fix(ci): verify exact triggering commit in Windows build and package

.github/workflows/build.yml

@@ -11,11 +11,24 @@ jobs:
     name: Build, test, validate and package Windows application
     runs-on: windows-latest
     steps:
-      - name: Checkout ARSAS application
+      - name: Checkout exact triggering ARSAS revision
+        uses: actions/checkout@v4
+        with:
+          path: ArIED61850Tester
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Verify tested application revision
         shell: powershell
         run: |
-          $ref = if ($env:GITHUB_HEAD_REF) { $env:GITHUB_HEAD_REF } else { $env:GITHUB_REF_NAME }
-          git clone --quiet --depth 1 --branch $ref "https://github.com/$env:GITHUB_REPOSITORY.git" ArIED61850Tester
+          $actual = (git -C .\ArIED61850Tester rev-parse HEAD).Trim().ToLowerInvariant()
+          $expected = $env:GITHUB_SHA.Trim().ToLowerInvariant()
+          if ($actual -ne $expected) {
+            throw "CI source revision mismatch. Expected $expected, checked out $actual."
+          }
+          "ARSAS_SOURCE_COMMIT=$actual" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          Write-Host "Testing and packaging exact ARSAS source $actual"
 
       - name: Resolve immutable ARIEC61850 integration lock
         shell: powershell

tests/ARSAS.Tests/ExactCiSourceRevisionContractTests.cs

@@ -0,0 +1,39 @@
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Locks the CI build to the event's immutable revision. A moving PR branch must
+/// never silently change which application source is built, tested or packaged.
+/// </summary>
+public sealed class ExactCiSourceRevisionContractTests
+{
+    [Fact]
+    public void WindowsBuild_ChecksOutAndVerifiesTheExactTriggerCommit()
+    {
+        var workflow = File.ReadAllText(FindRepositoryFile(".github/workflows/build.yml"));
+
+        Assert.Contains("ref: ${{ github.sha }}", workflow, StringComparison.Ordinal);
+        Assert.Contains("path: ArIED61850Tester", workflow, StringComparison.Ordinal);
+        Assert.Contains("persist-credentials: false", workflow, StringComparison.Ordinal);
+        Assert.Contains("git -C .\\ArIED61850Tester rev-parse HEAD", workflow, StringComparison.Ordinal);
+        Assert.Contains("$env:GITHUB_SHA.Trim().ToLowerInvariant()", workflow, StringComparison.Ordinal);
+        Assert.Contains("CI source revision mismatch", workflow, StringComparison.Ordinal);
+        Assert.Contains("ARSAS_SOURCE_COMMIT=$actual", workflow, StringComparison.Ordinal);
+        Assert.DoesNotContain("git clone --quiet --depth 1 --branch $ref", workflow, StringComparison.Ordinal);
+        Assert.Contains("dotnet test .\\ArIED61850Tester\\tests\\ARSAS.Tests", workflow, StringComparison.Ordinal);
+        Assert.Contains("scripts\\publish-windows-portable.ps1", workflow, StringComparison.Ordinal);
+    }
+
+    private static string FindRepositoryFile(string relativePath)
+    {
+        DirectoryInfo? directory = new(AppContext.BaseDirectory);
+        while (directory != null)
+        {
+            var candidate = Path.Combine(directory.FullName, relativePath);
+            if (File.Exists(candidate))
+                return candidate;
+            directory = directory.Parent;
+        }
+
+        throw new FileNotFoundException($"Repository file not found: {relativePath}");
+    }
+}