From c5a34766f0741d6079b7488f21bd7a5f0ccc7dc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lukas=20Br=C3=BCbach?= <Bruebach.Lukas@bdosecurity.de>
Date: Mon, 2 Nov 2026 12:40:01 +0100
Subject: [PATCH] [CI] Keep the vcpkg submodule pointer on the manifest
 baseline

vcpkg.json asks for builtin-baseline 9eec002 (vcpkg 2026.10.16), but the
submodule gitlink was still at 9e593bb. The runners check submodules out
shallowly, so vcpkg-tool cannot read versions/baseline.json out of the baseline
commit and every vcpkg leg (Windows and all macOS) fails in CMake configure
with:

  failed to `git show` versions/baseline.json

git phrases that as "path ... exists on disk, but not in <sha>" even when the
commit is simply absent from the shallow clone, so it reads like a tooling or
network failure rather than a mismatched pointer. Point the submodule back at
9eec002, and add a cheap job that fails when the gitlink and builtin-baseline
disagree, before the five build legs pay for it.
---
 .github/workflows/desktop-build.yml | 32 ++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 54068f5a0..df054ea26 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -101,6 +101,36 @@ jobs:
             --title "$release_name" \
             --notes-file "$body_path"
 
+  vcpkg-baseline:
+    name: vcpkg baseline
+    runs-on: ubuntu-slim
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v7
+
+      # vcpkg-tool reads versions/baseline.json out of the commit named by
+      # `builtin-baseline`, through the `vcpkg` submodule's git history. A submodule
+      # pointer that lags the manifest - e.g. a stale `vcpkg/` worktree captured by
+      # `git add` in a PR - makes every vcpkg leg fail in configure with "failed to
+      # `git show` versions/baseline.json". That reads like a baseline or network
+      # problem, when the pointer is what has to move. Check the two agree here in
+      # seconds instead of on five build legs.
+      - name: "Check the submodule pointer against the manifest baseline"
+        shell: bash
+        run: |
+          pointer="$(git rev-parse HEAD:vcpkg 2>/dev/null || true)"
+          baseline="$(sed -nE 's/.*"builtin-baseline"[[:space:]]*:[[:space:]]*"([0-9a-f]{40})".*/\1/p' vcpkg.json)"
+          if [[ -z "$pointer" || -z "$baseline" ]]; then
+            echo "::error file=vcpkg.json::could not read the vcpkg submodule pointer or the builtin-baseline"
+            exit 1
+          fi
+          if [[ "$pointer" != "$baseline" ]]; then
+            echo "::error file=vcpkg.json::vcpkg submodule is at $pointer but builtin-baseline is $baseline"
+            echo "Move them together: git -C vcpkg checkout $baseline && git add vcpkg"
+            exit 1
+          fi
+          echo "vcpkg submodule and builtin-baseline agree on $baseline"
+
   build-linux:
     strategy:
       fail-fast: false
@@ -466,7 +496,7 @@ jobs:
             vcpkg_upload: 1    # only one leg per vcpkg_scope hands its archives over
 
     name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
-    needs: configure
+    needs: [configure, vcpkg-baseline]
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 100
     env: