From a1cb6bd8e51a49bd7e8d2421d5efbbe4db4a3f81 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 11 May 2026 10:48:14 -0400
Subject: [PATCH] fix(firmware): bump version.txt to 0.6.4 + CI guard for
 tag/version match (#505)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

version.txt on main was still 0.6.2. CMake reads PROJECT_VER from it, so
esp_app_get_description()->version (and the boot log line) reported 0.6.2
for any source build — and v0.6.3-esp32 shipped a release binary that
internally identified as 0.6.2 because the bump never landed on main.

  - version.txt: 0.6.2 -> 0.6.4 (matches the latest release tag)
  - firmware-ci.yml: new `version-guard` job that runs on v*-esp32 tag
    pushes and fails the run if the tag's X.Y.Z != version.txt, so a
    future release can't ship a mislabeled binary.

Closes #505

Co-Authored-By: claude-flow <ruv@ruv.net>
---
 .github/workflows/firmware-ci.yml   | 26 ++++++++++++++++++++++++++
 firmware/esp32-csi-node/version.txt |  2 +-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/firmware-ci.yml b/.github/workflows/firmware-ci.yml
index 252a47ee..55e0e186 100644
--- a/.github/workflows/firmware-ci.yml
+++ b/.github/workflows/firmware-ci.yml
@@ -2,6 +2,11 @@ name: Firmware CI
 
 on:
   push:
+    branches:
+      - '**'
+    tags:
+      # ESP32 firmware release tags — build + version-consistency guard (RuView#505).
+      - 'v*-esp32'
     paths:
       - 'firmware/**'
       - '.github/workflows/firmware-ci.yml'
@@ -11,6 +16,27 @@ on:
       - '.github/workflows/firmware-ci.yml'
 
 jobs:
+  version-guard:
+    name: Verify version.txt matches release tag
+    runs-on: ubuntu-latest
+    if: github.ref_type == 'tag'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check firmware version.txt == tag
+        run: |
+          # Tag form: vX.Y.Z-esp32  →  expect version.txt to contain X.Y.Z
+          TAG="${GITHUB_REF_NAME}"
+          EXPECTED="${TAG#v}"
+          EXPECTED="${EXPECTED%-esp32}"
+          ACTUAL="$(tr -d '[:space:]' < firmware/esp32-csi-node/version.txt)"
+          echo "Tag: $TAG  →  expected version.txt: $EXPECTED  |  actual: $ACTUAL"
+          if [ "$EXPECTED" != "$ACTUAL" ]; then
+            echo "::error::firmware/esp32-csi-node/version.txt is '$ACTUAL' but tag '$TAG' expects '$EXPECTED'."
+            echo "::error::Bump version.txt and re-tag so esp_app_get_description()->version is correct (RuView#505)."
+            exit 1
+          fi
+          echo "version.txt matches the release tag."
+
   build:
     name: Build ESP32-S3 Firmware (${{ matrix.variant }})
     runs-on: ubuntu-latest
diff --git a/firmware/esp32-csi-node/version.txt b/firmware/esp32-csi-node/version.txt
index b6160487..d2b13eb6 100644
--- a/firmware/esp32-csi-node/version.txt
+++ b/firmware/esp32-csi-node/version.txt
@@ -1 +1 @@
-0.6.2
+0.6.4