ci: pin release gate to Node 22

.gitea/workflows/release-quality-gate.yml

@@ -9,6 +9,8 @@ jobs:
     timeout-minutes: 45
     env:
       GITEA_SHA: ${{ gitea.sha }}
+      NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
+      NODE_TOOL_IMAGE: node:22-bookworm-slim
     steps:
       - name: Checkout current Gitea revision
         run: |
@@ -18,6 +20,37 @@ jobs:
           git remote add origin https://git.copse.top/root/Jyotisha.git
           git fetch --no-tags origin "$GITEA_SHA"
           git checkout --detach --force "$GITEA_SHA"
+      - name: Prepare pinned Node tooling
+        run: |
+          set -euo pipefail
+          if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
+            for attempt in 1 2 3; do
+              if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then
+                break
+              fi
+              if [ "$attempt" -eq 3 ]; then
+                echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2
+                exit 1
+              fi
+              sleep $((attempt * 15))
+            done
+          fi
+          docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE"
+          docker image inspect "$NODE_TOOL_IMAGE" >/dev/null
+          tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")"
+          container_id="$(docker create "$NODE_TOOL_IMAGE")"
+          trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
+          docker cp "$container_id:/usr/local/bin/node" "$tool_dir/node"
+          docker cp "$container_id:/usr/local/lib/node_modules/npm" "$tool_dir/npm-package"
+          docker rm "$container_id" >/dev/null
+          trap - EXIT
+          ln -s "$tool_dir/npm-package/bin/npm-cli.js" "$tool_dir/npm"
+          chmod 0755 "$tool_dir/node" "$tool_dir/npm-package/bin/npm-cli.js"
+          test -n "${GITHUB_PATH:-}"
+          printf '%s\n' "$tool_dir" >> "$GITHUB_PATH"
+          export PATH="$tool_dir:$PATH"
+          node --version | grep -Eq '^v22\.'
+          npm --version
       - name: Verify runner toolchain
         run: |
           set -euo pipefail

frontend/tests/staging-backend-workflows.test.ts

@@ -884,6 +884,9 @@ test("manual release gate runs where Docker Compose v2 is available", () => {
 
   assert.match(workflow, /^on:\n\s+workflow_dispatch:/m);
   assert.match(workflow, /runs-on: manman-linux/);
+  assert.match(workflow, /NODE_TOOL_SOURCE_IMAGE: .*node:22-bookworm-slim@sha256:[0-9a-f]{64}/);
+  assert.match(workflow, /NODE_TOOL_IMAGE: node:22-bookworm-slim/);
+  assert.match(workflow, /node --version \| grep -Eq '\^v22\\\.'/);
   assert.match(workflow, /docker compose version --short \| grep -Eq '\^v\?2\\\.'/);
   assert.match(workflow, /PIP_INDEX_URL: https:\/\/mirrors\.aliyun\.com\/pypi\/simple\//);
   assert.match(workflow, /NPM_CONFIG_REGISTRY: https:\/\/registry\.npmmirror\.com/);