deploy: pin nas-deploy image by digest

Reviewed-on: #156

.gitea/workflows/anno-apply-pr.yml

@@ -22,7 +22,8 @@ concurrency:
 
 jobs:
   apply-approved:
-    runs-on: mac-ci    container:
+    runs-on: mac-ci
+    container:
       image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
 
     steps:

.gitea/workflows/anno-reject.yml

@@ -22,7 +22,8 @@ concurrency:
 
 jobs:
   reject:
-    runs-on: mac-ci    container:
+    runs-on: mac-ci
+    container:
       image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
 
     steps:

.gitea/workflows/auto-label-issues.yml

@@ -6,7 +6,8 @@ on:
 
 jobs:
   label:
-    runs-on: mac-ci    steps:
+    runs-on: mac-ci
+    steps:
       - name: Apply labels from Type/State/Category
         env:
           FORGE_BASE: ${{ vars.FORGE_API || vars.FORGE_BASE }}

.gitea/workflows/ci.yaml

@@ -15,7 +15,8 @@ defaults:
 
 jobs:
   build-and-anchors:
-    runs-on: mac-ci    container:
+    runs-on: mac-ci
+    container:
       image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
 
     steps:

.gitea/workflows/deploy-staging-live.yml

@@ -26,9 +26,9 @@ concurrency:
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: nas-deploy
     container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
+      image: localhost:5000/archicratie/nas-deploy-node22@sha256:fefa8bb307005cebec07796661ab25528dc319c33a8f1e480e1d66f90cd5cff6
 
     steps:
       - name: Tools sanity
@@ -127,25 +127,17 @@ jobs:
             echo "ℹ️ no annotations/media change -> skip deploy"
           fi
 
-      - name: Install docker client + docker compose plugin (v2) + python yaml
+      - name: Toolchain sanity + resolve COMPOSE_PROJECT_NAME
         run: |
           set -euo pipefail
           source /tmp/deploy.env
           [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
 
-          apt-get -o Acquire::Retries=5 -o Acquire::ForceIPv4=true update
-          apt-get install -y --no-install-recommends ca-certificates curl docker.io python3 python3-yaml
-          rm -rf /var/lib/apt/lists/*
-
-          mkdir -p /usr/local/lib/docker/cli-plugins
-          curl -fsSL \
-            "https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-x86_64" \
-            -o /usr/local/lib/docker/cli-plugins/docker-compose
-          chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
-
+          # tools are prebaked in the image
+          git --version
           docker version
           docker compose version
-          python3 --version
+          python3 -c 'import yaml; print("PyYAML OK")'
 
           # Reuse existing compose project name if containers already exist
           PROJ="$(docker inspect archicratie-web-blue --format '{{ index .Config.Labels "com.docker.compose.project" }}' 2>/dev/null || true)"

.gitea/workflows/smoke.yml

@@ -3,6 +3,7 @@ on: [push, workflow_dispatch]
 
 jobs:
   smoke:
-    runs-on: mac-ci    steps:
+    runs-on: mac-ci
+    steps:
       - run: node -v && npm -v
       - run: echo "runner OK"