From f9e253d9b33a0ffc4fdb6ec1c018434deefa1103 Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Wed, 26 Aug 2026 11:00:54 +0530
Subject: [PATCH] ci: align base-bash-libs workflow pins with GA (#1992)

---
 .ai-context/WORKFLOWS.md       |  4 ++++
 .github/workflows/tests.yml    |  6 +++---
 tests/test_github_workflows.py | 12 ++++++++++++
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/.ai-context/WORKFLOWS.md b/.ai-context/WORKFLOWS.md
index a84cae01..7f4d4617 100644
--- a/.ai-context/WORKFLOWS.md
+++ b/.ai-context/WORKFLOWS.md
@@ -44,6 +44,10 @@ run a duplicate push workflow for feature branches. Its concurrency group uses
 the pull-request number, or the Git ref for default-branch runs, so superseded
 commits cancel without affecting unrelated pull requests.
 
+Every `base-bash-libs` checkout in that workflow uses one immutable GA revision.
+The workflow contract test guards against an RC or mixed dependency pin
+returning across the platform and source-checkout jobs.
+
 Common commands:
 
 ```bash
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b5d02287..07757b2c 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -123,7 +123,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           repository: basefoundry/base-bash-libs
-          ref: c134fb8a3397e2cfee1d90845cec44f56dacae7b
+          ref: b4243765726c133499feeabdc50154f99c0fec12
           path: .dependencies/base-bash-libs
 
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
@@ -215,7 +215,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           repository: basefoundry/base-bash-libs
-          ref: c134fb8a3397e2cfee1d90845cec44f56dacae7b
+          ref: b4243765726c133499feeabdc50154f99c0fec12
           path: .dependencies/base-bash-libs
 
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
@@ -279,7 +279,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           repository: basefoundry/base-bash-libs
-          ref: c134fb8a3397e2cfee1d90845cec44f56dacae7b
+          ref: b4243765726c133499feeabdc50154f99c0fec12
           path: .dependencies/base-bash-libs
 
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py
index fbfca6c5..3499520a 100644
--- a/tests/test_github_workflows.py
+++ b/tests/test_github_workflows.py
@@ -25,6 +25,7 @@
 ISSUE_BRANCH_POLICY_TEMPLATE = REPO_ROOT / "templates" / "issue-branch-policy.yml"
 IMPLEMENTATION_ISSUE_TEMPLATE = REPO_ROOT / ".github" / "ISSUE_TEMPLATE" / "implementation.yml"
 FULL_COMMIT_SHA_ACTION_REF = re.compile(r"^[^@]+@[0-9a-f]{40}$")
+BASE_BASH_LIBS_GA_COMMIT = "b4243765726c133499feeabdc50154f99c0fec12"
 
 
 def workflow_files() -> list[Path]:
@@ -151,6 +152,17 @@ def test_tests_workflow_runs_once_per_pr_commit_and_on_main() -> None:
     }
 
 
+def test_tests_workflow_pins_all_base_bash_libs_checkouts_to_ga_revision() -> None:
+    refs = [
+        step.get("with", {}).get("ref")
+        for _, _, step in workflow_steps(TESTS_WORKFLOW)
+        if step.get("with", {}).get("repository") == "basefoundry/base-bash-libs"
+    ]
+
+    assert refs
+    assert refs == [BASE_BASH_LIBS_GA_COMMIT] * len(refs)
+
+
 def test_issue_branch_policy_workflow_is_trusted_and_template_backed() -> None:
     workflow = load_workflow(ISSUE_BRANCH_POLICY_WORKFLOW)
     triggers = workflow.get("on") or workflow.get(True)