[#2870, #2871, #2872] Pinned the seed script, 'asciinema' and 'sharp-cli' versions.

[AlexSkrypnyk]

Closes #2872
Closes #2870
Closes #2871

Summary

Three tools were resolved fresh at run time rather than being pinned, so what actually executed depended on when a command ran instead of on what the commit said. Two of them are artifacts downloaded over the network and then executed, which makes this a supply-chain concern as well as a reproducibility one. All three produce committed output (database images and documentation videos), so an unnoticed upstream change lands as a diff in generated artifacts rather than as an obvious failure.

Each is now pinned by the mechanism that suits it: the two downloaded artifacts get an explicit release tag plus a recorded SHA-256 checksum, and the one that is an npm package is installed from the existing lockfile instead of ad hoc. A pinned tag alone is not enough for the downloads, because a GitHub release asset can be replaced without the tag moving.

Changes

Test asset seeding (.vortex/tests/update-test-assets)

• SEED_URL moves from releases/latest/download to the explicit 26.7.0 tag. That is the current release, and the one that fixed arm64 seeding, so behaviour is unchanged today.
• SEED_SHA256 records the hash of that release's seed.sh, and a new verify_checksum() fails closed before the script is made executable and run.

Documentation video workflows (.github/workflows/vortex-release.yml, .github/workflows/vortex-test-installer.yml)

• asciinema moves from releases/latest/download to v3.2.1, with its SHA-256 checked via sha256sum --check --strict before the binary is made executable. The version and checksum are declared in a step-level env block and referenced as shell variables rather than interpolated into the run script, which keeps the step free of template-injection warnings.
• sharp-cli is no longer installed globally with npm i -g. It is now a declared dependency of .vortex/docs, so it is pinned by yarn.lock with integrity hashes and installed by the yarn install --frozen-lockfile the step already runs. The global install is deleted from both workflows.
• Both workflows carry identical asciinema values so the release build and the installer test always generate assets with the same tooling.

Video recorder (.vortex/docs/.utils/VideoRecorder.php)

• The poster render call changes from npx sharp-cli to npx sharp. The sharp-cli package installs its executable under the name sharp, so with a local install there is no sharp-cli binary in node_modules/.bin and npx sharp-cli would fall back to fetching the package from the registry, which is the behaviour this change is removing.

Documentation

• The maintenance pages record where each pin lives, and which ones are bumped by hand.

Notes for reviewers

sharp-cli was originally pinned here as npm i -g sharp-cli@5.2.0, which zizmor flagged as adhoc-packages ("installs a package outside of a lockfile") on both workflows. Moving it into the docs package.json resolves that finding at the source rather than suppressing it, and gives a stronger guarantee than a version pin since yarn.lock also carries integrity hashes. It matches how svg-term-cli, the sibling tool used by the same recorder, is already declared. The lockfile carries the @img/sharp-linux* binaries, so the Linux runners resolve native builds from it.

Two of the issues suggested using Renovate to keep these pins from rotting. That was not done: all of these are bumped by hand. Worth knowing if that is ever revisited, because the cases are not equivalent:

• The video workflows sit under .github/workflows/, which Renovate can already see, so a customManagers entry there would work as the issue describes.
• .vortex/tests/update-test-assets cannot be tracked. renovate.json sets ignorePaths to .vortex/**, and Renovate applies ignorePaths to the global file list before any manager runs, custom regex managers included, with no negation syntax available. A custom manager pointed at that path would be inert, and making it work would mean widening Renovate's surface across .vortex/.
• The same ignorePaths entry covers .vortex/docs, so the new sharp-cli lockfile entry is not Renovate-tracked either. It is still an improvement: the version is now resolved from a committed lockfile rather than from whatever npm publishes at run time.

Screenshots

N/A

Before / After

BEFORE                                        AFTER
──────                                        ─────

update-test-assets                            update-test-assets
  │                                             │
  └─ releases/latest/download/seed.sh           └─ releases/download/26.7.0/seed.sh
       └─► newest release at run time,               └─► SHA-256 verified, fails
           executed unverified                           closed before executing

vortex-release.yml          ┐                 vortex-release.yml          ┐
vortex-test-installer.yml   ┘ can disagree    vortex-test-installer.yml   ┘ in lockstep
  │                                             │
  ├─ asciinema latest/download                  ├─ asciinema v3.2.1
  │    └─► binary executed unverified           │    └─► SHA-256 verified
  │                                             │
  └─ npm i -g sharp-cli                         └─ (removed)
       └─► whatever npm publishes,                    │
           flagged by zizmor                          ▼
                                                 .vortex/docs/package.json
                                                   └─ sharp-cli, resolved by
                                                      yarn.lock via the existing
                                                      yarn install --frozen-lockfile

[coderabbitai]

Walkthrough

The test asset updater now pins the seed.sh release and verifies its checksum. Release and installer-test workflows pin Asciinema and Sharp CLI versions and verify Asciinema downloads. Maintenance documentation records the required updates.

Changes

Reproducibility hardening

Layer / File(s)	Summary
Seed asset pinning and verification .vortex/tests/update-test-assets, .vortex/docs/content/contributing/maintenance/template.mdx	The updater uses the 26.7.0 seed release, verifies seed.sh with SEED_SHA256, and documents coordinated constant updates.
Video tool pinning .github/workflows/vortex-release.yml, .github/workflows/vortex-test-installer.yml, .vortex/docs/content/contributing/maintenance/installer.mdx	Both workflows pin Asciinema and Sharp CLI versions, verify the Asciinema checksum, and document coordinated updates.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• drevops/vortex#2525 — Modifies the video-generation steps in the same workflows.

Poem

A rabbit checks each hash with care,
Pins every tool and seed in place.
No rolling tags can leap unseen,
The workflows run on versions clean.
“Hop!” says the hare, “releases trace!”

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR satisfies #2872, #2870, and #2871, but it does not pin the Alpine image required by #2869.	Pin the Alpine image in .vortex/tests/update-test-assets, or explicitly remove #2869 from the linked objectives.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The workflow, asset updater, and maintenance documentation changes support the linked version-pinning objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main version-pinning changes, including the seed script, Asciinema, and Sharp CLI.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/2872-pin-mariadb-seed

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.38%. Comparing base (c98f69d) to head (fbe904d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2874      +/-   ##
==========================================
- Coverage   86.81%   86.38%   -0.43%     
==========================================
  Files         100       93       -7     
  Lines        4846     4687     -159     
  Branches       47        3      -44     
==========================================
- Hits         4207     4049     -158     
+ Misses        639      638       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

📖 Documentation preview for this pull request has been deployed to Netlify:

https://6a6c18ed465477ff07661fe2--vortex-docs.netlify.app

This preview is rebuilt on every commit and is not the production documentation site.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.vortex/tests/update-test-assets (1)

239-240: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Pin the Alpine image tag.

alpine resolves a mutable image version. This can change the cleanup behavior between runs and violates the reproducibility objective. Use alpine:3.24 or an immutable digest.

Proposed fix

-    'docker run --rm -v %s:/sut alpine find /sut -mindepth 1 -delete',
+    'docker run --rm -v %s:/sut alpine:3.24 find /sut -mindepth 1 -delete',

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.vortex/tests/update-test-assets around lines 239 - 240, Update the Docker
cleanup command in the test asset update script to use a pinned Alpine image,
replacing the mutable alpine reference with alpine:3.24 or an immutable digest
while preserving the existing volume mount and cleanup arguments.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.vortex/tests/update-test-assets:
- Around line 239-240: Update the Docker cleanup command in the test asset
update script to use a pinned Alpine image, replacing the mutable alpine
reference with alpine:3.24 or an immutable digest while preserving the existing
volume mount and cleanup arguments.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e8155ed0-3a37-4761-a213-610995a007b7

📥 Commits

Reviewing files that changed from the base of the PR and between 81ffc18 and 9f7c191.

📒 Files selected for processing (2)

• .vortex/docs/content/contributing/maintenance/template.mdx
• .vortex/tests/update-test-assets

[github-actions]

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   98.55% (204/207)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)

[AlexSkrypnyk]

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   98.55% (204/207)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)