Merge pull request #313 from pikasTech/fix/dev-cd-target-sha-274

fix: pin DEV CD refresh target

scripts/src/dev-cd-apply.mjs

@@ -1281,7 +1281,7 @@ export async function runDevCdApply(argv, io = {}) {
         args: [
           "scripts/refresh-artifact-catalog.mjs",
           "--target-ref",
-          target.ref,
+          target.commitId,
           "--publish-report",
           artifactReportPath
         ],

scripts/src/dev-cd-apply.test.mjs

@@ -346,8 +346,10 @@ test("transaction runs phases, allows internal side-effect env, releases lock, a
 
   const publishCall = commandLog.find((entry) => entry.args.includes("scripts/dev-artifact-publish.mjs"));
   const applyCall = commandLog.find((entry) => entry.args.includes("scripts/dev-deploy-apply.mjs"));
+  const refreshCall = commandLog.find((entry) => entry.args.includes("scripts/refresh-artifact-catalog.mjs"));
   assert.ok(publishCall?.env.HWLAB_CD_TRANSACTION_ID);
   assert.equal(applyCall?.env.HWLAB_CD_TRANSACTION_ID, publishCall.env.HWLAB_CD_TRANSACTION_ID);
+  assert.equal(refreshCall.args[refreshCall.args.indexOf("--target-ref") + 1], "abc1234abc1234abc1234abc1234abc1234abc1");
 
   const writtenReport = JSON.parse(await readFile(path.join(repoRoot, "reports/dev-gate/dev-cd-apply.json"), "utf8"));
   assert.equal(writtenReport.devCdApply.liveVerify.summary.checked, 2);