From cef2d0553c70cd3a0743ff7a3d11216eb605b477 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Sun, 6 Sep 2026 05:06:18 -0700
Subject: [PATCH] ci: pin WSL kernel installer and participation selectors

---
 .github/actions/setup-wsl-test-runtime/setup.ps1 | 1 +
 config/scripts/wsl-e2e-lane-contract.test.mjs    | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/.github/actions/setup-wsl-test-runtime/setup.ps1 b/.github/actions/setup-wsl-test-runtime/setup.ps1
index 50504ac5007..2fd012eb246 100644
--- a/.github/actions/setup-wsl-test-runtime/setup.ps1
+++ b/.github/actions/setup-wsl-test-runtime/setup.ps1
@@ -15,6 +15,7 @@ wsl.exe --distribution Ubuntu --user root --exec /usr/bin/apt-get install --yes
 if ($LASTEXITCODE -ne 0) { throw "WSL git install failed: $LASTEXITCODE" }
 $kernelMsi = Join-Path $env:RUNNER_TEMP 'wsl_update_x64.msi'
 Invoke-WebRequest 'https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi' -OutFile $kernelMsi
+if ((Get-FileHash $kernelMsi -Algorithm SHA256).Hash.ToLowerInvariant() -ne '4d09c776c8d45f70a202281d18e19be1118f53159b0c217a5274a31ce18525fe') { throw 'WSL kernel installer checksum mismatch' }
 $installer = Start-Process msiexec.exe -ArgumentList @('/i', $kernelMsi, '/quiet', '/norestart') -Wait -PassThru
 if ($installer.ExitCode -ne 0) { throw "WSL kernel installation failed: $($installer.ExitCode)" }
 wsl.exe --status
diff --git a/config/scripts/wsl-e2e-lane-contract.test.mjs b/config/scripts/wsl-e2e-lane-contract.test.mjs
index 929083b5299..aaf40e16b18 100644
--- a/config/scripts/wsl-e2e-lane-contract.test.mjs
+++ b/config/scripts/wsl-e2e-lane-contract.test.mjs
@@ -46,6 +46,9 @@ describe('real WSL terminal lane', () => {
     expect(steps.some((step) => step.uses === './.github/actions/setup-wsl-test-runtime')).toBe(
       true
     )
+    const exercise = steps.find((step) => step.name === 'Exercise real WSL launch and paste')
+    expect(exercise.run).toContain('--repeat-each=3')
+    expect(exercise.run).toContain('--grep "WSL"')
     const receipt = steps.find((step) => step.name === 'Require all nine WSL executions')
     expect(receipt.if).toBe('always()')
     expect(receipt.run).toBe(