ci: prove upstream/ is pristine by comparing, not by keeping meson alive

This repository builds one way, through mcpp. A meson leg kept only to assert
something is a second build system to maintain and a second one to disagree
with the first.

Comparing is also the stronger claim: meson succeeding proves the tree still
BUILDS, not that nothing was edited. The job now downloads the wayland 1.26.0
release tarball, checks its sha256, and diffs it against upstream/ — which is
exactly the guarantee the layout exists to make.

Author: speak-agent

.github/workflows/ci.yml

@@ -106,14 +106,32 @@ jobs:
           echo "wayland.client, wayland.server and wayland.util all have interfaces"
 
   upstream:
-    # The fork patches no upstream file, so meson must still build this tree.
-    # If this breaks, something was modified that should not have been.
-    name: upstream meson still builds this tree
+    # `upstream/` must be the release tarball, byte for byte.
+    #
+    # Checked by COMPARING, not by building: this repository builds one way,
+    # through mcpp, and keeping a second build system alive just to assert
+    # something would be a second thing to maintain and a second thing to
+    # disagree with the first. Comparing is also the stronger check — meson
+    # succeeding proves the tree still builds, not that nothing was edited.
+    name: upstream/ is the release tarball, unmodified
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq meson ninja-build libffi-dev libexpat1-dev
-          meson setup build-meson upstream -Ddocumentation=false -Ddtd_validation=false
-          ninja -C build-meson
+      - name: diff upstream/ against wayland 1.26.0
+        run: |
+          curl -L -fsS -o wayland.tar.xz \
+            "https://gitlab.freedesktop.org/wayland/wayland/-/releases/1.26.0/downloads/wayland-1.26.0.tar.xz"
+          echo "64176eaa46e4969903e286f8e5ef8331affc17fdf03ac9b58381d2b23162b7a3  wayland.tar.xz" | sha256sum -c -
+          mkdir -p /tmp/pristine
+          tar -xJf wayland.tar.xz -C /tmp/pristine
+
+          # .gitignore lives at the repo root here, not inside upstream/ — it is
+          # this repository's, covering mcpp's build output. It is the one
+          # expected difference.
+          if diff -r --exclude=.gitignore /tmp/pristine/wayland-1.26.0 upstream; then
+            echo "upstream/ is pristine"
+          else
+            echo "::error::upstream/ differs from the wayland 1.26.0 release tarball."
+            echo "Everything this fork adds belongs under mcpp/."
+            exit 1
+          fi

README.mcpp.md

@@ -97,7 +97,10 @@ mcpp.toml             the workspace root
 
 Updating upstream is replacing `upstream/`. Nothing this fork adds lives inside
 it, so a diff against a fresh release tarball is empty there by construction —
-and CI checks that by building `upstream/` with its own meson on every run.
+and CI checks exactly that on every run, by downloading wayland 1.26.0 and
+comparing. Not by building it with meson: this repository builds one way,
+through mcpp, and comparing is the stronger check anyway — a successful meson
+build proves the tree still builds, not that nothing was edited.
 
 `build.mcpp` runs wayland-scanner at CONFIGURE time rather than declaring
 `mcpp::action` edges. The declarative shape was tried first and does not work
@@ -115,6 +118,6 @@ before ninja is written, so doing the work there is ordered by construction;
 
 ## Upstream
 
-Tracking wayland 1.26.0. Upstream sources, `protocol/`, `tests/` and the meson
-build are untouched — CI builds the tree with `meson setup && ninja` on every
-run, so "no upstream file is patched" has a test rather than a promise.
+Tracking wayland 1.26.0. `upstream/` is the release tarball byte for byte, and
+CI diffs it against a freshly downloaded one on every run — so "no upstream file
+is patched" has a test rather than a promise.