fix(ci): pin vcpkg checkout to tag 2026.04.27 so the binary cache actually hits

[JoshDreamland]

TL;DR

CI runtimes are awful because our cache misses every time MS updates a comment at HEAD; fix that

Summary

Cherry-pick of the vcpkg pin from PR #96 so it can land independently of the broader quickstart/Dockerfile work in that PR. PR #101 currently carries this same commit as a cherry-pick; once this PR merges, that PR will rebase to drop the duplicate.

Why

setup-vcpkg/action.yml was doing a plain git clone microsoft/vcpkg with no checkout, so every CI run landed on whatever master HEAD happened to be that day. That silently shifts port-version ABI hashes between runs, invalidating the binary archive cache that the action set up two steps later. Result: every CI run paid the cold vcpkg-compile cost.

Aligns all four pinning points on tag 2026.04.27 (commit 56bb2411):

• third_party/vcpkg submodule
• vcpkg-configuration.json baseline
• docker/postgres-ext.Dockerfile ARG VCPKG_COMMIT
• .github/actions/setup-vcpkg/action.yml — the actual fix (adds the git checkout that was missing, plus a git fetch for the case where the runner already has a cached vcpkg clone from a prior run)

Previously at 2026.03.18-398 (mid-release); the tagged commit is 144 commits forward of that, so this is a small forward move to a curated port-set, not a rewind.

Test plan

• CI cache step shows a hit on the second consecutive run with no manifest changes — the symptom this fix targets.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

---

Note

Low Risk
Build/CI reproducibility only; no runtime app logic, auth, or data handling changes.

Overview
Pins vcpkg to tag 2026.04.27 (56bb2411…) everywhere CI and Docker install it, so port baselines and binary cache keys stay stable across runs.

The composite setup-vcpkg action now checks out that commit after clone and on reuse of an existing $HOME/vcpkg clone (with git fetch when needed)—previously it stayed on master HEAD and silently busted the vcpkg binary archive cache. vcpkg-configuration.json baseline and docker/postgres-ext.Dockerfile VCPKG_COMMIT are updated to the same hash for alignment with the submodule.

^{Reviewed by Cursor Bugbot for commit cb45f87. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Pins vcpkg to a specific tagged commit (2026.04.27 / 56bb2411…) across CI, Docker builds, and the vcpkg registry baseline to stabilize port ABI hashes and make the vcpkg binary cache reliably hit between runs.

Changes:

• Update vcpkg-configuration.json builtin registry baseline to 56bb2411….
• Update Docker build arg VCPKG_COMMIT to the same pinned commit.
• Update the composite setup-vcpkg GitHub Action to explicitly git checkout the pinned commit (and attempt a git fetch when $HOME/vcpkg already exists).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
vcpkg-configuration.json	Aligns the builtin registry baseline with the pinned vcpkg tag/commit for reproducible dependency resolution.
docker/postgres-ext.Dockerfile	Pins the vcpkg clone used in the Docker build to the same commit for reproducible images.
.github/actions/setup-vcpkg/action.yml	Ensures CI uses a deterministic vcpkg commit rather than drifting master, improving cache hit rates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.