test: align source contracts with modular workbench

backend/tests/test_rc6_supply_chain.py

@@ -35,9 +35,9 @@ def test_lock_generator_uses_pinned_linux_runtime_and_verifies_policy() -> None:
 
 
 def test_ci_runs_complete_release_and_supply_chain_gates() -> None:
-    for workflow_path, context in (
-        (".github/workflows/release-gates.yml", "github.sha"),
-        (".gitea/workflows/release-gates.yml", "gitea.sha"),
+    for workflow_path, context, upload_artifact_action in (
+        (".github/workflows/release-gates.yml", "github.sha", "actions/upload-artifact@v4"),
+        (".gitea/workflows/release-gates.yml", "gitea.sha", "actions/upload-artifact@v3.2.2-node20"),
     ):
         workflow = read(workflow_path)
         assert "backend/requirements-ci.lock" in workflow
@@ -51,7 +51,7 @@ def test_ci_runs_complete_release_and_supply_chain_gates() -> None:
         assert "GEOINTEL_INSTALL_AI=false" in workflow
         assert "generate_container_sbom.sh" in workflow
         assert "scan_container_image.sh" in workflow
-        assert "actions/upload-artifact@v4" in workflow
+        assert upload_artifact_action in workflow
         assert context in workflow
 
 
@@ -65,7 +65,9 @@ def test_scanner_images_are_versioned_and_digest_pinned() -> None:
     assert "--ignore-unfixed" in scan
     assert "--timeout 20m" in scan
     assert "--scanners vuln" in scan
-    assert '-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro"' in scan
+    assert 'WORKSPACE_ARGS=(-v "$ROOT:/workspace")' in scan
+    assert 'WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")' in scan
+    assert '"${WORKSPACE_ARGS[@]}"' in scan
     assert '--ignorefile "$CONTAINER_IGNORE_FILE"' in scan
     assert "--skip-files /usr/local/bin/gosu" in scan
     assert "final filesystem replaces it with the audited setpriv shell wrapper" in scan