ci: add a weekly mutation check for the security checks' tests

.github/postgres/Dockerfile

@@ -1,9 +1,9 @@
-# Never built. ci.yml's sqlstore job runs this image as a service
-# container, and Dependabot doesn't update a workflow's service images,
-# but it does update a Dockerfile's (the docker ecosystem in
+# Never built. ci.yml's sqlstore job and mutation.yml run this image as
+# a service container, and Dependabot doesn't update a workflow's service
+# images, but it does update a Dockerfile's (the docker ecosystem in
 # .github/dependabot.yml). So the pin lives here too, and ci.yml's lint
-# job (.github/scripts/check-postgres-pin.sh) fails until the two match:
-# when Dependabot moves this digest, copy it to ci.yml.
+# job (.github/scripts/check-postgres-pin.sh) fails until they all
+# match: when Dependabot moves this digest, copy it to both workflows.
 FROM postgres:17-alpine@sha256:266d3c257594e195b309ae9d1805e54c788f1d7b375f56bf6c367aac6c917e7b
 # The image's server itself runs as postgres (its entrypoint drops root);
 # naming it here only keeps this never-built file from defaulting to root.

.github/scripts/check-postgres-pin.sh

@@ -1,35 +1,39 @@
 #!/usr/bin/env bash
-# Checks that every Postgres service image in .github/workflows/ci.yml
-# is exactly the image .github/postgres/Dockerfile pins (tag and digest).
-# Dependabot can't update a workflow's service image but does update a
-# Dockerfile's, so a Dependabot pull request moving the Dockerfile's
-# digest fails this until ci.yml is moved to match.
+# Checks that every Postgres service image in .github/workflows/ (the
+# sqlstore job in ci.yml, and mutation.yml) is exactly the image
+# .github/postgres/Dockerfile pins (tag and digest). Dependabot can't
+# update a workflow's service image but does update a Dockerfile's, so a
+# Dependabot pull request moving the Dockerfile's digest fails this
+# until the workflows are moved to match.
 #
 # Usage: check-postgres-pin.sh [repo-root]
 set -euo pipefail
 
 root=${1:-.}
 dockerfile=$root/.github/postgres/Dockerfile
-workflow=$root/.github/workflows/ci.yml
 
 want=$(sed -nE 's/^FROM[[:space:]]+([^[:space:]]+).*/\1/p' "$dockerfile")
 if [[ "$(printf '%s\n' "$want" | grep -c .)" -ne 1 || $want != postgres:*@sha256:* ]]; then
 	echo "$dockerfile: want exactly one FROM postgres:<tag>@sha256:<digest> line" >&2
 	exit 1
 fi
 
-found=$(sed -nE 's/^[[:space:]]*image:[[:space:]]*(postgres[:@][^[:space:]]*).*/\1/p' "$workflow")
-if [[ -z $found ]]; then
-	echo "$workflow: no Postgres service image found" >&2
+status=0
+seen=0
+for workflow in "$root"/.github/workflows/*.yml; do
+	found=$(sed -nE 's/^[[:space:]]*image:[[:space:]]*(postgres[:@][^[:space:]]*).*/\1/p' "$workflow")
+	[[ -z $found ]] && continue
+	while IFS= read -r got; do
+		seen=$((seen + 1))
+		if [[ $got != "$want" ]]; then
+			echo "$workflow: Postgres service image $got doesn't match $dockerfile's $want; copy the Dockerfile's pin there" >&2
+			status=1
+		fi
+	done <<<"$found"
+done
+if [[ $seen -eq 0 ]]; then
+	echo "$root/.github/workflows: no Postgres service image found" >&2
 	exit 1
 fi
-
-status=0
-while IFS= read -r got; do
-	if [[ $got != "$want" ]]; then
-		echo "$workflow: Postgres service image $got doesn't match $dockerfile's $want; copy the Dockerfile's pin to ci.yml" >&2
-		status=1
-	fi
-done <<<"$found"
-[[ $status -eq 0 ]] && echo "Postgres service image matches $dockerfile: $want"
+[[ $status -eq 0 ]] && echo "All $seen Postgres service images match $dockerfile: $want"
 exit "$status"