fix(ci): validate shared Cloud image contexts throughout the stack

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/docker-cloud.yml

@@ -3,6 +3,13 @@ name: Docker cloud
 on:
   workflow_dispatch:
   workflow_call:
+    inputs:
+      staging_artifact_base_url:
+        type: string
+        default: ""
+      staging_lock_sha256:
+        type: string
+        default: ""
 
 permissions: {}
 
@@ -98,9 +105,16 @@ jobs:
           node-version: 24
 
       - name: Refresh lockfile for Docker build context
+        env:
+          STAGING_ARTIFACT_BASE_URL: ${{ inputs.staging_artifact_base_url }}
+          EXPECTED_LOCK_SHA256: ${{ inputs.staging_lock_sha256 }}
         run: |
           set -euo pipefail
           pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
+          if [ -n "$STAGING_ARTIFACT_BASE_URL" ]; then
+            [[ "$EXPECTED_LOCK_SHA256" =~ ^[a-f0-9]{64}$ ]]
+            echo "$EXPECTED_LOCK_SHA256  pnpm-lock.yaml" | sha256sum --check --strict
+          fi
 
           changed="$(git status --porcelain)"
           if [ -z "$changed" ]; then

.github/workflows/docker.yml

@@ -19,6 +19,11 @@ on:
         type: string
         default: ""
 
+      staging_lock_sha256:
+        description: Reviewed SHA-256 of the resolved pnpm 9 lockfile; required with staging_artifact_base_url
+        type: string
+        default: ""
+
 # Least privilege: nothing at the workflow level; each job declares exactly
 # the token scopes it uses (checkout needs contents:read, GHCR pushes need
 # packages:write).
@@ -59,6 +64,14 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 24
+      - name: Resolve and verify staging dependencies before installation
+        env:
+          EXPECTED_LOCK_SHA256: ${{ inputs.staging_lock_sha256 }}
+        run: |
+          set -euo pipefail
+          [[ "$EXPECTED_LOCK_SHA256" =~ ^[a-f0-9]{64}$ ]]
+          pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
+          echo "$EXPECTED_LOCK_SHA256  pnpm-lock.yaml" | sha256sum --check --strict
       - run: pnpm install --frozen-lockfile
       - name: Build matching migrator artifacts
         env:
@@ -172,10 +185,18 @@ jobs:
           node-version: 24
 
       - name: Refresh lockfile for Docker build context
+        env:
+          STAGING_ARTIFACT_BASE_URL: ${{ inputs.staging_artifact_base_url }}
+          EXPECTED_LOCK_SHA256: ${{ inputs.staging_lock_sha256 }}
         run: |
           set -euo pipefail
           pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
 
+          if [ -n "$STAGING_ARTIFACT_BASE_URL" ]; then
+            [[ "$EXPECTED_LOCK_SHA256" =~ ^[a-f0-9]{64}$ ]]
+            echo "$EXPECTED_LOCK_SHA256  pnpm-lock.yaml" | sha256sum --check --strict
+          fi
+
           changed="$(git status --porcelain)"
           if [ -z "$changed" ]; then
             echo "Lockfile already matches package metadata."
@@ -406,6 +427,9 @@ jobs:
   build-and-push-cloud:
     if: github.event_name != 'push' || github.ref != 'refs/heads/master'
     uses: ./.github/workflows/docker-cloud.yml
+    with:
+      staging_artifact_base_url: ${{ inputs.staging_artifact_base_url || '' }}
+      staging_lock_sha256: ${{ inputs.staging_lock_sha256 || '' }}
     permissions:
       contents: read
       packages: write