test: reject ceremony pin suffix drift

test/governance.test.js

@@ -156,3 +156,16 @@ test('repository carries the complete Forgejo 0.6.3 doctrine mirror and root rou
   );
   assert.match(rootAgents, /read\s+`.ceremony\/AGENTS\.md` first/i);
 });
+
+test('repository workflow pins use the exact Forgejo ceremony version', () => {
+  for (const workflow of CEREMONY_WORKFLOWS) {
+    const contents = fs.readFileSync(path.join(__dirname, '..', '.forgejo', 'workflows', workflow), 'utf8');
+    const prefix = `uses: heavy-duty/ceremony/.github/workflows/${workflow}@`;
+    const pins = contents.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith(prefix));
+    assert.deepEqual(
+      pins,
+      [`${prefix}${CEREMONY_VERSION}`],
+      `${workflow} does not pin ceremony ${CEREMONY_VERSION}`,
+    );
+  }
+});