fix: lock workflow checkout provenance

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

tests/test_publication.py

@@ -88,17 +88,19 @@ class PublicationTest(unittest.TestCase):
     def test_archive_build_uses_fetched_source_lock_revision(self) -> None:
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
-            repo = root / "the-custodian"
+            source_root = root / "_sources"
+            source_root.mkdir()
+            repo = root / "policy-nexus"
             source = repo / "canon/example.md"
             source.parent.mkdir(parents=True)
             source.write_text("example", encoding="utf-8")
             revision = "b" * 40
-            (root / "source-lock.json").write_text(
+            (source_root / "source-lock.json").write_text(
                 json.dumps(
                     {
                         "schema_version": 1,
                         "repositories": {
-                            "the-custodian": {"revision": revision}
+                            "policy-nexus": {"revision": revision}
                         },
                     }
                 ),
@@ -106,7 +108,9 @@ class PublicationTest(unittest.TestCase):
             )
 
             with mock.patch.dict(
-                os.environ, {"POLICY_NEXUS_SOURCE_ROOT": str(root)}, clear=False
+                os.environ,
+                {"POLICY_NEXUS_SOURCE_ROOT": str(source_root)},
+                clear=False,
             ):
                 self.assertEqual(revision, build_site._source_revision(repo, source))
 

tools/build_site.py

@@ -48,27 +48,22 @@ def _source_revision(repo: Path, source: Path) -> str:
     source_root = os.environ.get("POLICY_NEXUS_SOURCE_ROOT", "")
     if source_root:
         root = Path(source_root).resolve()
+        lock_path = root / "source-lock.json"
         try:
-            repo.relative_to(root)
+            lock = json.loads(lock_path.read_text(encoding="utf-8"))
-        except ValueError:
+            locked_revision = lock["repositories"][repo.name]["revision"]
-            pass
+        except (KeyError, OSError, TypeError, json.JSONDecodeError) as exc:
-        else:
+            raise ValueError(
-            lock_path = root / "source-lock.json"
+                f"{repo.name}: source revision is missing from {lock_path}"
-            try:
+            ) from exc
-                lock = json.loads(lock_path.read_text(encoding="utf-8"))
+        if not isinstance(locked_revision, str) or not CLEAN_GIT_REVISION.fullmatch(
-                locked_revision = lock["repositories"][repo.name]["revision"]
+            locked_revision
-            except (KeyError, OSError, TypeError, json.JSONDecodeError) as exc:
+        ):
-                raise ValueError(
+            raise ValueError(
-                    f"{repo.name}: source revision is missing from {lock_path}"
+                f"{repo.name}: locked source revision must be a clean 40-hex Git commit, "
-                ) from exc
+                f"got {locked_revision!r}"
-            if not isinstance(locked_revision, str) or not CLEAN_GIT_REVISION.fullmatch(
+            )
-                locked_revision
+        return locked_revision
-            ):
-                raise ValueError(
-                    f"{repo.name}: locked source revision must be a clean 40-hex Git commit, "
-                    f"got {locked_revision!r}"
-                )
-            return locked_revision
     try:
         head = subprocess.run(
             ["git", "-C", str(repo), "rev-parse", "HEAD"],