[#2870, #2871, #2872] Pinned the seed script, 'asciinema' and 'sharp-cli' versions.

.github/workflows/vortex-release.yml

@@ -234,11 +234,15 @@ jobs:
           VORTEX_CURRENT_MAJOR: ${{ env.CURRENT_MAJOR }}
 
       - name: Generate video for installer (not used in the final artifact)
+        env:
+          ASCIINEMA_VERSION: v3.2.1
+          ASCIINEMA_SHA256: 1b405bbda565b33c3c4718de67fedc3535580603c0694b1ff3fb04f363430a20
         run: |
           sudo apt-get update
           sudo apt install expect
-          sudo curl -sSL https://github.com/asciinema/asciinema/releases/latest/download/asciinema-x86_64-unknown-linux-gnu -o /usr/local/bin/asciinema && sudo chmod +x /usr/local/bin/asciinema
-          npm i -g sharp-cli
+          sudo curl -sSL "https://github.com/asciinema/asciinema/releases/download/${ASCIINEMA_VERSION}/asciinema-x86_64-unknown-linux-gnu" -o /usr/local/bin/asciinema
+          echo "${ASCIINEMA_SHA256}  /usr/local/bin/asciinema" | sha256sum --check --strict
+          sudo chmod +x /usr/local/bin/asciinema
           yarn install --frozen-lockfile
           php .utils/update-videos.php installer
         working-directory: .vortex/docs

.github/workflows/vortex-test-installer.yml

@@ -77,11 +77,15 @@ jobs:
 
       - name: Generate video for installer (not used in the final artifact)
         if: matrix.php-versions == '8.2'
+        env:
+          ASCIINEMA_VERSION: v3.2.1
+          ASCIINEMA_SHA256: 1b405bbda565b33c3c4718de67fedc3535580603c0694b1ff3fb04f363430a20
         run: |
           sudo apt-get update
           sudo apt install expect
-          sudo curl -sSL https://github.com/asciinema/asciinema/releases/latest/download/asciinema-x86_64-unknown-linux-gnu -o /usr/local/bin/asciinema && sudo chmod +x /usr/local/bin/asciinema
-          npm i -g sharp-cli
+          sudo curl -sSL "https://github.com/asciinema/asciinema/releases/download/${ASCIINEMA_VERSION}/asciinema-x86_64-unknown-linux-gnu" -o /usr/local/bin/asciinema
+          echo "${ASCIINEMA_SHA256}  /usr/local/bin/asciinema" | sha256sum --check --strict
+          sudo chmod +x /usr/local/bin/asciinema
           yarn install --frozen-lockfile
           php .utils/update-videos.php installer
         working-directory: .vortex/docs

.vortex/docs/.utils/VideoRecorder.php

@@ -470,7 +470,8 @@ public function renderPng(string $cast_path, string $png_path, ?int $at_ms = NUL
     ]);
 
     $this->run([
-      'npx', 'sharp-cli',
+      // 'sharp-cli' installs its executable as 'sharp'.
+      'npx', 'sharp',
       '-i', $frame_svg,
       '-o', $png_path,
       '-f', 'png',

.vortex/docs/content/contributing/maintenance/installer.mdx

@@ -210,3 +210,14 @@ To update the video:
 cd .vortex
 ahoy update-videos installer
 ```
+
+`sharp-cli`, which renders the PNG posters, is a declared dependency of
+`.vortex/docs`, so it is pinned by `yarn.lock` and installed by the existing
+`yarn install --frozen-lockfile`.
+
+`asciinema` is downloaded rather than installed from a lockfile, so the
+workflows that regenerate the video in CI pin it explicitly:
+`.github/workflows/vortex-release.yml` and
+`.github/workflows/vortex-test-installer.yml` each set `ASCIINEMA_VERSION` and
+`ASCIINEMA_SHA256`. Bump both workflows together, so the release and the
+installer test always generate assets with identical tooling.

.vortex/docs/content/contributing/maintenance/template.mdx

@@ -272,6 +272,7 @@ Without arguments, runs `all` for a full refresh. Default tag is `latest`.
 
 - `docker`, `ahoy`, `curl`, `sed`, `php` available on `PATH`.
 - A Docker Hub session with push permission to `drevops/` for any image mode.
+- The `demo-image`, `test-image` and `all` modes download `seed.sh` from a pinned `drevops/mariadb-drupal-data` release and verify it against a recorded SHA-256 checksum. Adopting a newer release is a manual step: update `SEED_URL` and `SEED_SHA256` together.
 
 ### Caveats
 

.vortex/docs/package.json

@@ -38,6 +38,7 @@
     "raw-loader": "^4.0.2",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
+    "sharp-cli": "^5.2.0",
     "svg-term-cli": "^2.1.1"
   },
   "devDependencies": {

.vortex/tests/update-test-assets

@@ -40,7 +40,8 @@ declare(strict_types=1);
  */
 
 const SUT_DIR = '/tmp/star-wars';
-const SEED_URL = 'https://github.com/drevops/mariadb-drupal-data/releases/latest/download/seed.sh';
+const SEED_URL = 'https://github.com/drevops/mariadb-drupal-data/releases/download/26.7.0/seed.sh';
+const SEED_SHA256 = 'd97c184b2b76111b39b3cba96a624c22ed3f3408d781345770ea2b17beaba91e';
 const IMAGE_DEMO = 'drevops/vortex-dev-mariadb-drupal-data-demo-11.x';
 const IMAGE_TEST = 'drevops/vortex-dev-mariadb-drupal-data-test-11.x';
 const IMAGE_DEST = 'drevops/vortex-dev-mariadb-drupal-data-demo-destination-11.x';
@@ -390,6 +391,9 @@ function truncate_for_log(string $value, int $max): string {
 function seed_image(string $cwd, string $filename, string $image): void {
   step('Download seed.sh');
   run(sprintf('curl -fsSL -o seed.sh %s', escapeshellarg(SEED_URL)), $cwd);
+  // A release asset can be replaced without moving its tag, so pinning the
+  // URL alone does not pin the contents of the script that gets executed.
+  verify_checksum($cwd . '/seed.sh', SEED_SHA256);
   run('chmod +x seed.sh', $cwd);
 
   step('Ensure a multi-platform capable buildx builder');
@@ -405,6 +409,24 @@ function seed_image(string $cwd, string $filename, string $image): void {
   run(sprintf('DESTINATION_PLATFORMS=linux/amd64,linux/arm64 BUILDX_BUILDER=vortex-seed ./seed.sh .data/%s %s', escapeshellarg($filename), escapeshellarg($image)), $cwd);
 }
 
+function verify_checksum(string $path, string $expected): void {
+  step(sprintf('Verify checksum of %s', basename($path)));
+
+  $actual = hash_file('sha256', $path);
+
+  if ($actual === FALSE) {
+    fwrite(STDERR, sprintf("Error: cannot read %s for checksum verification.\n", $path));
+    exit(1);
+  }
+
+  if (!hash_equals($expected, $actual)) {
+    fwrite(STDERR, sprintf("Error: checksum mismatch for %s.\n  Expected: %s\n  Actual:   %s\n", $path, $expected, $actual));
+    exit(1);
+  }
+
+  println(sprintf('  - Checksum verified: %s', $actual));
+}
+
 // =============================================================================
 // Helpers.
 // =============================================================================