ci(gateway): pin candidate actions

gateway/packaging_test.go

@@ -1,15 +1,37 @@
 package gateway
 
 import (
+	"bufio"
 	"bytes"
 	"debug/buildinfo"
 	"debug/elf"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
+	"strings"
 	"testing"
 )
 
+func TestCIActionReferencesAreImmutable(t *testing.T) {
+	workflow, err := os.Open(filepath.Join("..", ".gitea", "workflows", "verify.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer workflow.Close()
+	immutable := regexp.MustCompile(`@[0-9a-f]{40}(?:\s+#.*)?$`)
+	scanner := bufio.NewScanner(workflow)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasPrefix(line, "- uses:") && !immutable.MatchString(line) {
+			t.Errorf("mutable CI action reference: %s", line)
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestGatewayLinuxArtifactsAreReproduciblePureGoELF(t *testing.T) {
 	first, second := t.TempDir(), t.TempDir()
 	for _, output := range []string{first, second} {