[Jaro-c]

Closes the watcher half of Glyndor/podup#1526, and replaces a comment with a test.

Two changes, and the test matters more

tests/test_workflow_pins.py — four assertions that run on every pull request.

Three reusables declare a Rust toolchain, and rust-supply-chain sat on 1.97 while rust-ci and rust-audit were on 1.98: a bump raised two and not the third, and nothing compared them. The consequence was not cosmetic — an SBOM was produced by a compiler the test suite never ran, the defect Glyndor/podup#1487 recorded. That was fixed with a comment, and a comment does not fail.

test	catches
the three toolchain defaults agree	the divergence that actually happened
that value is MAJOR.MINOR	rustup accepts stable, 1.98 and 1.98.0 and they mean different things — floating, a minor's stable release, and one pinned patch
SHELLCHECK_VERSION agrees across three workflows	same failure mode
ACTIONLINT_VERSION agrees across two	same

None hardcodes a version. They assert agreement, so they survive every bump and fail only on divergence.

Each was watched failing before being kept — the divergence introduced, the red observed, the file restored:

Rust toolchain defaults disagree: rust-ci.yml='1.98', rust-audit.yml='1.98',
  rust-supply-chain.yml='1.97'
Rust toolchain default is not a two-component version: rust-audit.yml='stable'
Shellcheck version disagrees: actionlint.yml='v0.10.0', shell-ci.yml='v0.11.0', ...
Actionlint version disagrees: actionlint.yml='v1.7.12', workflow-lint.yml='v1.7.11'

Each message names the file that drifted, not merely that one did.

The watcher

pin-watch.yml plus scripts/pin-watch.py, weekly on Tuesday at 06:00 so it does not stack on podup's Monday 05:00.

Every value is read from the workflow file, never hardcoded in the watcher. A watcher holding its own copy of a pin can disagree with reality, which is the bug it exists to prevent.

The part that decides whether this is read or muted. Four pins are held below upstream on purpose — ruff, bun, gosec, cargo-llvm-cov — each with its reason beside it. Reporting them every Tuesday would train the reader to close the issue unread. So a held pin is reported only when the pin stops matching its hold version, meaning somebody moved it and the note is now stale. The inversion is commented, so nobody "fixes" the watcher by deleting the list.

It also does not hide what it could not check: PowerShell Gallery returns Atom XML and is not wired, so PSScriptAnalyzer appears in a separate table marked as not queried rather than being counted as current.

Verified by running it

Against this repository with only gh stubbed — crates.io, PyPI, static.rust-lang.org and endoflife.date were real:

python            pin='3.13'     upstream='3.14'   DRIFT
rust              pin='1.98'     <match>
shellcheck        pin='v0.11.0'  <match>
bun               pin='1.3.14'   hold='1.3.14'     SILENT
cargo-llvm-cov    pin='0.8.7'    hold='0.8.7'      SILENT
gosec             pin='v2.27.1'  hold='v2.27.1'    SILENT
ruff              pin='0.12.0'   hold='0.12.0'     SILENT

One real drift, four held pins silent. Two more paths exercised: moving ruff to 0.14.0 against a hold of 0.12.0 reports STALE HOLD, and with the issue already open it declines to open a duplicate.

One correction worth recording: my first run reported actionlint, shellcheck and govulncheck as drifted. That was my stub returning raw JSON while ignoring --jq, not the script. The comparison was v1.7.12 against [{"tagName":"v1.7.12"}].

Not registered with schedule-freshness

The guard needs a successful run with event=schedule; crons fire only from the default branch and workflow_dispatch does not count, so an entry added in the pull request that adds the workflow fails on day one. It gets one after the first scheduled run — the same ordering podup hit with its own watcher.