📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/tools/scripts/tests/automation_workflows.test.js

@@ -169,6 +169,12 @@ assert.ok(
     ciWorkflow.indexOf("- name: Intake PR change"),
   "PR policy dependencies must be installed before preflight executes",
 );
+assert.match(
+  ciWorkflow,
+  /- name: Intake PR change[\s\S]*?git worktree add --detach "\$trusted_root" "\$\{\{ github\.event\.pull_request\.base\.sha \}\}"[\s\S]*?"\$trusted_root\/tools\/scripts\/pr_preflight\.cjs"[\s\S]*?--base "\$\{\{ github\.event\.pull_request\.base\.sha \}\}"[\s\S]*?--head "\$\{\{ github\.event\.pull_request\.head\.sha \}\}"[\s\S]*?--check-fork-safety/,
+  "PR policy must execute trusted-base fork classification against the exact base/head tuple",
+);
+assert.match(ciWorkflow, /impact_profile: \$\{\{ steps\.intake\.outputs\.impact_profile \}\}/);
 assert.match(
   ciWorkflow,
   /GH_TOKEN: \$\{\{ github\.token \}\}/,
@@ -201,11 +207,26 @@ assert.match(
   /- name: Checkout[\s\S]*?uses: actions\/checkout@[a-f0-9]{40}[\s\S]*?with:[\s\S]*?fetch-depth: 0[\s\S]*?persist-credentials: false/,
   "Pages should use an unshallowed, credential-free checkout because canonical provenance validation reads git history",
 );
+assert.match(
+  pagesWorkflow,
+  /- name: Checkout[\s\S]*?- name: Verify release provenance[\s\S]*?- name: Setup Node/,
+  "Pages should verify immutable release provenance before dependency setup or installation",
+);
+assert.match(
+  pagesWorkflow,
+  /Verify release provenance[\s\S]*?GH_TOKEN: \$\{\{ github\.token \}\}[\s\S]*?GITHUB_REF_TYPE[\s\S]*?expected_tag="v\$\{package_version\}"[\s\S]*?refs\/tags\/\$\{GITHUB_REF_NAME\}\^\{commit\}[\s\S]*?releases\/tags\/\$\{GITHUB_REF_NAME\}[\s\S]*?\.draft == false[\s\S]*?\.published_at/,
+  "Pages should bind deployment to the exact package tag, commit, and published GitHub Release using the read-only token",
+);
 assert.match(
   ciWorkflow,
   /artifact-preview:[\s\S]*?actions\/checkout@[a-f0-9]{40}[\s\S]*?fetch-depth: 0[\s\S]*?persist-credentials: false/,
   "artifact-preview should retain history because canonical provenance generation reads git history",
 );
+assert.match(
+  ciWorkflow,
+  /source-validation:[\s\S]*?ci_artifact_preview\.cjs create[\s\S]*?actions\/upload-artifact@[a-f0-9]{40}[\s\S]*?artifact-preview:[\s\S]*?actions\/download-artifact@[a-f0-9]{40}[\s\S]*?ci_artifact_preview\.cjs" verify-summary/,
+  "normal PR artifact preview must reuse the exact-head manifest produced by source validation",
+);
 assert.doesNotMatch(
   offlineCatalogBuilder,
   /buildMetadataOverrides|metadata-overrides|review-queue/,