2 files changed, 34 insertions, 1 deletions
diff --git a/scripts/ci-check-charon-pin.sh b/scripts/ci-check-charon-pin.sh
new file mode 100755
index 00000000..4aacd96e
--- /dev/null
+++ b/scripts/ci-check-charon-pin.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Checks that the charon pin:
+# - moves forward from the previous pin, to ensure we don't regress the charon version;
+# - is merged into Charon.
+
+NEW_CHARON_PIN="$(cat flake.lock | jq -r .nodes.charon.locked.rev)"
+OLD_CHARON_PIN="$(git show origin/main:flake.lock | jq -r .nodes.charon.locked.rev)"
+echo "This PR updates the charon pin from $OLD_CHARON_PIN to $NEW_CHARON_PIN"
+
+git clone https://github.com/AeneasVerif/charon
+cd charon
+CHARON_MAIN="$(git rev-parse HEAD)"
+
+if ! git merge-base --is-ancestor "$OLD_CHARON_PIN" "$NEW_CHARON_PIN"; then
+    echo "Error: the new charon pin does not have the old one as its ancestor. The pin must only move forward."
+    exit 1
+fi
+
+if ! git merge-base --is-ancestor "$NEW_CHARON_PIN" "$CHARON_MAIN"; then
+    echo "Error: commit $NEW_CHARON_PIN is not merged into Charon."
+    exit 1
+fi
diff --git a/scripts/update-charon-pin.sh b/scripts/update-charon-pin.sh
index 418602b8..1fa706ae 100755
--- a/scripts/update-charon-pin.sh
+++ b/scripts/update-charon-pin.sh
@@ -1,7 +1,18 @@
 #!/usr/bin/env bash
 if ! which jq 2> /dev/null 1>&2; then
-    echo 'Error: command `jq` not found.'
+    echo 'Error: command `jq` not found; please install it.'
     exit 1
 fi
+
+if [ -L charon ]; then
+    echo '`./charon` is a symlink; we using the commit there for our new pin.'
+    COMMIT="$(git -C charon rev-parse HEAD)"
+    nix flake lock --override-input charon "github:aeneasverif/charon/$COMMIT"
+else
+    echo 'Pinning the latest commit from Charon `main`'
+    nix flake lock --update-input charon
+fi
+
+# Keep the commit revision in `./charon-pin` as well so that non-nix users can know which commit to use.
 echo '# This is the commit from https://github.com/AeneasVerif/charon that should be used with this version of aeneas.' > ./charon-pin
 jq -r .nodes.charon.locked.rev flake.lock >> ./charon-pin