#!/usr/bin/env python3
"""Require immutable commits for third-party Gitea workflow actions."""

from __future__ import annotations

import pathlib
import re


ROOT = pathlib.Path(__file__).resolve().parents[1]
USE = re.compile(r"^\s*-\s+uses:\s+([^@\s]+)@([^\s#]+)", re.MULTILINE)


for workflow in sorted((ROOT / ".gitea/workflows").glob("*.y*ml")):
    for action, revision in USE.findall(workflow.read_text(encoding="utf-8")):
        if not action.startswith("./") and not re.fullmatch(r"[0-9a-f]{40}", revision):
            raise SystemExit(f"{workflow.relative_to(ROOT)}: mutable action {action}@{revision}")

print("Protocol CI action references are immutable")