From 0316258bc0eabcbe57cf6d889b45c46bf33e7693 Mon Sep 17 00:00:00 2001
From: stringhandler <stringhandler@protonmail.com>
Date: Thu, 15 Oct 2026 12:43:18 +0200
Subject: [PATCH 1/2] ci: check simplicity-sys symbol prefixes match the crate
 version

vendor-simplicity.sh prefixes every libsimplicity symbol with the crate's
major/minor version so incompatible versions can be linked together. Fail CI
if any file carries a different prefix, e.g. one copied in by hand.
---
 .github/workflows/main.yml              |  9 ++++++++
 simplicity-sys/check-symbol-versions.sh | 29 +++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100755 simplicity-sys/check-symbol-versions.sh

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 824cf5b2..b22a1242 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -37,6 +37,15 @@ jobs:
       - name: Running cargo fmt
         run: cargo fmt --all -- --check
 
+  symbol_versions:
+    name: Symbol Version Prefixes
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Crate
+        uses: actions/checkout@v4
+      - name: Check simplicity-sys symbol prefixes match its version
+        run: ./simplicity-sys/check-symbol-versions.sh
+
   simpcli_test:
     name: SimpCLI Tests
     runs-on: ubuntu-latest
diff --git a/simplicity-sys/check-symbol-versions.sh b/simplicity-sys/check-symbol-versions.sh
new file mode 100755
index 00000000..9bba4a89
--- /dev/null
+++ b/simplicity-sys/check-symbol-versions.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Check that every versioned symbol prefix in simplicity-sys matches the crate version.
+#
+# vendor-simplicity.sh renames every libsimplicity symbol to `rustsimplicity_<major>_<minor>_*`
+# and the allocator hooks to `rust_<major>_<minor>_*`, so that semver-incompatible versions of
+# this crate can be linked into the same binary. A file that keeps an older prefix (for example
+# one copied in by hand instead of vendored) silently defeats that, so fail if any prefix other
+# than the current one appears.
+
+cd "$(dirname "$0")"
+
+VERSION_CODE=$(grep "^version" Cargo.toml | sed 's/\./_/g' | sed 's/.*"\(.*\)".*/\1/' | cut -d_ -f1-2)
+
+# Each output line is `file:line:match`; keep only matches that are not the current version.
+STALE=$(grep -rnoE '(rustsimplicity|rust)_[0-9]+_[0-9]+' Cargo.toml depend src \
+    | grep -vE ":(rustsimplicity|rust)_${VERSION_CODE}\$" || true)
+
+if [ -n "$STALE" ]; then
+    echo "Found symbol prefixes that do not match the simplicity-sys version code ${VERSION_CODE}:"
+    echo "$STALE"
+    echo
+    echo "Expected only rustsimplicity_${VERSION_CODE}_* and rust_${VERSION_CODE}_*."
+    echo "Re-run vendor-simplicity.sh rather than copying libsimplicity files in by hand."
+    exit 1
+fi
+
+echo "All symbol prefixes match version code ${VERSION_CODE}."

From 619d916dcea5fea24f0313dd2c7c68b8b1bdec70 Mon Sep 17 00:00:00 2001
From: stringhandler <stringhandler@protonmail.com>
Date: Thu, 15 Oct 2026 12:44:47 +0200
Subject: [PATCH 2/2] ci: check vendored libsimplicity matches its recorded
 revision

Re-run vendor-simplicity.sh at the commit in simplicity-HEAD-revision.txt and
fail if the vendored tree differs, catching hand-edited or grafted files.

Also restrict the workflow's GITHUB_TOKEN to read-only contents access, since
no job needs to write.
---
 .github/workflows/main.yml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b22a1242..7682eb10 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,6 +2,9 @@ on: [push, pull_request]
 
 name: Continuous integration
 
+permissions:
+  contents: read
+
 jobs:
   Prepare:
     runs-on: ubuntu-24.04
@@ -46,6 +49,38 @@ jobs:
       - name: Check simplicity-sys symbol prefixes match its version
         run: ./simplicity-sys/check-symbol-versions.sh
 
+  vendored_libsimplicity:
+    name: Vendored libsimplicity
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Crate
+        uses: actions/checkout@v4
+      - name: Read vendored libsimplicity revision
+        id: libsimplicity
+        run: |
+          set -euo pipefail
+          echo "rev=$(sed -n '2p' simplicity-sys/depend/simplicity-HEAD-revision.txt)" >> "$GITHUB_OUTPUT"
+      - name: Checkout libsimplicity
+        uses: actions/checkout@v4
+        with:
+          repository: BlockstreamResearch/simplicity
+          ref: ${{ steps.libsimplicity.outputs.rev }}
+          path: libsimplicity
+      - name: Re-vendor libsimplicity and check for differences
+        env:
+          LIBSIMPLICITY_REV: ${{ steps.libsimplicity.outputs.rev }}
+        run: |
+          set -euo pipefail
+          cd simplicity-sys
+          # vendor-simplicity.sh asks before deleting the existing vendored copy.
+          echo y | ./vendor-simplicity.sh depend ../libsimplicity
+          if [ -n "$(git status --porcelain --untracked-files=all -- .)" ]; then
+            echo "simplicity-sys does not match libsimplicity $LIBSIMPLICITY_REV re-vendored with vendor-simplicity.sh:"
+            git status --short --untracked-files=all -- .
+            git diff --stat -- .
+            exit 1
+          fi
+
   simpcli_test:
     name: SimpCLI Tests
     runs-on: ubuntu-latest