Run Node tooling in a pinned CI container

.gitea/workflows/backend-quality-gate.yml

@@ -50,27 +50,80 @@ jobs:
       - name: Install and verify Linux runner toolchain
         run: |
           set -euo pipefail
-          packages=()
-          command -v node >/dev/null || packages+=(nodejs)
-          command -v npm >/dev/null || packages+=(npm)
           if ! docker compose version --short 2>/dev/null | grep -Eq '^v?2\.'; then
-            packages+=(docker-compose-v2)
-          fi
-          if ((${#packages[@]})); then
             apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 \
               -o Acquire::https::Timeout=30 update
             DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-              "${packages[@]}"
+              docker-compose-v2
           fi
           python3 --version
-          node --version
-          npm --version
           curl --version
+          git --version
+          openssl version
           docker version
           docker compose version
           docker compose version --short | grep -Eq '^v?2\.'
           docker compose --help | grep -q -- '--project-name'
 
+      - name: Prepare pinned Node tooling
+        env:
+          NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
+          NODE_TOOL_IMAGE: node:22-bookworm-slim
+        run: |
+          set -euo pipefail
+          if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
+            for attempt in 1 2 3; do
+              if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then
+                break
+              fi
+              if [ "$attempt" -eq 3 ]; then
+                echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2
+                exit 1
+              fi
+              sleep $((attempt * 15))
+            done
+          fi
+          docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE"
+          docker image inspect "$NODE_TOOL_IMAGE" >/dev/null
+          tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")"
+          cat > "$tool_dir/node" <<'EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
+          workdir="$(pwd -P)"
+          docker_args=(
+            run --rm --network host
+            --user "$(id -u):$(id -g)"
+            --group-add "$(stat -c %g /var/run/docker.sock)"
+            --volume "$workdir:$workdir"
+            --volume /tmp:/tmp
+            --volume /var/run/docker.sock:/var/run/docker.sock
+            --workdir "$workdir"
+            --env HOME=/tmp
+            --env "npm_config_cache=/tmp/jyotisha-npm-cache-${GITEA_SHA:-local}"
+            --env "DOCKER_CONFIG=/tmp/jyotisha-docker-config-${GITEA_SHA:-local}"
+          )
+          for command_name in docker git openssl; do
+            command_path="$(command -v "$command_name")"
+            docker_args+=(--volume "$command_path:/usr/local/bin/$command_name:ro")
+          done
+          while read -r library; do
+            [ -f "$library" ] && docker_args+=(--volume "$library:$library:ro")
+          done < <(ldd "$(command -v openssl)" | awk '/lib(ssl|crypto)\.so/ { print $3 }')
+          for compose_plugin in \
+            /usr/libexec/docker/cli-plugins/docker-compose \
+            /usr/lib/docker/cli-plugins/docker-compose; do
+            [ -x "$compose_plugin" ] && docker_args+=(--volume "$compose_plugin:$compose_plugin:ro")
+          done
+          exec docker "${docker_args[@]}" node:22-bookworm-slim "${0##*/}" "$@"
+          EOF
+          chmod 0755 "$tool_dir/node"
+          ln -s node "$tool_dir/npm"
+          test -n "${GITHUB_PATH:-}"
+          printf '%s\n' "$tool_dir" >> "$GITHUB_PATH"
+          export PATH="$tool_dir:$PATH"
+          node --version
+          npm --version
+
       - name: Preload PostgreSQL integration image
         env:
           POSTGRES_TEST_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/postgres:17-alpine
@@ -143,6 +196,46 @@ jobs:
           test "$(git rev-parse HEAD)" = "$GITEA_SHA"
           test -z "$(git status --porcelain --untracked-files=all)"
 
+      - name: Prepare pinned Node tooling
+        env:
+          NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
+          NODE_TOOL_IMAGE: node:22-bookworm-slim
+        run: |
+          set -euo pipefail
+          if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
+            for attempt in 1 2 3; do
+              if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then
+                break
+              fi
+              if [ "$attempt" -eq 3 ]; then
+                echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2
+                exit 1
+              fi
+              sleep $((attempt * 15))
+            done
+          fi
+          docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE"
+          docker image inspect "$NODE_TOOL_IMAGE" >/dev/null
+          tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")"
+          cat > "$tool_dir/node" <<'EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
+          workdir="$(pwd -P)"
+          exec docker run --rm \
+            --user "$(id -u):$(id -g)" \
+            --volume "$workdir:$workdir" \
+            --workdir "$workdir" \
+            --env HOME=/tmp \
+            node:22-bookworm-slim "${0##*/}" "$@"
+          EOF
+          chmod 0755 "$tool_dir/node"
+          ln -s node "$tool_dir/npm"
+          test -n "${GITHUB_PATH:-}"
+          printf '%s\n' "$tool_dir" >> "$GITHUB_PATH"
+          export PATH="$tool_dir:$PATH"
+          node --version
+          npm --version
+
       - name: Build and publish exact-SHA ACR images
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}

frontend/tests/staging-backend-workflows.test.ts

@@ -131,11 +131,22 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.equal((workflow.match(/git status --porcelain --untracked-files=all/g) ?? []).length, 2);
   assert.match(workflow, /python3 -m venv \.venv/);
   assert.match(workflow, /python -m playwright install --with-deps chromium/);
-  assert.match(workflow, /command -v node[^\n]+\|\| packages\+=\(nodejs\)/);
-  assert.match(workflow, /command -v npm[^\n]+\|\| packages\+=\(npm\)/);
-  assert.match(workflow, /packages\+=\(docker-compose-v2\)/);
   assert.equal((workflow.match(/Acquire::https::Timeout=30 update/g) ?? []).length, 1);
-  assert.match(workflow, /apt-get install -y --no-install-recommends[\s\S]*"\$\{packages\[@\]\}"/);
+  assert.match(workflow, /apt-get install -y --no-install-recommends[\s\S]*docker-compose-v2/);
+  assert.doesNotMatch(workflow, /packages\+=\((?:nodejs|npm)\)|apt-get install[^\n]*(?:nodejs|npm)/);
+  assert.equal((workflow.match(/NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c/g) ?? []).length, 2);
+  assert.equal((workflow.match(/NODE_TOOL_IMAGE: node:22-bookworm-slim/g) ?? []).length, 2);
+  assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/cat > "\$tool_dir\/node" <<'EOF'/g) ?? []).length, 2);
+  assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/ln -s node "\$tool_dir\/npm"/g) ?? []).length, 2);
+  assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 2);
+  assert.match(workflow, /--volume \/var\/run\/docker\.sock:\/var\/run\/docker\.sock/);
+  assert.match(workflow, /--network host/);
+  assert.match(workflow, /node:22-bookworm-slim "\$\{0##\*\/\}" "\$@"/);
+  assert.doesNotMatch(workflow, /(?:--volume|-v)[^\n]*(?:\$HOME\/\.docker|DOCKER_CONFIG)/);
   assert.match(workflow, /node --version[\s\S]*npm --version/);
   assert.match(workflow, /docker compose version --short/);
   assert.match(workflow, /docker compose --help \| grep -q -- '--project-name'/);