Publish curated ITWorx_MCP_Hub source from 7fde2770ba344c684b7e7a6b74f763dc19e7c560

tests/test_release_images_workflow.py

@@ -16,6 +16,22 @@ def release_job() -> dict:
     return workflow["jobs"]["release-images"]
 
 
+def test_all_checkouts_use_the_canonical_authenticated_https_origin() -> None:
+    workflow = yaml.safe_load(
+        (ROOT / ".gitea/workflows/managed-validation.yml").read_text(encoding="utf-8")
+    )
+    checkouts = [
+        step
+        for job in workflow["jobs"].values()
+        for step in job["steps"]
+        if step.get("uses") == CHECKOUT
+    ]
+    assert len(checkouts) == 2
+    for checkout in checkouts:
+        assert checkout["with"]["github-server-url"] == "https://gitea.example.com"
+        assert "token" not in checkout["with"]
+
+
 def test_release_build_requires_successful_validation_and_exact_main_push() -> None:
     job = release_job()
     assert job["name"] == "release-images"