Answer architecture round 4: 0 🔴, 1 🟡; run the repository checks on every file they read, and check each repository installs the release's own version

.github/workflows/packages.yml

@@ -120,11 +120,12 @@ jobs:
         env:
           PACKAGES_GPG_KEY: ${{ secrets.PACKAGES_GPG_KEY }}
           PACKAGES_RSA_KEY: ${{ secrets.PACKAGES_RSA_KEY }}
+          TAG: ${{ inputs.tag }}
         run: |
           build() {
             docker buildx build -f release-tooling/package-repos.Dockerfile \
               --secret id=gpg,env=PACKAGES_GPG_KEY --secret id=rsa,env=PACKAGES_RSA_KEY \
-              --build-context packages=packages "$@" .
+              --build-context packages=packages --build-arg "EXPECTED_VERSION=$TAG" "$@" .
           }
           build --target checks --output type=local,dest=checks
           build --target site --output type=local,dest=site

.github/workflows/test.yml

@@ -32,7 +32,7 @@ jobs:
           else
             echo "code=true" >> "$GITHUB_OUTPUT"
           fi
-          if git diff --quiet "$base"...HEAD -- release-tooling Dockerfile .github/workflows/packages.yml; then
+          if git diff --quiet "$base"...HEAD -- release-tooling Dockerfile .dockerignore LICENSE DATA-LICENSES.md .github/workflows/packages.yml .github/workflows/test.yml; then
             echo "packaging=false" >> "$GITHUB_OUTPUT"
           else
             echo "packaging=true" >> "$GITHUB_OUTPUT"