From a8a80b98467fa9e7f83c23a50453c19f6cb3a094 Mon Sep 17 00:00:00 2001
From: mptyl <mp@tylconsulting.it>
Date: Tue, 25 Aug 2026 19:10:06 +0200
Subject: [PATCH] fix(ci): pin maintenance smoke image

---
 .../scripts/verify-workspace-descriptor-files.mjs    |  4 ++--
 scripts/test-task13-runtime-fixtures.sh              | 12 ++++++++++++
 scripts/unified-deployment-smoke.sh                  | 10 ++++++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/backend/scripts/verify-workspace-descriptor-files.mjs b/backend/scripts/verify-workspace-descriptor-files.mjs
index b3581a82..1ad077f3 100755
--- a/backend/scripts/verify-workspace-descriptor-files.mjs
+++ b/backend/scripts/verify-workspace-descriptor-files.mjs
@@ -40,9 +40,9 @@ const reviewedExpandableBlocks = new Map([
   ]],
   ["scripts/unified-deployment-smoke.sh", [
     { sha256: "ca0c17d9ff8dc0fbe018fc1c5510eb33bc667a936fbe44a9be2d311390576825", rationale: "Generates reviewed Task 13 runtime configuration." },
-    { sha256: "cf62a7adcbb7b4e2323e7f2baee58f72dad7c19678f416555067eafefed65144", rationale: "Generates the reviewed local Task 13 Compose override." },
+    { sha256: "36d3d8a2362dbdc4fad90948d6c227586d749f56b9a4bc5b6b5a91bcbec6407b", rationale: "Generates the reviewed local Task 13 Compose override." },
     { sha256: "c556f7d910d0788e219b042957e6b307cb9925b43920c680535d0d3a6dcbdb25", rationale: "Generates the reviewed local Task 13 installation descriptor." },
-    { sha256: "c0078c68bd42a8668fbcb849888531e5e56109579df1ff96140a9e91b1efea56", rationale: "Generates the reviewed server Task 13 Compose override." },
+    { sha256: "526006fa6d48a8080b3834723630c64de5005a67243e944ebf1da15212b4d654", rationale: "Generates the reviewed server Task 13 Compose override." },
     { sha256: "b34a2b4ffaa72e01efb64a7a28b13513527538d837b2f35b6ca5fb3dbdb2d5dc", rationale: "Generates the reviewed server Task 13 installation descriptor." },
   ]],
   ["scripts/vector-backup.sh", [
diff --git a/scripts/test-task13-runtime-fixtures.sh b/scripts/test-task13-runtime-fixtures.sh
index 8549f87f..285c436f 100755
--- a/scripts/test-task13-runtime-fixtures.sh
+++ b/scripts/test-task13-runtime-fixtures.sh
@@ -77,6 +77,18 @@ rendered="$fixture/rendered.json"
 docker compose --project-name "$TASK13_PROJECT" --project-directory "$root" \
   --env-file "$TASK13_ENV_FILE" "${compose_files[@]}" config --format json >"$rendered"
 task13_assert_rendered_contract
+maintenance_rendered="$fixture/maintenance-rendered.json"
+docker compose --project-name "$TASK13_PROJECT" --project-directory "$root" \
+  --env-file "$TASK13_ENV_FILE" "${compose_files[@]}" --profile workspace-maintenance \
+  config --format json >"$maintenance_rendered"
+node - "$maintenance_rendered" <<'NODE'
+const config = JSON.parse(require("fs").readFileSync(process.argv[2], "utf8"));
+const core = config.services?.core;
+const maintenance = config.services?.["workspace-maintenance"];
+if (!core || !maintenance || maintenance.image !== core.image) {
+  throw new Error("workspace-maintenance must use the isolated core image");
+}
+NODE
 tsx_loader="$root/backend/node_modules/tsx/dist/loader.mjs"
 checker=(node --import "$tsx_loader" "$root/scripts/task13-runtime-fixture-check.ts")
 [[ -f "$tsx_loader" ]] || {
diff --git a/scripts/unified-deployment-smoke.sh b/scripts/unified-deployment-smoke.sh
index c4ba5fef..cda216bd 100755
--- a/scripts/unified-deployment-smoke.sh
+++ b/scripts/unified-deployment-smoke.sh
@@ -504,6 +504,11 @@ services:
       - application-secrets:/run/secrets:ro
       - registry-remote:/fixtures/remote.git:ro
     secrets: !reset []
+  workspace-maintenance:
+    image: $TASK13_CORE_IMAGE
+    pull_policy: never
+    labels:
+      io.thothii.task13.run: "$TASK13_RUN_ID"
   frontend:
     image: $TASK13_FRONTEND_IMAGE
     build:
@@ -704,6 +709,11 @@ services:
       - $remote_path:/fixtures/remote.git:ro
       - $TASK13_SESSION_RUNTIME_PASSWORD:/run/secrets/task13-runtime-password:ro
       - $TASK13_OIDC_CERT:/fixtures/task13-oidc-ca.pem:ro
+  workspace-maintenance:
+    image: $TASK13_CORE_IMAGE
+    pull_policy: never
+    labels:
+      io.thothii.task13.run: "$TASK13_RUN_ID"
   frontend:
     image: $TASK13_FRONTEND_IMAGE
     build: