cameri / nostream / 41236831540

78%

push

github

build: pin the node base image in every file that names one (#1009)

## What

`Dockerfile` pinned `node:24.22.1-alpine` by digest in #1005, but four
other files that name a node base image still said `node:24-alpine`:

| file | service / stage |
|---|---|
| `Dockerfile.railwayapp` | Railway build stage + runtime stage |
| `Dockerfile.test` | the CI test image |
| `docker-compose.yml` | `nostream-migrate` |
| `test/integration/docker-compose.yml` | `migrations-test` |

All five now carry the same tag and digest.

## Why it matters

A floating tag means the relay image, the CI image, the Railway image
and both ephemeral migration containers can each start from a different
base, and a release can run different node code than the one before it
without a commit saying so.

## Guard

`test/unit/ci/node-base-pin.spec.ts` collects every `FROM node:…` and
`image: node:…` in the repo and asserts two things: each carries a
digest, and all of them are the *same* reference. That second check is
what #1005 lacked — it pinned `Dockerfile` and left the rest behind, and
nothing noticed.

It also asserts the scan found the expected rows, so a glob that
silently matches nothing cannot make the suite green.

## Verification

- new spec: 3 passing
- reverting `Dockerfile.test` to `node:24-alpine`: fails on both counts
(digest and single reference)
- `test/unit/ci/**`: 26 passing

4383 of 6201 branches covered (70.68%)

Branch coverage included in aggregate %.

9554 of 11817 relevant lines covered (80.85%)

774.88 hits per line