build: harden image build inputs

docker/core.Dockerfile

@@ -4,8 +4,11 @@
 ARG PI_VERSION=0.80.3
 ARG IMAGE_VERSION=local
 
+# ---- Pinned Node source for the runtime binary and npm ----
+FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS node-runtime
+
 # ---- Stage 0: locked Pi runtime ----
-FROM node:22-bookworm AS pi-runtime-build
+FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS pi-runtime-build
 ARG PI_VERSION
 WORKDIR /opt/pi-runtime
 COPY docker/pi-runtime/package.json docker/pi-runtime/package-lock.json ./
@@ -13,7 +16,7 @@ RUN npm ci --omit=dev \
  && test "$(./node_modules/.bin/pi --version)" = "$PI_VERSION"
 
 # ---- Stage 1: backend TypeScript -> dist ----
-FROM node:22-bookworm AS backend-build
+FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS backend-build
 WORKDIR /src/backend
 COPY backend/package*.json ./
 RUN npm ci
@@ -21,7 +24,7 @@ COPY backend/ ./
 RUN npm run build
 
 # ---- Stage 2: runtime (Python 3.12 nativo + Node 22 copiato, stesso glibc bookworm) ----
-FROM python:3.12-slim-bookworm AS runtime
+FROM python:3.12-slim-bookworm@sha256:d50fb7611f86d04a3b0471b46d7557818d88983fc3136726336b2a4c657aa30b AS runtime
 ARG PI_VERSION
 ARG IMAGE_VERSION
 LABEL org.opencontainers.image.title="thothii-core" \
@@ -36,8 +39,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && ln -s /usr/bin/fdfind /usr/local/bin/fd
 
 # Node 22 + npm copiati dall'immagine ufficiale (stesso Debian bookworm → binario compatibile)
-COPY --from=node:22-bookworm /usr/local/bin/node /usr/local/bin/node
-COPY --from=node:22-bookworm /usr/local/lib/node_modules /usr/local/lib/node_modules
+COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
 RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
  && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
 

docker/frontend.Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.7
 # thothii-frontend: build Vite (React) + nginx-unprivileged (porta 8080).
 ARG IMAGE_VERSION=local
-FROM node:22-bookworm AS build
+FROM node:22-bookworm@sha256:7725a5c2c83eed1d36258c66efae14b1ceccd021db9ed1d9559d3335ed3d68ed AS build
 WORKDIR /src
 COPY frontend/package*.json ./
 RUN npm ci
@@ -9,7 +9,7 @@ COPY frontend/ ./
 ENV VITE_BASE=/ VITE_BACKEND_URL=/api
 RUN npm run build
 
-FROM nginxinc/nginx-unprivileged:1.27-alpine AS runtime
+FROM nginxinc/nginx-unprivileged:1.27-alpine@sha256:65e3e85dbaed8ba248841d9d58a899b6197106c23cb0ff1a132b7bfe0547e4c0 AS runtime
 ARG IMAGE_VERSION
 LABEL org.opencontainers.image.title="thothii-frontend" \
       org.opencontainers.image.version="${IMAGE_VERSION}" \
@@ -18,6 +18,7 @@ COPY --from=build /src/dist /usr/share/nginx/html
 COPY docker/nginx.conf.template /etc/nginx/templates/default.conf.template
 COPY --chmod=755 docker/frontend-entrypoint.sh /usr/local/bin/frontend-entrypoint
 COPY --chmod=755 docker/validate-frontend-api-upstream.sh /usr/local/bin/validate-frontend-api-upstream
+COPY --chmod=755 docker/smoke/frontend-smoke.sh /usr/local/bin/frontend-config-smoke
 ENTRYPOINT ["/usr/local/bin/frontend-entrypoint"]
 CMD ["nginx", "-g", "daemon off;"]
 EXPOSE 8080

docker/smoke/frontend-smoke.sh

@@ -1,14 +1,6 @@
 #!/bin/sh
 set -eu
 
-assignment=$(sed \
-  -e 's/^window\.__THOTHII_CONFIG__ = //' \
-  -e 's/;$//' \
-  /usr/share/nginx/html/config.js)
-
-printf '%s\n' "$assignment" \
-  | jq -e --arg expected "${BACKEND_BASE_URL-/api}" \
-      'type == "object" and keys == ["backendBaseUrl"] and .backendBaseUrl == $expected' \
-  >/dev/null
+test "$(cat /usr/share/nginx/html/config.js)" = 'window.__THOTHII_CONFIG__ = {};'
 
 printf '%s\n' "frontend runtime config smoke: ok"