From 8ea8a4b41c1441d318f319086d577f83bd202704 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 1 Sep 2026 00:37:12 +0200
Subject: [PATCH] fix: lock workflow checkout provenance

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
---
 tests/test_publication.py | 12 ++++++++----
 tools/build_site.py       | 35 +++++++++++++++--------------------
 2 files changed, 23 insertions(+), 24 deletions(-)

diff --git a/tests/test_publication.py b/tests/test_publication.py
index 77077c9..3e98c47 100644
--- a/tests/test_publication.py
+++ b/tests/test_publication.py
@@ -88,17 +88,19 @@ class PublicationTest(unittest.TestCase):
     def test_archive_build_uses_fetched_source_lock_revision(self) -> None:
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
-            repo = root / "the-custodian"
+            source_root = root / "_sources"
+            source_root.mkdir()
+            repo = root / "policy-nexus"
             source = repo / "canon/example.md"
             source.parent.mkdir(parents=True)
             source.write_text("example", encoding="utf-8")
             revision = "b" * 40
-            (root / "source-lock.json").write_text(
+            (source_root / "source-lock.json").write_text(
                 json.dumps(
                     {
                         "schema_version": 1,
                         "repositories": {
-                            "the-custodian": {"revision": revision}
+                            "policy-nexus": {"revision": revision}
                         },
                     }
                 ),
@@ -106,7 +108,9 @@ class PublicationTest(unittest.TestCase):
             )
 
             with mock.patch.dict(
-                os.environ, {"POLICY_NEXUS_SOURCE_ROOT": str(root)}, clear=False
+                os.environ,
+                {"POLICY_NEXUS_SOURCE_ROOT": str(source_root)},
+                clear=False,
             ):
                 self.assertEqual(revision, build_site._source_revision(repo, source))
 
diff --git a/tools/build_site.py b/tools/build_site.py
index f449875..61e9bdf 100644
--- a/tools/build_site.py
+++ b/tools/build_site.py
@@ -48,27 +48,22 @@ def _source_revision(repo: Path, source: Path) -> str:
     source_root = os.environ.get("POLICY_NEXUS_SOURCE_ROOT", "")
     if source_root:
         root = Path(source_root).resolve()
+        lock_path = root / "source-lock.json"
         try:
-            repo.relative_to(root)
-        except ValueError:
-            pass
-        else:
-            lock_path = root / "source-lock.json"
-            try:
-                lock = json.loads(lock_path.read_text(encoding="utf-8"))
-                locked_revision = lock["repositories"][repo.name]["revision"]
-            except (KeyError, OSError, TypeError, json.JSONDecodeError) as exc:
-                raise ValueError(
-                    f"{repo.name}: source revision is missing from {lock_path}"
-                ) from exc
-            if not isinstance(locked_revision, str) or not CLEAN_GIT_REVISION.fullmatch(
-                locked_revision
-            ):
-                raise ValueError(
-                    f"{repo.name}: locked source revision must be a clean 40-hex Git commit, "
-                    f"got {locked_revision!r}"
-                )
-            return locked_revision
+            lock = json.loads(lock_path.read_text(encoding="utf-8"))
+            locked_revision = lock["repositories"][repo.name]["revision"]
+        except (KeyError, OSError, TypeError, json.JSONDecodeError) as exc:
+            raise ValueError(
+                f"{repo.name}: source revision is missing from {lock_path}"
+            ) from exc
+        if not isinstance(locked_revision, str) or not CLEAN_GIT_REVISION.fullmatch(
+            locked_revision
+        ):
+            raise ValueError(
+                f"{repo.name}: locked source revision must be a clean 40-hex Git commit, "
+                f"got {locked_revision!r}"
+            )
+        return locked_revision
     try:
         head = subprocess.run(
             ["git", "-C", str(repo), "rev-parse", "HEAD"],