test(ci): check each iOS checkout step's ref instead of a count

tests/test_ios_workflow_dispatch_ref.py

@@ -21,7 +21,10 @@
 def job_block(name: str) -> str:
     text = WORKFLOW.read_text(encoding="utf-8")
     marker = f"  {name}:\n"
-    start = text.index(marker)
+    found = re.search(rf"(?m)^  {re.escape(name)}:\n", text)
+    if found is None:
+        raise ValueError(f"no job {name!r} in {WORKFLOW}")
+    start = found.start()
     match = re.search(r"(?m)^  [A-Za-z0-9_-]+:\n", text[start + len(marker) :])
     if match is None:
         return text[start:]
@@ -110,18 +113,32 @@ def test_manual_ref_is_resolved_once_to_a_full_commit_sha(self) -> None:
 
     def test_paid_and_downstream_jobs_checkout_only_the_resolved_sha(self) -> None:
         workflow = WORKFLOW.read_text(encoding="utf-8")
-        resolved_ref = "ref: ${{ needs.detect-ios-changes.outputs.target_sha }}"
+        resolved_sha = "${{ needs.detect-ios-changes.outputs.target_sha }}"
+        resolved_ref = f"ref: {resolved_sha}"
 
         self.assertNotIn("ref: ${{ inputs.ref || github.ref", workflow)
         for job in ("package-conventions-lint", "mobile-core-package", "ios-simulator-build", "ios-simulator"):
             with self.subTest(job=job):
                 self.assertIn(resolved_ref, job_block(job))
 
-        # The routing job checks out the workflow revision itself; every other
-        # checkout is pinned to the one resolved 40-character commit SHA. The
-        # two jobs that restore the git object seed (#14669) also retry their
-        # checkout without it, at the same SHA.
-        self.assertEqual(workflow.count(resolved_ref), 6)
+        # The routing jobs check out the workflow revision itself; every other
+        # checkout, including the retry after a failed seeded checkout, is
+        # pinned to the one resolved commit SHA.
+        routing = {"runner", "detect-ios-changes"}
+        jobs = yaml.safe_load(workflow)["jobs"]
+        pinned = 0
+        for name, job in jobs.items():
+            for index, step in enumerate(job.get("steps", [])):
+                if not str(step.get("uses", "")).startswith("actions/checkout@"):
+                    continue
+                ref = (step.get("with") or {}).get("ref")
+                with self.subTest(job=name, step=index):
+                    if name in routing:
+                        self.assertNotEqual(ref, resolved_sha)
+                    else:
+                        self.assertEqual(ref, resolved_sha)
+                        pinned += 1
+        self.assertGreaterEqual(pinned, 4)
 
 
 def job_admitted(jobs, name, results, outputs, inputs, *, cancelled=False):