From 1f2472dfbc3d81973cd1d5fb1c486e752e504978 Mon Sep 17 00:00:00 2001
From: "lightning-it-shared-assets-sync[bot]"
 <307342877+lightning-it-shared-assets-sync[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 19:47:06 +0000
Subject: [PATCH] chore: sync repository quality assets

Shared-Assets-Source-SHA: 10614cb0c96719a97c312985ae3affef28f03f9d
Shared-Assets-Source-Run: 32410520592
Shared-Assets-Source-Attempt: 1
Shared-Assets-Sync-App-ID: 4351516
---
 .github/workflows/current-revision-rerun.yml | 45 ++++++++++++++++----
 1 file changed, 36 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/current-revision-rerun.yml b/.github/workflows/current-revision-rerun.yml
index 5bb5c53..2b32e0e 100644
--- a/.github/workflows/current-revision-rerun.yml
+++ b/.github/workflows/current-revision-rerun.yml
@@ -183,24 +183,51 @@ jobs:
 
           reservations_pages="$(gh api --paginate --slurp \
             "repos/${REPOSITORY}/commits/${EXPECTED_HEAD}/check-runs?check_name=Protected%20current-revision%20verifier&filter=all&per_page=100")"
-          reservations="$(jq -c \
-            --arg head "${EXPECTED_HEAD}" \
-            --arg prefix "rep60-required-workflow:v2:" \
-            --arg suffix ":${PR_NUMBER}:${EXPECTED_HEAD}" '
+          all_reservations="$(jq -c \
+            --arg head "${EXPECTED_HEAD}" '
               [.[].check_runs[]? |
                 select(.name == "Protected current-revision verifier") |
                 select(.app.id == 15368 and .app.slug == "github-actions") |
                 select(.head_sha == $head) |
-                select((.external_id | type) == "string") |
-                select(.external_id | startswith($prefix) and endswith($suffix))]
+                select((.external_id | type) == "string")]
             ' <<<"${reservations_pages}")"
-          test "$(jq 'length' <<<"${reservations}")" -eq 1
+          v3_reservations="$(jq -c \
+            --arg prefix "rep60-required-workflow:v3:" \
+            --arg suffix ":${PR_NUMBER}:${EXPECTED_BASE}:${EXPECTED_HEAD}" '
+              [.[] |
+                select(.external_id | startswith($prefix) and endswith($suffix))]
+            ' <<<"${all_reservations}")"
+          v2_reservations="$(jq -c \
+            --arg prefix "rep60-required-workflow:v2:" \
+            --arg suffix ":${PR_NUMBER}:${EXPECTED_HEAD}" '
+              [.[] |
+                select(.external_id | startswith($prefix) and endswith($suffix))]
+            ' <<<"${all_reservations}")"
+          v3_count="$(jq 'length' <<<"${v3_reservations}")"
+          v2_count="$(jq 'length' <<<"${v2_reservations}")"
+          if [ "${v3_count}" -eq 1 ]; then
+            # v3 is base-bound and therefore authoritative even when a stale
+            # v2 reservation for the same PR/head remains visible during the
+            # bounded cutover.
+            reservations="${v3_reservations}"
+          elif [ "${v3_count}" -eq 0 ] && [ "${v2_count}" -eq 1 ]; then
+            # Bounded cutover compatibility: v2 lacks the base in external_id,
+            # so the protected run payload below must bind the exact live base.
+            reservations="${v2_reservations}"
+          else
+            echo "Protected verifier evidence is missing or version-ambiguous." >&2
+            exit 1
+          fi
           reservation_id="$(jq -er '.[0].id | select(type == "number" and . > 0)' <<<"${reservations}")"
           reservation_url="$(jq -r '.[0].details_url // empty' <<<"${reservations}")"
           test "${reservation_url}" = "${GITHUB_SERVER_URL}/${REPOSITORY}/runs/${reservation_id}"
           reservation_external_id="$(jq -er '.[0].external_id | select(type == "string" and length > 0)' <<<"${reservations}")"
-          [[ "${reservation_external_id}" =~ ^rep60-required-workflow:v2:([1-9][0-9]*):${PR_NUMBER}:${EXPECTED_HEAD}$ ]]
-          run_id="${BASH_REMATCH[1]}"
+          if [[ "${reservation_external_id}" =~ ^rep60-required-workflow:v3:([1-9][0-9]*):${PR_NUMBER}:${EXPECTED_BASE}:${EXPECTED_HEAD}$ ]]; then
+            run_id="${BASH_REMATCH[1]}"
+          else
+            [[ "${reservation_external_id}" =~ ^rep60-required-workflow:v2:([1-9][0-9]*):${PR_NUMBER}:${EXPECTED_HEAD}$ ]]
+            run_id="${BASH_REMATCH[1]}"
+          fi
           verifier_run_url="${GITHUB_SERVER_URL}/${REPOSITORY}/actions/runs/${run_id}"
           run="$(gh api "repos/${REPOSITORY}/actions/runs/${run_id}")"
           jq -e \