ -35,7 +46,7 @@ dirname=$(basename -s .zip "$filename")
 
 trap "rm -rf ./${filename} ./${dirname}" EXIT
 
-curl -O "$1" || fatal "Download of $url failed"
+curl -O "$url" || fatal "Download of $url failed"
 [[ -f "$filename" ]] || fatal "File $filename not found after download"
 unzip "$filename" || fatal "Unzip of $filename failed"
 [[ -d "$dirname" ]] || fatal "Directory $dirname missing after unzip"
diff --git a/version-url.txt b/version-url.txt
new file mode 100644
index 0000000..f28fac5
--- /dev/null
+++ b/version-url.txt
@@ -0,0 +1 @@
+https://sqlite.org/2026/sqlite-amalgamation-3530100.zip
\ No newline at end of file