fix(ci): validate image digests and isolate test outputs

tests/test_ci_output_isolation.py

@@ -5,11 +5,34 @@ import subprocess
 import sys
 import tempfile
 from pathlib import Path
+from unittest.mock import patch
 
-from ci_test_case import IsolatedCITestCase
+from ci_test_case import CI_COMMAND_FILES, IsolatedCITestCase
 
 
 class CIOutputIsolationTests(IsolatedCITestCase):
+    def test_all_command_files_are_private_and_environment_is_restored(self):
+        with tempfile.TemporaryDirectory() as scratch:
+            external = {variable: str(Path(scratch) / variable) for variable in CI_COMMAND_FILES}
+            for path in external.values():
+                Path(path).write_text('external CI file\n')
+            with patch.dict(os.environ, external):
+                probe = IsolatedCITestCase()
+                probe.setUp()
+                private = []
+                try:
+                    for variable in CI_COMMAND_FILES:
+                        self.assertNotEqual(os.environ[variable], external[variable])
+                        path = Path(os.environ[variable])
+                        private.append(path)
+                        path.write_text('test-only command\n')
+                finally:
+                    probe.doCleanups()
+                for variable in CI_COMMAND_FILES:
+                    self.assertEqual(os.environ[variable], external[variable])
+                    self.assertEqual(Path(external[variable]).read_text(), 'external CI file\n')
+                self.assertTrue(all(not path.exists() for path in private))
+
     def test_unit_suite_preserves_external_ci_files(self):
         tests = Path(__file__).resolve().parent
         modules = sorted(p.stem for p in tests.glob('test_*.py') if p.name != Path(__file__).name)
@@ -17,7 +40,7 @@ class CIOutputIsolationTests(IsolatedCITestCase):
             environment = os.environ.copy()
             environment['PYTHONPATH'] = str(tests) + os.pathsep + environment.get('PYTHONPATH', '')
             expected = {}
-            for variable in ('GITHUB_STEP_SUMMARY', 'GITHUB_OUTPUT'):
+            for variable in CI_COMMAND_FILES:
                 path = Path(scratch) / variable
                 content = f'external {variable}\n'
                 path.write_text(content)