ci: make image input refreshes deterministic

.gitea/workflows/refresh-image-locks.yml

@@ -16,7 +16,7 @@ on:
       - '.gitea/workflows/refresh-image-locks.yml'
 
 permissions:
-  code: write
+  code: read
 
 jobs:
   refresh:
@@ -25,9 +25,19 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Use the image Python version
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12.13'
+
+      - name: Use the image Node version
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.23.1'
+
       - name: Compile gateway Python lock
         run: |
-          python3 -m pip install --break-system-packages pip-tools==7.5.1
+          python3 -m pip install pip-tools==7.5.1
           python3 -m piptools compile \
             --generate-hashes \
             --output-file requirements.gateway.lock \
@@ -59,24 +69,6 @@ jobs:
             sha256sum install.sh > install.sh.sha256
           )
 
-      - name: Commit refreshed inputs on feature branches
-        run: |
-          if [ "${{ gitea.ref_name }}" = "main" ]; then
-            exit 0
-          fi
-          git config user.name "Gitea Actions"
-          git config user.email "actions@noreply.gitea.dideric.is"
-          git add \
-            requirements.gateway.lock \
-            bot_bottle/contrib/claude/package-lock.json \
-            bot_bottle/contrib/pi/package-lock.json \
-            bot_bottle/contrib/codex/install.sh.sha256
-          if git diff --cached --quiet; then
-            exit 0
-          fi
-          git commit -m "build: refresh image input locks"
-          git push origin "HEAD:${{ gitea.ref_name }}"
-
       - name: Upload refreshed inputs
         uses: actions/upload-artifact@v3
         with:

bot_bottle/contrib/pi/package-lock.json

@@ -1047,6 +1047,7 @@
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-agent-core": {
       "version": "0.81.1",
       "resolved": "https://registry.npmjs.org/@earendil-works/pi-agent-core/-/pi-agent-core-0.81.1.tgz",
+      "integrity": "sha512-yqbh68CyhqxMov/jUogFJfMqlu2Gd37GAki+tr59YCmAPHfomiCA5ESzusXtpGzABeiZFC/OrRdQ4GwCCOMIHA==",
       "license": "MIT",
       "dependencies": {
         "@earendil-works/pi-ai": "^0.81.1",
@@ -1056,12 +1057,12 @@
       },
       "engines": {
         "node": ">=22.19.0"
-      },
-      "integrity": "sha512-yqbh68CyhqxMov/jUogFJfMqlu2Gd37GAki+tr59YCmAPHfomiCA5ESzusXtpGzABeiZFC/OrRdQ4GwCCOMIHA=="
+      }
     },
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-ai": {
       "version": "0.81.1",
       "resolved": "https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-0.81.1.tgz",
+      "integrity": "sha512-hzHE7Z8l5mgJk+ke67Lge0rwS2+wbKJrFKl9o5M1R1rh33+cCT7D1AHz1OAtX5wFs90E1/BTGhyJRTUHaMxGvQ==",
       "license": "MIT",
       "dependencies": {
         "@anthropic-ai/sdk": "0.91.1",
@@ -1081,12 +1082,12 @@
       },
       "engines": {
         "node": ">=22.19.0"
-      },
-      "integrity": "sha512-hzHE7Z8l5mgJk+ke67Lge0rwS2+wbKJrFKl9o5M1R1rh33+cCT7D1AHz1OAtX5wFs90E1/BTGhyJRTUHaMxGvQ=="
+      }
     },
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-tui": {
       "version": "0.81.1",
       "resolved": "https://registry.npmjs.org/@earendil-works/pi-tui/-/pi-tui-0.81.1.tgz",
+      "integrity": "sha512-OMEe+Zt8oQYi/rCq3upxsTlIScWL0FPhXwQus34TbQb3EmTx88S7Uzx32JxvQiEeWOw8eDCdJf2PBUBE9r6wIg==",
       "license": "MIT",
       "dependencies": {
         "get-east-asian-width": "1.6.0",
@@ -1094,8 +1095,7 @@
       },
       "engines": {
         "node": ">=22.19.0"
-      },
-      "integrity": "sha512-OMEe+Zt8oQYi/rCq3upxsTlIScWL0FPhXwQus34TbQb3EmTx88S7Uzx32JxvQiEeWOw8eDCdJf2PBUBE9r6wIg=="
+      }
     },
     "node_modules/@earendil-works/pi-coding-agent/node_modules/@google/genai": {
       "version": "1.52.0",

docs/image-build-inputs.md

@@ -35,11 +35,12 @@ dependency update:
    versions in the provider's `package.json`, or `CODEX_VERSION` in the Codex
    Dockerfile. Direct versions must be exact—no ranges, dist-tags, or
    unversioned package names.
-4. Push the feature branch. The `refresh-image-locks` workflow regenerates the
-   pip/npm locks and Codex installer checksum, then adds a
-   `build: refresh image input locks` commit to that branch. It can also be run
-   manually; on `main` it uploads the candidates without committing them.
-5. Review the lock diff and let both normal CI and `image-input-builds` pass.
+4. Push the feature branch or manually run the `refresh-image-locks` workflow.
+   It regenerates the four derived files with the image's exact Python and Node
+   versions and uploads them as the `image-input-locks` artifact. It never
+   writes to the branch, so a refresh cannot race with developer pushes.
+5. Download the artifact, replace the four committed files, review the lock
+   diff, and let both normal CI and `image-input-builds` pass.
    The latter checks both base architectures, builds every supported image,
    exercises the exact local Firecracker base-ID handoff, and runs each
    provider CLI's version smoke test.