ci: run validation in pinned container

tests/test_addon_metadata.py

@@ -173,32 +173,42 @@ def test_ci_builds_and_loads_only_the_amd64_test_image() -> None:
         assert publication_primitive not in workflow
 
 
-def test_ci_installs_toolchain_without_hosted_toolcache_actions() -> None:
+def test_ci_runs_validation_in_pinned_container() -> None:
     workflow = (ROOT / ".gitea/workflows/ci.yml").read_text(encoding="utf-8")
     parsed = yaml.safe_load(workflow)
     steps = parsed["jobs"]["validate"]["steps"]
-    setup_command = next(
-        step["run"] for step in steps if step.get("name") == "Install test toolchain"
-    )
-
     assert "actions/setup-python" not in workflow
     assert "actions/setup-go" not in workflow
-    for required_command in (
-        "apk add --no-cache curl python3 py3-pip",
-        "go1.27.1.linux-amd64.tar.gz",
-        "63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445",
-        "sha256sum -c -",
-        "python3 -m venv .venv",
-        ".venv/bin/pip install --requirement requirements-dev.txt",
-    ):
-        assert required_command in setup_command
-
+    build_command = next(
+        step["run"] for step in steps if step.get("name") == "Build validation image"
+    )
+    assert build_command.split() == [
+        "docker",
+        "buildx",
+        "build",
+        "--platform",
+        "linux/amd64",
+        "--file",
+        "tests/Dockerfile.ci",
+        "--load",
+        "--tag",
+        "homeassistant-stelloauth-tests:test",
+        ".",
+    ]
     validation_command = next(
         step["run"]
         for step in steps
         if step.get("name") == "Validate metadata, patches, and process manager"
     )
-    assert validation_command == ".venv/bin/pytest -q"
+    assert validation_command == "docker run --rm homeassistant-stelloauth-tests:test -q"
+
+    dockerfile = (ROOT / "tests/Dockerfile.ci").read_text(encoding="utf-8")
+    assert (
+        "golang:1.27.1-bookworm@sha256:"
+        "69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195"
+    ) in dockerfile
+    assert "python3 python3-venv" in dockerfile
+    assert 'ENTRYPOINT ["/opt/venv/bin/pytest"]' in dockerfile
 
 
 def test_patch_payloads_disable_git_whitespace_errors() -> None: