From 8fd492e544e937ed7a82e67dbd0efb2d8e338950 Mon Sep 17 00:00:00 2001
From: lilleman <lilleman@larvit.se>
Date: Sat, 22 Aug 2026 12:01:35 +0200
Subject: [PATCH] Scope the sidecar trailer by package so a mixed branch cannot
 lose it

---
 .gitea/workflows/release.yml               | 1 +
 README.md                                  | 2 +-
 release-tooling/dockerhub-overview.test.ts | 2 +-
 release-tooling/dockerhub-overview.ts      | 8 +++++++-
 renovate.json                              | 6 ++++++
 src/plugin-host/plugin.test.ts             | 2 +-
 6 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 03cd8c6..1ed5109 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -83,6 +83,7 @@ jobs:
         run: |
           set -euo pipefail
           VERSION=${INPUT_VERSION:-${GIT_TAG#v}}
+          VERSION=${VERSION#v}
           # An empty dispatch input falls back to the branch name, so gate this like a tag.
           docker run --rm -v "$PWD:/repo" -w /repo node:24.19.0-alpine3.24 \
             node release-tooling/contract-version.ts "$VERSION" src/plugin-host/plugin.ts
diff --git a/README.md b/README.md
index 414fecd..969e35b 100644
--- a/README.md
+++ b/README.md
@@ -606,7 +606,7 @@ provider/consumer semantics in `checkApiVersion`:
 | Plugin `apiVersion` vs host | Result | Host action |
 | --- | --- | --- |
 | same major, same minor (patch ignored) | `ok` | load |
-| same major, plugin minor **<** host minor | `warn` | load, log — additive-compatible, newer features exist |
+| same major, plugin minor **<** host minor | `warn` | load, log — built against an older release; check that release's notes |
 | same major, plugin minor **>** host minor | `refuse` | **abort boot** — plugin needs a newer host |
 | different major | `refuse` | **abort boot** — incompatible contract |
 | missing / not a valid semver | `refuse` | **abort boot** — must be declared |
diff --git a/release-tooling/dockerhub-overview.test.ts b/release-tooling/dockerhub-overview.test.ts
index d383a1e..f0153b0 100644
--- a/release-tooling/dockerhub-overview.test.ts
+++ b/release-tooling/dockerhub-overview.test.ts
@@ -28,8 +28,8 @@ test("the quick start's sidecars are pinned to the same versions this repo runs"
   const pins = (source: string) =>
     new Map([...source.matchAll(/image: ([^:\s]+):(v?\d\S*)/g)].map((m) => [m[1] ?? "", m[2] ?? ""]));
   const ours = new Map([
-    ...pins(readFileSync("compose.yml", "utf8")),
     ...pins(readFileSync("compose.override.yml", "utf8")),
+    ...pins(readFileSync("compose.yml", "utf8")), // production wins: the template is the prod quick start
   ]);
   const published = pins(template());
   assert.ok(published.size > 0, "the template should pin sidecars");
diff --git a/release-tooling/dockerhub-overview.ts b/release-tooling/dockerhub-overview.ts
index 6d0b86f..a7e06f0 100644
--- a/release-tooling/dockerhub-overview.ts
+++ b/release-tooling/dockerhub-overview.ts
@@ -60,7 +60,13 @@ async function main(): Promise<number> {
   if (!VERSION.test(version)) return fail(`version must be X.Y.Z, got ${JSON.stringify(version)}`);
 
   const templatePath = join(import.meta.dirname, "dockerhub-overview.md.tmpl");
-  const body = renderOverview(readFileSync(templatePath, "utf8"), version);
+  let template = "";
+  try {
+    template = readFileSync(templatePath, "utf8");
+  } catch (err) {
+    return fail(`${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const body = renderOverview(template, version);
   const leftover = leftoverPlaceholders(body);
   if (leftover.length > 0) return fail(`${templatePath} has unrendered placeholders: ${leftover.join(", ")}`);
 
diff --git a/renovate.json b/renovate.json
index 1235384..86d345a 100644
--- a/renovate.json
+++ b/renovate.json
@@ -24,6 +24,12 @@
       "matchManagers": ["docker-compose"],
       "commitBody": "Release-Bump: {{{updateType}}}"
     },
+    {
+      "description": "The production sidecars, wherever they are pinned — compose.yml and the published quick start move in one branch, so the trailer must not depend on which upgrade sorts first. mailpit is dev-only and stays out",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["oryd/hydra", "oryd/keto", "oryd/kratos", "postgres"],
+      "commitBody": "Release-Bump: {{{updateType}}}"
+    },
     {
       "description": "node is pinned to one version across Dockerfile, dev, E2E and CI, so Renovate moves them in a single branch whose commitBody would otherwise depend on upgrade order — the Dockerfile copy ships, so any node bump is a product change",
       "matchDatasources": ["docker"],
diff --git a/src/plugin-host/plugin.test.ts b/src/plugin-host/plugin.test.ts
index 6fde120..ebd9330 100644
--- a/src/plugin-host/plugin.test.ts
+++ b/src/plugin-host/plugin.test.ts
@@ -20,7 +20,7 @@ import { AUTH_FLOWS } from "../auth/flow-view.ts";
 // HOST_API_VERSION would always equal the host and defeat the check. No `id`/`basePath` — the
 // host derives both from the plugin's folder name.
 const scheduling: PluginManifest = definePlugin({
-  apiVersion: "0.1.0",
+  apiVersion: "1.0.0",
   hooks: { onBoot: () => {} },
   nav: [{
     children: [{ href: "/scheduling/shifts", id: "scheduling:shifts", label: "Shifts", permission: "scheduling:read" }],