From 3fac8096f7dd4b6de5c5bf6765ba9cd4aaf5aef6 Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <codex-bot-andresmgsl@noreply.forgejo.heavyduty.builders>
Date: Mon, 31 Aug 2026 18:38:54 +0000
Subject: [PATCH] test: require exact ceremony workflow pins

---
 test/governance.test.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/test/governance.test.js b/test/governance.test.js
index 11eb7c4..5a6e03c 100644
--- a/test/governance.test.js
+++ b/test/governance.test.js
@@ -13,10 +13,7 @@ const REPOSITORY_MIRROR = path.join(__dirname, '..', '.ceremony');
 const ROOT_AGENTS = path.join(__dirname, '..', 'AGENTS.md');
 const CEREMONY_REPOSITORY = 'https://forgejo.heavyduty.builders/heavy-duty/ceremony';
 const CEREMONY_VERSION = '0.6.3';
-const CEREMONY_WORKFLOWS = [
-  path.join(__dirname, '..', '.forgejo', 'workflows', 'labels.yml'),
-  path.join(__dirname, '..', '.forgejo', 'workflows', 'labels-sweep.yml'),
-];
+const CEREMONY_WORKFLOWS = ['labels.yml', 'labels-sweep.yml'];
 const cleanups = [];
 process.on('exit', () => {
   for (const dir of cleanups) fs.rmSync(dir, { recursive: true, force: true });
@@ -148,8 +145,11 @@ test('repository carries the complete Forgejo 0.6.3 doctrine mirror and root rou
     'mirror README does not identify the exact Forgejo ceremony source and version',
   );
   for (const workflow of CEREMONY_WORKFLOWS) {
-    const contents = fs.readFileSync(workflow, 'utf8');
-    assert.match(contents, new RegExp(`uses: heavy-duty/ceremony/.github/workflows/[^@]+@${CEREMONY_VERSION}`));
+    const contents = fs.readFileSync(path.join(__dirname, '..', '.forgejo', 'workflows', workflow), 'utf8');
+    assert.ok(
+      contents.includes(`uses: heavy-duty/ceremony/.github/workflows/${workflow}@${CEREMONY_VERSION}`),
+      `${workflow} does not pin ceremony ${CEREMONY_VERSION}`,
+    );
   }
   assert.match(mirrorReadme, /labels doctrine is vendored manually/);
   assert.doesNotMatch(mirrorReadme, /The pin lives in `.github\/workflows\/release\.yml`/);