Contract registry live drift #3

	name: Contract registry live drift

	on:
	workflow_dispatch:
	schedule:
	- cron: "17 5 * * 1"

	permissions:
	contents: read

	jobs:
	verify-v1-1:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- name: Compare published v1.1.1 release with vendored contracts
	env:
	REGISTRY_BASE: https://coding-autopilot-system.github.io/cas-contracts/registry
	PINNED_VERSION: 1.1.1
	VENDORED_ROOT: tests/contracts/cas-contracts/v1.1.1
	shell: python
	run: \|
	import hashlib, json, os, pathlib, urllib.request
	base = os.environ["REGISTRY_BASE"]
	version = os.environ["PINNED_VERSION"]
	root = pathlib.Path(os.environ["VENDORED_ROOT"])
	with urllib.request.urlopen(f"{base}/index.json", timeout=20) as response:
	index = json.load(response)
	if version not in index.get("releases", []):
	raise SystemExit(f"published registry is missing release {version}")
	with urllib.request.urlopen(f"{base}/releases/v{version}/manifest.json", timeout=20) as response:
	manifest = json.load(response)
	for entry in manifest["schemas"]:
	local = (root / entry["path"]).read_bytes()
	if hashlib.sha256(local).hexdigest() != entry["sha256"]:
	raise SystemExit(f"vendored digest drift: {entry['path']}")
	with urllib.request.urlopen(f"{base}/releases/v{version}/{entry['path']}", timeout=20) as response:
	published = response.read()
	if published != local:
	raise SystemExit(f"published content drift: {entry['path']}")

Provide feedback