feat(ci): Build using locked versions

.github/workflows/release.yaml

@@ -104,3 +104,4 @@ jobs:
             VERSION=${{ fromJSON(steps.metadata.outputs.json).labels['org.opencontainers.image.version'] || 'unknown' }}
             COMMIT=${{ fromJSON(steps.metadata.outputs.json).labels['org.opencontainers.image.revision'] }}
             BUILD_TIMESTAMP=${{ fromJSON(steps.metadata.outputs.json).labels['org.opencontainers.image.created'] }}
+            CARGO_INSTALL_EXTRA_ARGS=--locked

.github/workflows/test.yaml

@@ -141,7 +141,7 @@ jobs:
       - name: Build image
         # NOTE: We need to build in debug mode because we need to use
         #   `debug_only` configuration during integration tests.
-        run: task build-image -- --profile=dev
+        run: task build-image -- --profile=dev --locked
 
       - name: Install SQLite3
         run: sudo apt-get update && sudo apt-get install -y sqlite3

local-run/scripts/build-images

@@ -15,7 +15,7 @@ test-env-vars 'tutorials/run-locally.md' \
 	PROSE_POD_API_DIR
 
 # Build the Prose Pod API image.
-edo task build-image -- --profile=dev
+edo task build-image -- --profile=dev --locked
 
 if [ -n "${PROSE_POD_SERVER_DIR}" ] && [ -d "${PROSE_POD_SERVER_DIR:?}" ]; then
 	# Build the Prose Pod Server image.

scripts/build-image

@@ -45,9 +45,14 @@ $(format_title 'Options:')
     $(format_flag --profile=CARGO_PROFILE)
       Choose which Cargo profile to use when building the Prose Pod API.
       $(format_secondary "Note: $(format_code '--profile=dev') enables $(format_code 'debug_only') configuration.")
+    $(format_flag --locked)
+      Build with locked versions (specified in $(format_code 'Cargo.lock')).
+      $(format_secondary "Ensures no dependency gets silently updated and breaks builds.")
     $(format_flag --no-pull)
       Do not pull referenced Docker images.
       $(format_secondary "Speeds up the builds and does not use the network, but does not update base images.")
+    $(format_flag --offline)
+      Build without accessing the network (implies $(format_flag --no-pull)).
 
   $(format_subtitle 'Miscellaneous options:')
     $(format_flag --help)
@@ -96,6 +101,10 @@ for arg in "$@"; do
 			info 'Will not pull referenced Docker images.'
 			NO_PULL=1
 			;;
+		--locked)
+			info 'Will build with locked versions.'
+			CARGO_INSTALL_EXTRA_ARGS+=('--locked')
+			;;
 		--no-pull)
 			info 'Will not pull referenced Docker images.'
 			NO_PULL=1