chore(ci): pin artifact download action

scripts/release-workflow.test.tsmodified+3-0

Changes to scripts/release-workflow.test.ts

		⋯11 linesShow the 11 lines above this hunk@@ -12,6 +12,7 @@ type Job = {
12	12	strategy?: { matrix: { platform: { name: string, os: string }[] } }
13	13	}
14	14	const release = Bun.YAML.parse(readFileSync(join(import.meta.dir, '../.github/workflows/release.yml'), 'utf8')) as { jobs: Record<string, Job> }
	15	+const artifactDownload = 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
15	16	const needs = (job: Job) => typeof job.needs === 'string' ? [job.needs] : job.needs ?? []
16	17	const steps = (job: Job) => job.steps?.map(step => step.run ?? '').join('\n') ?? ''
17	18
		⋯64 linesShow the 64 lines above this hunk@@ -82,4 +83,6 @@ test('SBOM generation validates required documents before uploading artifacts',
82	83	expect(command).not.toContain('||')
83	84	const scan = workflow.jobs['vulnerability-scan'].steps!.find(step => step.name === 'Scan and validate vulnerability report')
84	85	expect(scan?.env?.CRAFT_FAIL_HIGH).toBe('$')
	86	+ expect(workflow.jobs['vulnerability-scan'].steps!.find(step => step.uses?.startsWith('actions/download-artifact@'))?.uses).toBe(artifactDownload)
	87	+ expect(release.jobs['attach-release-sbom'].steps!.find(step => step.uses?.startsWith('actions/download-artifact@'))?.uses).toBe(artifactDownload)
85	88	})