From 3b08826752bc847908d2e754054f1b32d67d8038 Mon Sep 17 00:00:00 2001
From: Jesse_Chen <chen.yue@mevixaga.com>
Date: Wed, 5 Aug 2026 17:33:55 +0800
Subject: [PATCH] Run pinned Node integration tests on host

---
 .gitea/workflows/backend-quality-gate.yml     | 33 +++++++++++++++++--
 .../tests/staging-backend-workflows.test.ts   | 16 +++++----
 2 files changed, 41 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/backend-quality-gate.yml b/.gitea/workflows/backend-quality-gate.yml
index 454cd12a..e8f757fa 100644
--- a/.gitea/workflows/backend-quality-gate.yml
+++ b/.gitea/workflows/backend-quality-gate.yml
@@ -83,10 +83,39 @@ jobs:
           docker compose version --short | grep -Eq '^v?2\.'
           docker compose --help | grep -q -- '--project-name'
 
-      - name: Verify runner Node tooling
+      - name: Prepare pinned Node tooling
+        env:
+          NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
+          NODE_TOOL_IMAGE: node:22-bookworm-slim
         run: |
           set -euo pipefail
-          node --version
+          if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
+            for attempt in 1 2 3; do
+              if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then
+                break
+              fi
+              if [ "$attempt" -eq 3 ]; then
+                echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2
+                exit 1
+              fi
+              sleep $((attempt * 15))
+            done
+          fi
+          docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE"
+          docker image inspect "$NODE_TOOL_IMAGE" >/dev/null
+          tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")"
+          container_id="$(docker create "$NODE_TOOL_IMAGE")"
+          trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
+          docker cp "$container_id:/usr/local/bin/node" "$tool_dir/node"
+          docker cp "$container_id:/usr/local/lib/node_modules/npm" "$tool_dir/npm-package"
+          docker rm "$container_id" >/dev/null
+          trap - EXIT
+          ln -s "$tool_dir/npm-package/bin/npm-cli.js" "$tool_dir/npm"
+          chmod 0755 "$tool_dir/node" "$tool_dir/npm-package/bin/npm-cli.js"
+          test -n "${GITHUB_PATH:-}"
+          printf '%s\n' "$tool_dir" >> "$GITHUB_PATH"
+          export PATH="$tool_dir:$PATH"
+          node --version | grep -Eq '^v22\.'
           npm --version
 
       - name: Preload PostgreSQL integration image
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index 292b7aa2..361d85ad 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -151,18 +151,22 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /command -v rsync[\s\S]*packages\+=\(rsync\)/);
   assert.match(workflow, /apt-get install -y --no-install-recommends[\s\S]*"\$\{packages\[@\]\}"/);
   assert.doesNotMatch(workflow, /packages\+=\((?:nodejs|npm)\)|apt-get install[^\n]*(?:nodejs|npm)/);
-  assert.equal((workflow.match(/NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c/g) ?? []).length, 1);
-  assert.equal((workflow.match(/NODE_TOOL_IMAGE: node:22-bookworm-slim/g) ?? []).length, 1);
-  assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 1);
-  assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 1);
+  assert.equal((workflow.match(/NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c/g) ?? []).length, 2);
+  assert.equal((workflow.match(/NODE_TOOL_IMAGE: node:22-bookworm-slim/g) ?? []).length, 2);
+  assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 2);
   assert.equal((workflow.match(/cat > "\$tool_dir\/node" <<'EOF'/g) ?? []).length, 1);
   assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 1);
   assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 1);
   assert.equal((workflow.match(/ln -s node "\$tool_dir\/npm"/g) ?? []).length, 1);
-  assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 1);
+  assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 2);
   assert.match(workflow, /node:22-bookworm-slim "\$\{0##\*\/\}" "\$@"/);
   assert.doesNotMatch(workflow, /(?:--volume|-v)[^\n]*(?:\$HOME\/\.docker|DOCKER_CONFIG)/);
-  assert.match(workflow, /name: Verify runner Node tooling[\s\S]*node --version[\s\S]*npm --version/);
+  assert.match(workflow, /docker create "\$NODE_TOOL_IMAGE"/);
+  assert.match(workflow, /docker cp "\$container_id:\/usr\/local\/bin\/node" "\$tool_dir\/node"/);
+  assert.match(workflow, /docker cp "\$container_id:\/usr\/local\/lib\/node_modules\/npm" "\$tool_dir\/npm-package"/);
+  assert.match(workflow, /node --version \| grep -Eq '\^v22\\\.'/);
+  assert.match(workflow, /npm --version/);
   assert.match(workflow, /docker compose version --short/);
   assert.match(workflow, /docker compose --help \| grep -q -- '--project-name'/);
   assert.match(