[build] add test to prevent updating pinned chrome version before cdp

common/BUILD.bazel

diff --git a/common/BUILD.bazel b/common/BUILD.bazel
index f267704..068f7e7 100644
--- a/common/BUILD.bazel
+++ b/common/BUILD.bazel
@@ -2,6 +2,8 @@
 
 package(default_visibility = ["//visibility:public"])
 
+exports_files(["repositories.bzl"])
+
 bool_flag(
     name = "pin_browsers",
     build_setting_default = True,

java/src/org/openqa/selenium/devtools/BUILD.bazel

diff --git a/java/src/org/openqa/selenium/devtools/BUILD.bazel b/java/src/org/openqa/selenium/devtools/BUILD.bazel
index 5390e18..d929b84 100644
--- a/java/src/org/openqa/selenium/devtools/BUILD.bazel
+++ b/java/src/org/openqa/selenium/devtools/BUILD.bazel
@@ -1,6 +1,8 @@
 load("//common:defs.bzl", "copy_file")
 load("//java:defs.bzl", "artifact", "java_binary", "java_library")
 
+exports_files(["versions.bzl"])
+
 GENERATOR_SOURCES = [
     "CdpClientGenerator.java",
 ]

scripts/BUILD.bazel

diff --git a/scripts/BUILD.bazel b/scripts/BUILD.bazel
index 670d27e..5156f6e 100644
--- a/scripts/BUILD.bazel
+++ b/scripts/BUILD.bazel
@@ -1,5 +1,5 @@
 load("@py_dev_requirements//:requirements.bzl", "requirement")
-load("@rules_python//python:defs.bzl", "py_binary")
+load("@rules_python//python:defs.bzl", "py_binary", "py_test")
 load("//java:defs.bzl", "artifact", "java_binary")
 
 py_binary(
@@ -11,6 +11,15 @@
     ],
 )
 
+py_test(
+    name = "pinned_browsers_test",
+    srcs = ["pinned_browsers_test.py"],
+    data = [
+        "//common:repositories.bzl",
+        "//java/src/org/openqa/selenium/devtools:versions.bzl",
+    ],
+)
+
 py_binary(
     name = "selenium_manager",
     srcs = ["selenium_manager.py"],

scripts/pinned_browsers_test.py

diff --git a/scripts/pinned_browsers_test.py b/scripts/pinned_browsers_test.py
new file mode 100644
index 0000000..eac6e0f
--- /dev/null
+++ b/scripts/pinned_browsers_test.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+
+import re
+from pathlib import Path
+
+root = Path(__file__).resolve().parents[1]
+repositories = (root / "common/repositories.bzl").read_text()
+versions = (root / "java/src/org/openqa/selenium/devtools/versions.bzl").read_text()
+
+chrome_versions = set(
+    re.findall(
+        r'name = "(?:linux|mac)_chrome",\s+url = "[^"]+/(\d+)\.[^"]+/(?:linux64|mac-arm64)/chrome-[^"]+\.zip"',
+        repositories,
+    )
+)
+devtools_versions = set(re.findall(r'"v(\d+)"', versions))
+unmatched_chrome_versions = chrome_versions - devtools_versions
+
+if unmatched_chrome_versions:
+    raise AssertionError(
+        f"Stable pinned Chrome versions {sorted(chrome_versions)} must be present in "
+        "CDP_VERSIONS; found {sorted(devtools_versions)}. "
+    )