fix: pin drift snapshot checkout revision (#236)

* fix: pin drift snapshot checkout revision

Co-Authored-By: Codex <noreply@openai.com>

* ci: retrigger review with updated bridge

Co-Authored-By: Codex <noreply@openai.com>

---------

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/reusable-drift-check.yml

@@ -12,6 +12,10 @@ on:
       snapshot_checkout_path:
         required: true
         type: string
+      snapshot_repository_ref:
+        required: false
+        type: string
+        default: "main"
       python_version:
         required: false
         type: string
@@ -131,7 +135,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ inputs.snapshot_repository }}
-          ref: main
+          ref: ${{ inputs.snapshot_repository_ref }}
           token: ${{ secrets.snapshot_repository_token || github.token }}
           path: ${{ inputs.snapshot_checkout_path }}
 

tests/test_reusable_drift_workflow.py

@@ -14,6 +14,7 @@ def test_reusable_drift_workflow_enforces_lifecycle_preflight() -> None:
     assert "snapshot_repository:" in workflow
     assert "snapshot_repository_token:" in workflow
     assert "snapshot_checkout_path:" in workflow
+    assert "snapshot_repository_ref:" in workflow
     assert "ai_gateway_service_url:" in workflow
     assert "quant_platform_kit_ref:" in workflow
     assert "lifecycle_performance_bucket:" in workflow
@@ -38,6 +39,7 @@ def test_reusable_drift_workflow_enforces_lifecycle_preflight() -> None:
     ) in workflow
     assert "quant-lifecycle drift --domain ${{ inputs.strategy_domain }} --no-alerts" in workflow
     assert 'repository: ${{ inputs.snapshot_repository }}' in workflow
+    assert 'ref: ${{ inputs.snapshot_repository_ref }}' in workflow
     assert 'path: ${{ inputs.snapshot_checkout_path }}' in workflow
     assert 'token: ${{ secrets.snapshot_repository_token || github.token }}' in workflow
     assert 'ref: ${{ inputs.quant_platform_kit_ref }}' in workflow