PLA-324: make Ghost-CLI installation reproducible

[9larsons]

Summary

• replace the mutable global npm install -g ghost-cli with a lockfile-backed local npm ci
• disable all Ghost-CLI dependency lifecycle scripts and verify the installed CLI version before exposing it on PATH
• refresh the exact Ghost-CLI dependency and lockfile automatically when versions.json changes
• copy the locked toolchain into each generated Docker build context and reject stale generated output

This addresses PLA-324.

Security decisions

The install retains --ignore-scripts. Ghost-CLI itself has no install lifecycle script. The only dependency marked with an install script in this lock is Yarn 1.22.22; its preinstall only removes conflicting Corepack shims during a global Yarn install, so it is not needed for this local toolchain. Ghost-CLI, ghost install --help, and its bundled Yarn all work with lifecycle scripts disabled.

The Node base-image tags remain unpinned. Docker Official Images resolves them per supported architecture and uses parent-image updates to trigger rebuilds; a single manifest digest would work against that multi-architecture update flow. Build output still records the resolved parent digest.

npm audit --omit=dev reports existing issues in Ghost-CLI 1.30.1's dependency tree (1 critical, 4 high, and 4 moderate). This patch freezes that tree and prevents unreviewed transitive changes, but remediation requires upstream Ghost-CLI dependency updates rather than altering the requested CLI version here.

Validation

• update-ghost-cli-lock.sh refreshes an exact version and is idempotent; stale locks are rejected by apply-templates.sh
• generated Bookworm and Alpine lockfiles are byte-identical to the source lock
• npm ci --omit=dev --ignore-scripts and Ghost-CLI 1.30.1 execution pass locally
• full linux/arm64 Bookworm and Alpine image builds pass, including Ghost 6.56.0 installation and native dependency checks
• both built images report Ghost-CLI 1.30.1 and Ghost 6.56.0
• Bookworm runtime smoke returns HTTP 200 from /ghost/api/admin/site/ using SQLite
• shell syntax, generated-file idempotence, and git diff --check pass

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6267b48f-734c-4da5-9751-a04b6329f667

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}