ci: run validation in pinned container

.dockerignore

@@ -0,0 +1,4 @@
+.git
+.venv
+.pytest_cache
+**/__pycache__

.gitea/workflows/ci.yml

@@ -15,24 +15,10 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - name: Install test toolchain
+      - name: Build validation image
-        run: |
+        run: docker buildx build --platform linux/amd64 --file tests/Dockerfile.ci --load --tag homeassistant-stelloauth-tests:test .
-          set -eu
-          apk add --no-cache curl python3 py3-pip
-          curl --fail --location --silent --show-error \
-            --output /tmp/go1.27.1.linux-amd64.tar.gz \
-            https://go.dev/dl/go1.27.1.linux-amd64.tar.gz
-          echo "63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445  /tmp/go1.27.1.linux-amd64.tar.gz" \
-            | sha256sum -c -
-          mkdir -p /opt/go1.27.1
-          tar --extract --gzip --file /tmp/go1.27.1.linux-amd64.tar.gz \
-            --directory /opt/go1.27.1 --strip-components 1
-          ln -sf /opt/go1.27.1/bin/go /usr/local/bin/go
-          go version
-          python3 -m venv .venv
-          .venv/bin/pip install --requirement requirements-dev.txt
       - name: Validate metadata, patches, and process manager
-        run: .venv/bin/pytest -q
+        run: docker run --rm homeassistant-stelloauth-tests:test -q
       - name: Build amd64 image
         run: docker buildx build --platform linux/amd64 --build-arg BUILD_ARCH=amd64 --load --tag homeassistant-stelloauth-addon:test stelloauth
       - name: Exercise runtime

tests/Dockerfile.ci

@@ -0,0 +1,15 @@
+FROM golang:1.27.1-bookworm@sha256:69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195
+
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends python3 python3-venv
+
+WORKDIR /workspace
+
+COPY requirements-dev.txt ./
+RUN python3 -m venv /opt/venv \
+    && /opt/venv/bin/pip install --no-cache-dir --requirement requirements-dev.txt
+
+COPY . ./
+RUN git init
+
+ENTRYPOINT ["/opt/venv/bin/pytest"]

tests/test_addon_metadata.py

@@ -173,32 +173,42 @@ def test_ci_builds_and_loads_only_the_amd64_test_image() -> None:
         assert publication_primitive not in workflow
 
 
-def test_ci_installs_toolchain_without_hosted_toolcache_actions() -> None:
+def test_ci_runs_validation_in_pinned_container() -> None:
     workflow = (ROOT / ".gitea/workflows/ci.yml").read_text(encoding="utf-8")
     parsed = yaml.safe_load(workflow)
     steps = parsed["jobs"]["validate"]["steps"]
-    setup_command = next(
-        step["run"] for step in steps if step.get("name") == "Install test toolchain"
-    )
-
     assert "actions/setup-python" not in workflow
     assert "actions/setup-go" not in workflow
-    for required_command in (
+    build_command = next(
-        "apk add --no-cache curl python3 py3-pip",
+        step["run"] for step in steps if step.get("name") == "Build validation image"
-        "go1.27.1.linux-amd64.tar.gz",
+    )
-        "63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445",
+    assert build_command.split() == [
-        "sha256sum -c -",
+        "docker",
-        "python3 -m venv .venv",
+        "buildx",
-        ".venv/bin/pip install --requirement requirements-dev.txt",
+        "build",
-    ):
+        "--platform",
-        assert required_command in setup_command
+        "linux/amd64",
-
+        "--file",
+        "tests/Dockerfile.ci",
+        "--load",
+        "--tag",
+        "homeassistant-stelloauth-tests:test",
+        ".",
+    ]
     validation_command = next(
         step["run"]
         for step in steps
         if step.get("name") == "Validate metadata, patches, and process manager"
     )
-    assert validation_command == ".venv/bin/pytest -q"
+    assert validation_command == "docker run --rm homeassistant-stelloauth-tests:test -q"
+
+    dockerfile = (ROOT / "tests/Dockerfile.ci").read_text(encoding="utf-8")
+    assert (
+        "golang:1.27.1-bookworm@sha256:"
+        "69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195"
+    ) in dockerfile
+    assert "python3 python3-venv" in dockerfile
+    assert 'ENTRYPOINT ["/opt/venv/bin/pytest"]' in dockerfile
 
 
 def test_patch_payloads_disable_git_whitespace_errors() -> None: