Add assertion test to enforce action.yml update on release

Signed-off-by: lelia <lelia@socket.dev>

Author: lelia

.github/workflows/python-tests.yml

@@ -8,13 +8,15 @@ on:
       - "tests/**/*.py"
       - "pyproject.toml"
       - "uv.lock"
+      - "action.yml"
       - ".github/workflows/python-tests.yml"
   pull_request:
     paths:
       - "socket_basics/**/*.py"
       - "tests/**/*.py"
       - "pyproject.toml"
       - "uv.lock"
+      - "action.yml"
       - ".github/workflows/python-tests.yml"
   workflow_dispatch:
 
@@ -49,5 +51,28 @@ jobs:
           V_TOML=$(python -c "import tomllib; print(tomllib.loads(open('pyproject.toml').read())['project']['version'])")
           [ "$V_PY" = "$V_TOML" ] || (echo "Version mismatch: version.py=$V_PY pyproject.toml=$V_TOML" && exit 1)
           echo "Version in sync: $V_PY"
+
+      - name: 🔒 Assert action.yml image ref matches version (once switched to pre-built)
+        run: |
+          python3 - <<'EOF'
+          import re, sys, tomllib
+          from pathlib import Path
+
+          action = Path("action.yml").read_text()
+          version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
+
+          match = re.search(r'image:\s*["\']docker://[^:]+:([^"\']+)["\']', action)
+          if not match:
+              print(f"SKIP: action.yml still uses Dockerfile — check will activate once switched to pre-built image")
+              sys.exit(0)
+
+          action_version = match.group(1)
+          if action_version != version:
+              print(f"FAIL: action.yml refs {action_version} but version is {version}")
+              print(f"      Update action.yml image ref to docker://ghcr.io/socketdev/socket-basics:{version}")
+              sys.exit(1)
+
+          print(f"OK: action.yml image ref matches version {version}")
+          EOF
       - name: 🧪 Run tests
         run: pytest -q tests/