return parse(readFileSync(".github/workflows/workflow-sanity.yml", "utf8"));

}

function readRealBehaviorProofWorkflow() {

return parse(readFileSync(".github/workflows/real-behavior-proof.yml", "utf8"));

}

function readCriticalQualityWorkflow() {

return readFileSync(".github/workflows/codeql-critical-quality.yml", "utf8");

}

expect(findUnpinnedExternalActions()).toEqual([]);

});

it("runs real behavior proof from the trusted workflow revision", () => {

const workflow = readRealBehaviorProofWorkflow();

const source = readFileSync(".github/workflows/real-behavior-proof.yml", "utf8");

const checkout = workflow.jobs["real-behavior-proof"].steps.find(

(step) => step.uses === CHECKOUT_V6,

);

expect(checkout.with.ref).toBe("${{ github.workflow_sha }}");

expect(checkout.with.ref).not.toBe("${{ github.event.pull_request.base.sha }}");

expect(source).toContain("Old PR events can carry a stale base SHA");

});

it("keeps docs-change detection fail-safe and fixture-aware", () => {

const action = readFileSync(".github/actions/detect-docs-changes/action.yml", "utf8");

expect(runStep.env.OPENCLAW_TEST_PROJECTS_PARALLEL).toBe("2");

expect(runStep.env.OPENCLAW_NODE_TEST_ENV_JSON).toBe("${{ toJson(matrix.env) }}");

expect(runStep.run).toContain("env: JSON.parse(process.env.OPENCLAW_NODE_TEST_ENV_JSON");

expect(runStep.run).toContain("if (plan.env && typeof plan.env === \"object\"");

expect(runStep.run).toContain('if (plan.env && typeof plan.env === "object"');

expect(runStep.run).toContain("childEnv[key] = value");

});