ci: make image input refreshes deterministic

.gitea/workflows/refresh-image-locks.yml

@@ -16,7 +16,7 @@ on:
       - '.gitea/workflows/refresh-image-locks.yml'
 
 permissions:
-  code: write
+  code: read
 
 jobs:
   refresh:
@@ -25,9 +25,19 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Use the image Python version
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12.13'
+
+      - name: Use the image Node version
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.23.1'
+
       - name: Compile gateway Python lock
         run: |
-          python3 -m pip install --break-system-packages pip-tools==7.5.1
+          python3 -m pip install pip-tools==7.5.1
           python3 -m piptools compile \
             --generate-hashes \
             --output-file requirements.gateway.lock \
@@ -59,24 +69,6 @@ jobs:
             sha256sum install.sh > install.sh.sha256
           )
 
-      - name: Commit refreshed inputs on feature branches
-        run: |
-          if [ "${{ gitea.ref_name }}" = "main" ]; then
-            exit 0
-          fi
-          git config user.name "Gitea Actions"
-          git config user.email "actions@noreply.gitea.dideric.is"
-          git add \
-            requirements.gateway.lock \
-            bot_bottle/contrib/claude/package-lock.json \
-            bot_bottle/contrib/pi/package-lock.json \
-            bot_bottle/contrib/codex/install.sh.sha256
-          if git diff --cached --quiet; then
-            exit 0
-          fi
-          git commit -m "build: refresh image input locks"
-          git push origin "HEAD:${{ gitea.ref_name }}"
-
       - name: Upload refreshed inputs
         uses: actions/upload-artifact@v3
         with: