From 038b60f97f8f8424a75a59bef837e3e5edfadaab Mon Sep 17 00:00:00 2001
From: myrmidex <myrmidex@myrmidex.net>
Date: Sat, 15 Aug 2026 01:31:14 +0200
Subject: [PATCH] 147 - Pin the CI image to a version tag instead of latest

---
 .forgejo/workflows/ci.yml     | 2 +-
 .forgejo/workflows/images.yml | 3 +++
 docker/build/Dockerfile.ci    | 4 ++++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 85f3f27e..a99a86a9 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
   ci:
     runs-on: docker
     container:
-      image: forge.lvl0.xyz/lvl0/fedi-feed-router-ci:latest
+      image: forge.lvl0.xyz/lvl0/fedi-feed-router-ci:php8.3-1
     steps:
       - uses: https://data.forgejo.org/actions/checkout@v4
 
diff --git a/.forgejo/workflows/images.yml b/.forgejo/workflows/images.yml
index 2bdd4009..643e7528 100644
--- a/.forgejo/workflows/images.yml
+++ b/.forgejo/workflows/images.yml
@@ -18,8 +18,10 @@ jobs:
         include:
           - name: fedi-feed-router-base
             file: docker/build/Dockerfile.base
+            version: php8.3-1
           - name: fedi-feed-router-ci
             file: docker/build/Dockerfile.ci
+            version: php8.3-1
     steps:
       - uses: https://data.forgejo.org/actions/checkout@v4
 
@@ -40,5 +42,6 @@ jobs:
           file: ${{ matrix.file }}
           push: true
           tags: |
+            forge.lvl0.xyz/lvl0/${{ matrix.name }}:${{ matrix.version }}
             forge.lvl0.xyz/lvl0/${{ matrix.name }}:latest
             forge.lvl0.xyz/lvl0/${{ matrix.name }}:${{ github.sha }}
diff --git a/docker/build/Dockerfile.ci b/docker/build/Dockerfile.ci
index b63abaf4..d63a4c1c 100644
--- a/docker/build/Dockerfile.ci
+++ b/docker/build/Dockerfile.ci
@@ -2,6 +2,10 @@
 # Tests run against sqlite in memory (see .env.testing), so no database client
 # or cache extension is needed.
 #
+# Published as fedi-feed-router-ci:php<version>-<revision>, not :latest. Runners
+# cache mutable tags and will not re-pull them, so bump the revision in the tag
+# and in ci.yml whenever this file changes.
+#
 # php:alpine already bundles the rest of what composer.lock requires. gd is not
 # declared anywhere but ThumbnailUploader calls it directly.
 FROM php:8.3-alpine