From 4d832cf9e43aa8f342f9cf3cdee13a0d71b3cc47 Mon Sep 17 00:00:00 2001
From: MickLesk <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 13 Nov 2026 12:36:01 +0100
Subject: [PATCH 1/2] Pin tag-only apps with var_appversion too

fetch_and_deploy_gh_tag and fetch_and_deploy_gl_tag ignored var_appversion
and always took the newest tag, so a tag-only app like Redmine could not be
installed at an older version. They now take the pin for the script's own
app, by the same rule as fetch_and_deploy_release.
---
 lib/forge.func                  |  8 ++++++++
 tests/forge-appversion-scope.sh | 21 ++++++++++++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/lib/forge.func b/lib/forge.func
index 5cb09959..5e17ee38 100644
--- a/lib/forge.func
+++ b/lib/forge.func
@@ -778,10 +778,14 @@ _deploy_unpacked_archive() {
 #   - For repos that only publish tags, not GitHub Releases
 # ------------------------------------------------------------------------------
 fetch_and_deploy_gh_tag() {
+  local script_app="${NSAPP:-${app:-}}"
   local app="$1"
   local repo="$2"
   local version="${3:-latest}"
   local target="${4:-/opt/$app}"
+  if [[ -n "${var_appversion:-}" ]] && _forge_is_script_app "$app" "$script_app"; then
+    version="$var_appversion"
+  fi
   local app_lc=""
   app_lc="$(echo "${app,,}" | tr -d ' ')"
   local version_file="$HOME/.${app_lc}"
@@ -938,10 +942,14 @@ get_latest_gl_tag() {
 #     (use fetch_and_deploy_gl_release for proper Releases with assets)
 # ------------------------------------------------------------------------------
 fetch_and_deploy_gl_tag() {
+  local script_app="${NSAPP:-${app:-}}"
   local app="$1"
   local repo="$2"
   local tag_pattern="${3:-latest}"
   local target="${4:-/opt/$app}"
+  if [[ -n "${var_appversion:-}" ]] && _forge_is_script_app "$app" "$script_app"; then
+    tag_pattern="$var_appversion"
+  fi
 
   local app_lc=""
   app_lc="$(echo "${app,,}" | tr -d ' ')"
diff --git a/tests/forge-appversion-scope.sh b/tests/forge-appversion-scope.sh
index 57b4d915..eee9552e 100644
--- a/tests/forge-appversion-scope.sh
+++ b/tests/forge-appversion-scope.sh
@@ -2,7 +2,7 @@
 set -uo pipefail
 
 CORE_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
-eval "$(awk '/^(fetch_and_deploy_release|_forge_workdir|_forge_is_script_app|_forge_descriptor|_forge_strip_v|_forge_previous_version)[(][)] [{]/,/^}/' "$CORE_DIR/lib/forge.func")"
+eval "$(awk '/^(fetch_and_deploy_release|fetch_and_deploy_gh_tag|fetch_and_deploy_gl_tag|_forge_workdir|_forge_is_script_app|_forge_descriptor|_forge_strip_v|_forge_previous_version)[(][)] [{]/,/^}/' "$CORE_DIR/lib/forge.func")"
 
 TEST_DIR="$(mktemp -d)"
 trap 'rm -rf -- "$TEST_DIR"' EXIT
@@ -92,5 +92,24 @@ rm -rf "$TEST_DIR/opt/subwave"
 deploy github subwave perminder-klair/subwave tarball latest "$TEST_DIR/opt/subwave" >/dev/null
 check "a tarball whose directory is gone is deployed again" "1" "$(grep -c '^download ' "$LOG")"
 
+# Tag-only apps (Redmine) ignored the pin and always took the newest tag.
+get_latest_gh_tag() { echo "9.9.9"; }
+get_latest_gl_tag() { echo "9.9.9"; }
+tag_deploy() {
+  : >"$LOG"
+  rm -f "$HOME/.$2"
+  "$1" "$2" "owner/$2" "${3:-latest}" "$TEST_DIR/opt/$2" >/dev/null 2>&1
+  grep -o '/[^/]*\.tar\.gz$' "$LOG" | head -n1
+}
+export var_appversion=7.0.3
+# shellcheck disable=SC2034  # read by the tag helpers
+NSAPP=redmine
+check "GitHub tag: the script's own app gets the pin" "/7.0.3.tar.gz" "$(tag_deploy fetch_and_deploy_gh_tag redmine)"
+check "GitHub tag: another app stays on latest" "/9.9.9.tar.gz" "$(tag_deploy fetch_and_deploy_gh_tag guacd)"
+check "GitLab tag: the script's own app gets the pin" "/redmine-7.0.3.tar.gz" "$(tag_deploy fetch_and_deploy_gl_tag redmine)"
+check "GitLab tag: another app keeps its pattern" "/guacd-9.9.9.tar.gz" "$(tag_deploy fetch_and_deploy_gl_tag guacd 'v*')"
+unset var_appversion NSAPP
+check "GitHub tag: without a pin it takes the newest" "/9.9.9.tar.gz" "$(tag_deploy fetch_and_deploy_gh_tag redmine)"
+
 echo "${passed} passed, ${failed} failed"
 [[ "$failed" -eq 0 ]]

From 4aea1cc1e15f36d7639d722817c4e25e0437251d Mon Sep 17 00:00:00 2001
From: MickLesk <47820557+MickLesk@users.noreply.github.com>
Date: Fri, 13 Nov 2026 15:40:50 +0100
Subject: [PATCH 2/2] Trim the comments to what a reader would get wrong

---
 tests/forge-appversion-scope.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/forge-appversion-scope.sh b/tests/forge-appversion-scope.sh
index eee9552e..871a8600 100644
--- a/tests/forge-appversion-scope.sh
+++ b/tests/forge-appversion-scope.sh
@@ -92,7 +92,6 @@ rm -rf "$TEST_DIR/opt/subwave"
 deploy github subwave perminder-klair/subwave tarball latest "$TEST_DIR/opt/subwave" >/dev/null
 check "a tarball whose directory is gone is deployed again" "1" "$(grep -c '^download ' "$LOG")"
 
-# Tag-only apps (Redmine) ignored the pin and always took the newest tag.
 get_latest_gh_tag() { echo "9.9.9"; }
 get_latest_gl_tag() { echo "9.9.9"; }
 tag_deploy() {