From c900f47d777db03d067f8722b0e88e92cbd9bc1b Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <codex-bot-andresmgsl@noreply.forgejo.heavyduty.builders>
Date: Mon, 31 Aug 2026 19:30:33 +0000
Subject: [PATCH] test: reject ceremony pin suffix drift

---
 test/governance.test.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/test/governance.test.js b/test/governance.test.js
index 28a8baa..85607c8 100644
--- a/test/governance.test.js
+++ b/test/governance.test.js
@@ -156,3 +156,16 @@ test('repository carries the complete Forgejo 0.6.3 doctrine mirror and root rou
   );
   assert.match(rootAgents, /read\s+`.ceremony\/AGENTS\.md` first/i);
 });
+
+test('repository workflow pins use the exact Forgejo ceremony version', () => {
+  for (const workflow of CEREMONY_WORKFLOWS) {
+    const contents = fs.readFileSync(path.join(__dirname, '..', '.forgejo', 'workflows', workflow), 'utf8');
+    const prefix = `uses: heavy-duty/ceremony/.github/workflows/${workflow}@`;
+    const pins = contents.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith(prefix));
+    assert.deepEqual(
+      pins,
+      [`${prefix}${CEREMONY_VERSION}`],
+      `${workflow} does not pin ceremony ${CEREMONY_VERSION}`,
+    );
+  }
+});