import re
from pathlib import Path
import yaml
w = yaml.safe_load(Path(".github/workflows/ci.yml").read_text())
assert set(w["on"]) == {"pull_request", "push"}
assert w["permissions"] == {"contents": "read"}
steps = w["jobs"]["verify"]["steps"]
uses = [x["uses"] for x in steps if "uses" in x]
assert len(uses) == 3
assert all(re.fullmatch(r"actions/[a-z-]+@[0-9a-f]{40}", x) for x in uses)
assert steps[0]["with"]["persist-credentials"] is False
print("workflow local checks: read-only permissions; 3 full-SHA actions")