Add SOURCE_REF and CI check for tuple bookkeeping

Fail CI when HEAD diverges from SOURCE_REF so spec pins/matrix
can record the SDK commit in the ecosystem tuple.

Author: Nathan Gillett

.github/workflows/ci.yml

@@ -44,6 +44,9 @@ jobs:
       - name: Install dependencies
         run: pip install -e ".[dev]"
 
+      - name: Verify SOURCE_REF matches this commit
+        run: bash scripts/check-source-ref.sh
+
       - name: Verify sdk-signing fixtures match pinned spec
         env:
           INTENTPROOF_SPEC_DIR: intentproof-spec

SOURCE_REF

@@ -0,0 +1 @@
+62dc0738053fdab8d8a9178e0c7f674369599632

scripts/check-source-ref.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Fail when SOURCE_REF does not match the current commit (tuple bookkeeping).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+if [[ ! -f SOURCE_REF ]]; then
+  echo "Missing SOURCE_REF in repository root" >&2
+  exit 2
+fi
+
+HEAD="$(git rev-parse HEAD)"
+REF="$(tr -d '[:space:]' < SOURCE_REF)"
+if ! echo "$REF" | grep -qE '^[0-9a-f]{40}$'; then
+  echo "Invalid SOURCE_REF: must be a 40-character lowercase git SHA" >&2
+  exit 1
+fi
+
+if [[ "$HEAD" != "$REF" ]]; then
+  echo "FAIL: SOURCE_REF ($REF) does not match HEAD ($HEAD)" >&2
+  echo "Update SOURCE_REF and bump spec matrix/pins after merging SDK changes." >&2
+  exit 1
+fi
+
+echo "PASS: SOURCE_REF matches HEAD ($HEAD)."