ci(vendor-hash): restore real hash before unchanged-check early-return

The workflow replaces vendorHash with a fake sentinel before calling
nix build, parses the real hash from the "got:" line, and substitutes
it back. When old_hash equals new_hash, the early-return branch was
exiting before performing that final substitution, leaving the fake
hash in nix/package.nix. Combined with go.mod/go.sum changes from
go mod tidy, the Commit and push step then committed the fake hash.
See PR #974 for a concrete occurrence.

Move the restoration sed ahead of the unchanged check so the file is
always in a valid state before any exit. Also pipe grep through
head -n1 to defend against multi-line output (e.g. multiple FOD
failures reporting their own got: lines).

Author: cpcloud

.github/workflows/update-vendor-hash.yml

@@ -102,21 +102,25 @@ jobs:
           sed -i "s|vendorHash = \"sha256-[^\"]*\";|vendorHash = \"$fake_hash\";|" nix/package.nix
 
           output=$(nix build '.#micasa' 2>&1 || true)
-          new_hash=$(echo "$output" | grep -oP 'got:\s+\Ksha256-[A-Za-z0-9+/=]+' || true)
+          new_hash=$(echo "$output" | grep -oP 'got:\s+\Ksha256-[A-Za-z0-9+/=]+' | head -n1 || true)
 
           if [ -z "$new_hash" ]; then
             echo "::error::Failed to extract vendorHash from nix build output"
             echo "$output"
             exit 1
           fi
 
+          # Restore a real hash before any early-return so the fake hash can
+          # never reach a commit. If old_hash == new_hash this substitutes the
+          # original value back in place of the fake.
+          sed -i "s|vendorHash = \"$fake_hash\";|vendorHash = \"$new_hash\";|" nix/package.nix
+
           if [ "$old_hash" = "$new_hash" ]; then
             echo "vendorHash unchanged ($old_hash), nothing to do"
             echo "changed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          sed -i "s|vendorHash = \"$fake_hash\";|vendorHash = \"$new_hash\";|" nix/package.nix
           echo "changed=true" >> "$GITHUB_OUTPUT"
 
       - name: Verify build