From 988df7233e8798059ebc3acec96e61adab8d4db5 Mon Sep 17 00:00:00 2001 From: "andrzej.janczak" Date: Thu, 3 Sep 2026 09:19:54 +0200 Subject: [PATCH] Pin @codacy/codacy-cloud-cli and @codacy/analysis-cli versions Both were installed unpinned, so every image build could pick up a different CLI and a prod failure could not be reproduced with certainty. Pin to the currently published versions (1.9.0 / 0.22.0). --- docker/Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 5fbfeba..21c20b5 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -17,11 +17,13 @@ RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-reco ARG CLAUDE_CODE_VERSION=2.1.226 # Pinned: policy-engine semantics change between minors, so a bump must be tested, never picked up silently ARG GEMINI_CLI_VERSION=0.54.4 +ARG CODACY_CLOUD_CLI_VERSION=1.9.0 +ARG CODACY_ANALYSIS_CLI_VERSION=0.22.0 RUN npm install -g \ @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} \ @google/gemini-cli@${GEMINI_CLI_VERSION} \ - @codacy/codacy-cloud-cli \ - @codacy/analysis-cli + @codacy/codacy-cloud-cli@${CODACY_CLOUD_CLI_VERSION} \ + @codacy/analysis-cli@${CODACY_ANALYSIS_CLI_VERSION} # Pre-bake skills — Claude loads via --plugin-dir, Gemini installs from local path # ADD'ing the master ref content makes Docker invalidate this layer whenever codacy-skills master moves,