From 0036f59c83b2b090c090f9e5de51821192db2754 Mon Sep 17 00:00:00 2001
From: "riseproject-dev[bot]"
 <330740410+riseproject-dev[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 08:57:37 +0000
Subject: [PATCH 1/2] vhacdx: Add version 0.1.1

Signed-off-by: riseproject-dev[bot] <330740410+riseproject-dev[bot]@users.noreply.github.com>
---
 docs/packages/vhacdx.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/packages/vhacdx.yaml b/docs/packages/vhacdx.yaml
index f654f92095c3..1a719b3e5687 100644
--- a/docs/packages/vhacdx.yaml
+++ b/docs/packages/vhacdx.yaml
@@ -30,3 +30,4 @@ versions:
     sha256: 918c6f9f35cc77b751a30ff42b76e6b8c1c831fb0eec1c8158cab15cb4f847ba
     requires-python: '>=3.7'
 - version: 0.1.0
+- version: 0.1.1

From 151f9443c505a609a9b52e1ae171574dbec9fb84 Mon Sep 17 00:00:00 2001
From: Ludovic Henry <git@ludovic.dev>
Date: Tue, 27 Oct 2026 19:39:36 +0100
Subject: [PATCH 2/2] vhacdx: select the upstream commit per version and verify
 the declared version

The workflow pinned a single commit (0.0.10), so the pending 0.1.0 and 0.1.1
entries would have built 0.0.10 source and published it under the new versions.
Map each version to the commit matching its PyPI sdist (0.1.0 -> 13d47bc,
0.1.1 -> 02d00ea; upstream has no tags), fail on an unknown version, and assert
pyproject.toml declares the version being built.
---
 .github/workflows/build-vhacdx.yml | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-vhacdx.yml b/.github/workflows/build-vhacdx.yml
index 9bf8b588767a..5e682551dfd8 100644
--- a/.github/workflows/build-vhacdx.yml
+++ b/.github/workflows/build-vhacdx.yml
@@ -31,10 +31,6 @@ permissions:
   contents: read  # to fetch code (actions/checkout)
 
 env:
-  # Upstream cuts releases without git tags, so pin the release commit: `main`
-  # HEAD is byte-identical (source-wise) to the 0.0.10 PyPI sdist. Update it
-  # alongside VHACDX_VERSION.
-  VHACDX_REF: 1dbf2874b7c00d79c2f4ea56379b9a3c20a4693b
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
   MUSLLINUX_RISCV64_IMAGE: quay.io/pypa/musllinux_1_2_riscv64
 
@@ -63,13 +59,35 @@ jobs:
       VHACDX_VERSION: ${{ matrix.version }}
 
     steps:
+      # Upstream cuts releases without git tags, so map each version to the
+      # commit whose source is byte-identical (ignoring .github/.gitignore) to
+      # that version's PyPI sdist. Add a line for every new version in
+      # docs/packages/vhacdx.yaml.
+      - name: Resolve source commit for ${{ env.VHACDX_VERSION }}
+        id: src
+        run: |
+          case "$VHACDX_VERSION" in
+            0.0.10) ref=1dbf2874b7c00d79c2f4ea56379b9a3c20a4693b ;;
+            0.1.0) ref=13d47bc82b92da808fb4bf177b59f6b8a89fd100 ;;
+            0.1.1) ref=02d00ea2857cc6cb54965152a70b55e9e41a2caf ;;
+            *) echo "::error::No upstream commit recorded for vhacdx $VHACDX_VERSION; add it to this case statement"; exit 1 ;;
+          esac
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
+
       - name: Checkout vhacdx ${{ env.VHACDX_VERSION }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: trimesh/vhacdx
-          ref: ${{ env.VHACDX_REF }}
+          ref: ${{ steps.src.outputs.ref }}
           persist-credentials: false
 
+      - name: Check the checked-out source declares ${{ env.VHACDX_VERSION }}
+        run: |
+          declared=$(sed -n 's/^version = "\(.*\)"$/\1/p' pyproject.toml | head -n1)
+          if [ "$declared" != "$VHACDX_VERSION" ]; then
+            echo "::error::pyproject.toml declares '$declared' but building $VHACDX_VERSION"; exit 1
+          fi
+
       - uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
         env:
           CIBW_ARCHS: riscv64