ci: require agentcompat stress validation

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

integration/agentcompat/internal/workflowpolicy/resolver.go

@@ -0,0 +1,62 @@
+package workflowpolicy
+
+import (
+	"regexp"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+var (
+	resolvedRefPattern    = regexp.MustCompile(`^\$\{\{\s*steps\.([A-Za-z0-9_-]+)\.outputs\.sha\s*\}\}$`)
+	resolverRemotePattern = regexp.MustCompile(`(?m)^\s*remote=['"]https://github\.com/(nezhahq/(?:agent|nezha))\.git['"]\s*$`)
+)
+
+type refResolver struct {
+	id         string
+	repository Repository
+}
+
+func validatedRefResolver(step *yaml.Node) (refResolver, bool) {
+	idNode, hasID := mappingValue(step, "id")
+	runNode, hasRun := mappingValue(step, "run")
+	id, literalID := scalarString(idNode)
+	command, literalRun := scalarString(runNode)
+	if !hasID || !hasRun || !literalID || !literalRun || strings.TrimSpace(id) == "" {
+		return refResolver{}, false
+	}
+	lines := make([]string, 0, 7)
+	for _, line := range strings.Split(command, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if trimmed != "" {
+			lines = append(lines, trimmed)
+		}
+	}
+	if len(lines) != 7 || lines[0] != "set -euo pipefail" {
+		return refResolver{}, false
+	}
+	remoteMatch := resolverRemotePattern.FindStringSubmatch(lines[1])
+	if len(remoteMatch) != 2 {
+		return refResolver{}, false
+	}
+	repository := Repository(remoteMatch[1])
+	branch := "main"
+	if repository == RepositoryNezha {
+		branch = "master"
+	}
+	expectedLines := []string{
+		lines[0],
+		lines[1],
+		"mapfile -t refs < <(git ls-remote \"$remote\" refs/heads/" + branch + ")",
+		"(( ${#refs[@]} == 1 ))",
+		"sha=${refs[0]%%$'\\t'*}",
+		`[[ "$sha" =~ ^[0-9a-f]{40}$ ]]`,
+		`printf 'sha=%s\n' "$sha" >> "$GITHUB_OUTPUT"`,
+	}
+	for index, expected := range expectedLines {
+		if lines[index] != expected {
+			return refResolver{}, false
+		}
+	}
+	return refResolver{id: id, repository: repository}, true
+}