on:
  pull_request:
concurrency: policy
permissions:
  contents: read
jobs:
  verify:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - id: resolve-agent
        run: |
          set -euo pipefail
          remote='https://github.com/nezhahq/agent.git'
          mapfile -t refs < <(git ls-remote "$remote" refs/heads/main)
          (( ${#refs[@]} == 1 ))
          sha=${refs[0]%%$'\t'*}
          [[ "$sha" =~ ^[0-9a-f]{40}$ ]]
          sha=attacker-controlled
          printf 'sha=%s\n' "$sha" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          repository: nezhahq/agent
          ref: ${{ steps.resolve-agent.outputs.sha }}
          persist-credentials: false