From 37a59a636a75a250f686d49df3115c310e35a98f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9mi=20Bardon?= <remi@remibardon.name>
Date: Fri, 24 Jan 2025 21:28:10 +0100
Subject: [PATCH] feat(ci): Build using locked versions

---
 .github/workflows/release.yaml | 1 +
 .github/workflows/test.yaml    | 2 +-
 local-run/scripts/build-images | 2 +-
 scripts/build-image            | 9 +++++++++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4974df7b..dc6e570b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -104,3 +104,4 @@ jobs:
             VERSION=${{ fromJSON(steps.metadata.outputs.json).labels['org.opencontainers.image.version'] || 'unknown' }}
             COMMIT=${{ fromJSON(steps.metadata.outputs.json).labels['org.opencontainers.image.revision'] }}
             BUILD_TIMESTAMP=${{ fromJSON(steps.metadata.outputs.json).labels['org.opencontainers.image.created'] }}
+            CARGO_INSTALL_EXTRA_ARGS=--locked
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index e03a0a82..20ef57b1 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -141,7 +141,7 @@ jobs:
       - name: Build image
         # NOTE: We need to build in debug mode because we need to use
         #   `debug_only` configuration during integration tests.
-        run: task build-image -- --profile=dev
+        run: task build-image -- --profile=dev --locked
 
       - name: Install SQLite3
         run: sudo apt-get update && sudo apt-get install -y sqlite3
diff --git a/local-run/scripts/build-images b/local-run/scripts/build-images
index ec25e34a..e21a0783 100755
--- a/local-run/scripts/build-images
+++ b/local-run/scripts/build-images
@@ -15,7 +15,7 @@ test-env-vars 'tutorials/run-locally.md' \
 	PROSE_POD_API_DIR
 
 # Build the Prose Pod API image.
-edo task build-image -- --profile=dev
+edo task build-image -- --profile=dev --locked
 
 if [ -n "${PROSE_POD_SERVER_DIR}" ] && [ -d "${PROSE_POD_SERVER_DIR:?}" ]; then
 	# Build the Prose Pod Server image.
diff --git a/scripts/build-image b/scripts/build-image
index 201ce818..cdbdbdab 100755
--- a/scripts/build-image
+++ b/scripts/build-image
@@ -45,9 +45,14 @@ $(format_title 'Options:')
     $(format_flag --profile=CARGO_PROFILE)
       Choose which Cargo profile to use when building the Prose Pod API.
       $(format_secondary "Note: $(format_code '--profile=dev') enables $(format_code 'debug_only') configuration.")
+    $(format_flag --locked)
+      Build with locked versions (specified in $(format_code 'Cargo.lock')).
+      $(format_secondary "Ensures no dependency gets silently updated and breaks builds.")
     $(format_flag --no-pull)
       Do not pull referenced Docker images.
       $(format_secondary "Speeds up the builds and does not use the network, but does not update base images.")
+    $(format_flag --offline)
+      Build without accessing the network (implies $(format_flag --no-pull)).
 
   $(format_subtitle 'Miscellaneous options:')
     $(format_flag --help)
@@ -96,6 +101,10 @@ for arg in "$@"; do
 			info 'Will not pull referenced Docker images.'
 			NO_PULL=1
 			;;
+		--locked)
+			info 'Will build with locked versions.'
+			CARGO_INSTALL_EXTRA_ARGS+=('--locked')
+			;;
 		--no-pull)
 			info 'Will not pull referenced Docker images.'
 			NO_PULL=1