fix(ci): run exact-head gates on stacked pull requests

.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
 
 permissions:
   contents: read
@@ -19,11 +18,18 @@ env:
 jobs:
   build-and-test:
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
+      - name: Verify exact checkout
+        env:
+          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          actual_head="$(git rev-parse HEAD)"
+          test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA"
       # pnpm version comes from the package.json "packageManager" field
       # (pnpm 10+), which is required to read `overrides` from
       # pnpm-workspace.yaml consistently with the committed lockfile.
@@ -47,14 +53,20 @@ jobs:
   browser-release-evidence:
     name: Cross-engine Clipboard / Playwright 1.62.0
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 60
     env:
       PLAYWRIGHT_BROWSERS_PATH: /tmp/inkspan-playwright-browsers
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
+      - name: Verify exact checkout
+        env:
+          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          actual_head="$(git rev-parse HEAD)"
+          test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA"
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -74,6 +86,7 @@ jobs:
   office:
     name: Office / Python ${{ matrix.python-version }}
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -88,6 +101,12 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
+      - name: Verify exact checkout
+        env:
+          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          actual_head="$(git rev-parse HEAD)"
+          test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA"
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}

src/workflowExactHead.test.ts

@@ -33,6 +33,37 @@ describe('exact-head CI workflow contract', () => {
     expect(workflow.match(/persist-credentials: false/g)).toHaveLength(3);
   });
 
+  it('runs exact-head CI for pull requests regardless of stacked base branch', () => {
+    expect(workflow).toContain('  push:\n    branches: [main]');
+    expect(workflow).toContain('  pull_request:\n');
+    expect(workflow).not.toContain('  pull_request:\n    branches: [main]');
+  });
+
+  it('keeps ordinary jobs bounded while allowing slow browser dependency mirrors to finish', () => {
+    expect(workflow.match(/timeout-minutes: 30/g)).toHaveLength(2);
+    expect(workflow.match(/timeout-minutes: 60/g)).toHaveLength(1);
+
+    const browserStart = workflow.indexOf('  browser-release-evidence:');
+    const officeStart = workflow.indexOf('  office:', browserStart);
+    expect(browserStart).toBeGreaterThan(-1);
+    expect(officeStart).toBeGreaterThan(browserStart);
+    const browserJob = workflow.slice(browserStart, officeStart);
+    expect(browserJob).toContain('timeout-minutes: 60');
+  });
+
+  it('verifies the runtime checkout SHA before any job consumes repository code', () => {
+    const verificationStep = [
+      '- name: Verify exact checkout',
+      '        env:',
+      '          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}',
+      '        run: |',
+      '          actual_head="$(git rev-parse HEAD)"',
+      '          test "$actual_head" = "$INKSPAN_EXPECTED_HEAD_SHA"',
+    ].join('\n');
+
+    expect(workflow.split(verificationStep)).toHaveLength(4);
+  });
+
   it('keeps the workflow read-only and hash-pins every third-party action', () => {
     expect(workflow).toContain('permissions:\n  contents: read');
     expect(workflow).not.toContain('contents: write');