[minor] Pin stable template provenance (#37)

* [minor] Pin stable template provenance

* [skip-release] Match generated lock YAML

Author: pennypacker-he

.github/workflows/integration-test.yaml

@@ -23,14 +23,20 @@ jobs:
             create_args: ""
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
         with:
           go-version: "1.26.x"
 
       - name: Install sitectl
-        uses: libops/.github/.github/actions/install-sitectl@da242aa070fa29b4028c5e03884b69857ea13fdf # main
+        uses: libops/.github/.github/actions/install-sitectl@90a9272d0829c878a682ba636bc155c2b06c7939 # main
+        with:
+          packages: sitectl
+          package-versions: sitectl=0.40.0
+          allow-unversioned: false
 
       - name: setup git identity
         run: |

.goreleaser.yaml

@@ -1,7 +1,7 @@
 version: 2
 before:
   hooks:
-    - ./scripts/check-sitectl-core-version.sh v0.38.0
+    - ./scripts/check-sitectl-core-version.sh v0.40.0
     - go mod tidy
 builds:
   - binary: sitectl-drupal
@@ -72,10 +72,10 @@ nfpms:
     overrides:
       deb:
         dependencies:
-          - sitectl (>= 0.38.0)
+          - sitectl (>= 0.40.0)
       rpm:
         dependencies:
-          - sitectl >= 0.38.0
+          - sitectl >= 0.40.0
       apk:
         dependencies:
-          - sitectl>=0.38.0
+          - sitectl>=0.40.0

cmd/create.go

@@ -4,7 +4,7 @@ import "github.com/libops/sitectl/pkg/plugin"
 
 const (
 	drupalCreateRepo       = "https://github.com/libops/drupal"
-	drupalCreateBranch     = "main"
+	drupalCreateBranch     = "v1.0.0"
 	drupalCreateDrupalRoot = "."
 	drupalContainerRoot    = "/var/www/drupal"
 )

go.mod

@@ -3,7 +3,7 @@ module github.com/libops/sitectl-drupal
 go 1.26.1
 
 require (
-	github.com/libops/sitectl v0.38.0
+	github.com/libops/sitectl v0.40.0
 	github.com/spf13/cobra v1.10.2
 	gopkg.in/yaml.v3 v3.0.1
 )

go.sum

@@ -82,8 +82,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/libops/sitectl v0.38.0 h1:QyaquU/+E3OS2yEQQnGi/dkCPpT+jGYYLJulPOSfqnE=
-github.com/libops/sitectl v0.38.0/go.mod h1:+MB7d95kz2/MbNSRB2gTlSwDg6swsFjh4zI5gC6rb+k=
+github.com/libops/sitectl v0.40.0 h1:LmlaqnCybdaT391nTe8tQvH4NYKDLdCcbNNjYluntv4=
+github.com/libops/sitectl v0.40.0/go.mod h1:+MB7d95kz2/MbNSRB2gTlSwDg6swsFjh4zI5gC6rb+k=
 github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
 github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=

scripts/check-sitectl-core-version.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -eu
 
-minimum="${1:-v0.38.0}"
+minimum="${1:-v0.40.0}"
 version="$(GOWORK=off go list -m -f '{{.Version}}' github.com/libops/sitectl)"
 
 case "$version" in

scripts/test-create.sh

@@ -48,6 +48,21 @@ build_plugin() {
 	command -v "${PLUGIN_BINARY}" >/dev/null
 }
 
+assert_template_lock() {
+	local lock="${SITE_DIR}/.libops/template.lock.yaml"
+	if [ -L "${lock}" ] || [ ! -f "${lock}" ]; then
+		echo "sitectl create did not retain a regular template provenance lock" >&2
+		return 1
+	fi
+	test "$(stat -c '%a' "${lock}")" = "644"
+	grep -Fxq 'apiVersion: sitectl.libops.io/v1alpha1' "${lock}"
+	grep -Fxq 'kind: TemplateLock' "${lock}"
+	grep -Eq '^    commit: [0-9a-f]{40}([0-9a-f]{24})?$' "${lock}"
+	grep -Fxq "    repository: https://github.com/libops/${PLUGIN_NAME}" "${lock}"
+	grep -Eq '^        digest: sha256:[0-9a-f]{64}$' "${lock}"
+	grep -Fxq '    revision: v1.0.0' "${lock}"
+}
+
 create_site() {
 	local target="${PLUGIN_NAME}/${CREATE_DEFINITION}"
 	local extra_args=()
@@ -61,6 +76,7 @@ create_site() {
 		--checkout-source template \
 		--default-context \
 		"${extra_args[@]}"
+	assert_template_lock
 }
 
 run_healthcheck() {