From 80a5199150ca1303f2ae487f4f083e697451e0f4 Mon Sep 17 00:00:00 2001
From: George Berkshire <41768719+ageorge156@users.noreply.github.com>
Date: Thu, 20 Aug 2026 20:22:15 +0800
Subject: [PATCH] test: add reproducer for missing lite CI contract

---
 tests/test_ci_contract.py | 41 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 tests/test_ci_contract.py

diff --git a/tests/test_ci_contract.py b/tests/test_ci_contract.py
new file mode 100644
index 0000000..c76458e
--- /dev/null
+++ b/tests/test_ci_contract.py
@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class CiContractTests(unittest.TestCase):
+    def test_ci_publishes_one_offline_lite_gate(self) -> None:
+        workflow = (ROOT / ".gitea/workflows/ci.yml").read_text(encoding="utf-8")
+        job_block = workflow.split("jobs:", 1)[1]
+
+        self.assertEqual(
+            re.findall(r"(?m)^  ([a-z][a-z0-9_-]*):\s*$", job_block),
+            ["lite"],
+        )
+        self.assertIn(
+            "actions/checkout@524e936cd9e579adf00e308bfdf971aebc7de09e",
+            workflow,
+        )
+        self.assertIn("persist-credentials: false", workflow)
+        self.assertIn(
+            "python3 -m unittest discover -s tests -v",
+            workflow,
+        )
+        for forbidden in (
+            "actions/checkout@v",
+            "apt ",
+            "pip ",
+            "curl ",
+            "wget ",
+            "docker pull",
+        ):
+            self.assertNotIn(forbidden, workflow)
+
+
+if __name__ == "__main__":
+    unittest.main()