Add SOURCE_REF and CI check for tuple bookkeeping

Fail CI when HEAD diverges from SOURCE_REF so spec pins/matrix
can record the SDK commit in the ecosystem tuple.

Author: Nathan Gillett

.github/workflows/ci.yml

@@ -41,6 +41,9 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Verify SOURCE_REF matches this commit
+        run: bash scripts/check-source-ref.sh
+
       - name: go build
         run: go build ./...
 

SOURCE_REF

@@ -0,0 +1 @@
+4ef01d2cc3d3dfc8f531d97b8cdae67adfe3a68e

scripts/check-source-ref.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Fail when SOURCE_REF does not match the current commit (tuple bookkeeping).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+if [[ ! -f SOURCE_REF ]]; then
+  echo "Missing SOURCE_REF in repository root" >&2
+  exit 2
+fi
+
+HEAD="$(git rev-parse HEAD)"
+REF="$(tr -d '[:space:]' < SOURCE_REF)"
+if ! echo "$REF" | grep -qE '^[0-9a-f]{40}$'; then
+  echo "Invalid SOURCE_REF: must be a 40-character lowercase git SHA" >&2
+  exit 1
+fi
+
+if [[ "$HEAD" != "$REF" ]]; then
+  echo "FAIL: SOURCE_REF ($REF) does not match HEAD ($HEAD)" >&2
+  echo "Update SOURCE_REF and bump spec matrix/pins after merging SDK changes." >&2
+  exit 1
+fi
+
+echo "PASS: SOURCE_REF matches HEAD ($HEAD)."