ci: verify installed distributions

tests/test_ci_policy.py

@@ -0,0 +1,47 @@
+"""Repository contracts for immutable CI execution dependencies."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+
+ROOT = Path(__file__).parents[1]
+WORKFLOW = ROOT / ".github" / "workflows" / "ci.yml"
+MANIFEST = ROOT / "ci" / "digests.txt"
+ACTION_REF = re.compile(
+    r"^\s*uses:\s*([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)@([0-9a-f]{40})\s+#\s+(\S+)\s*$",
+)
+
+
+def _manifest_entries() -> dict[tuple[str, str], tuple[str, str]]:
+    entries: dict[tuple[str, str], tuple[str, str]] = {}
+    for line in MANIFEST.read_text(encoding="utf-8").splitlines():
+        if not line or line.startswith("#"):
+            continue
+        kind, name, pin, version, _date, _rationale = line.split(maxsplit=5)
+        entries[(kind, name)] = (pin, version)
+    return entries
+
+
+def test_every_external_action_is_sha_pinned_and_manifested():
+    entries = _manifest_entries()
+    uses_lines = [
+        line for line in WORKFLOW.read_text(encoding="utf-8").splitlines()
+        if "uses:" in line and "uses: ./" not in line
+    ]
+
+    assert uses_lines
+    for line in uses_lines:
+        match = ACTION_REF.match(line)
+        assert match is not None, f"external action is not SHA-pinned with a version comment: {line}"
+        name, pin, version = match.groups()
+        assert entries[("action", name)] == (pin, version)
+
+
+def test_actionlint_version_and_checksum_match_manifest():
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    pin, version = _manifest_entries()[("tool", "rhysd/actionlint")]
+
+    assert f'ACTIONLINT_VERSION: "{version.removeprefix("v")}"' in workflow
+    assert f'ACTIONLINT_SHA256: "{pin.removeprefix("sha256:")}"' in workflow