From 3d5921eb506e28c72327bba2427b77b9a7f54acb Mon Sep 17 00:00:00 2001
From: bendwyer <17102207+bendwyer@users.noreply.github.com>
Date: Sun, 6 Sep 2026 15:22:45 +0000
Subject: [PATCH] fix(images): build against the resolved version, not latest

Eight Dockerfiles fetched "latest" themselves while the merge job separately
resolved "latest" to compute the tag. Two resolutions, minutes apart, with
nothing tying them together: an upstream release landing between them tags an
image with a version it does not contain.

bendwyer/github-workflows#194 now resolves once and passes VERSION as a
build-arg. These consume it, so the artifact and its tag come from the same
value.

The six that download a GitHub release asset move from releases/latest to
releases/download/v${VERSION}, since every one of these upstreams tags
vX.Y.Z and get-version.sh already strips the v. The two npm images pin the
package spec instead. flux-mcp, paperless-mcp and terraform-mcp no longer
need jq, having stopped querying the API themselves.

Verified all eight build against their resolved version, that the installed
version matches the arg rather than latest (ansible-mcp 26.6.0, context7-mcp
4.0.5, terraform-mcp 1.3.0), and that a wrong VERSION now fails the build
instead of silently falling back.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 images/ansible-mcp/Dockerfile   | 3 ++-
 images/context7-mcp/Dockerfile  | 3 ++-
 images/flux-mcp/Dockerfile      | 6 +++---
 images/github-mcp/Dockerfile    | 3 ++-
 images/grafana-mcp/Dockerfile   | 3 ++-
 images/humble-cli/Dockerfile    | 5 +++--
 images/paperless-mcp/Dockerfile | 8 ++++----
 images/terraform-mcp/Dockerfile | 8 ++++----
 8 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/images/ansible-mcp/Dockerfile b/images/ansible-mcp/Dockerfile
index d6e4bdf..944dc25 100644
--- a/images/ansible-mcp/Dockerfile
+++ b/images/ansible-mcp/Dockerfile
@@ -1,7 +1,8 @@
 FROM node:24-alpine3.24@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf AS build
 
+ARG VERSION
 WORKDIR /app
-RUN npm install @ansible/ansible-mcp-server
+RUN npm install @ansible/ansible-mcp-server@${VERSION}
 
 FROM gcr.io/distroless/nodejs24-debian13@sha256:7cca079bad19303c78cd874a5da79832441985a216b767196507d69b8784a698
 COPY --from=build /app /app
diff --git a/images/context7-mcp/Dockerfile b/images/context7-mcp/Dockerfile
index ef02578..c190533 100644
--- a/images/context7-mcp/Dockerfile
+++ b/images/context7-mcp/Dockerfile
@@ -1,7 +1,8 @@
 FROM node:24-alpine3.24@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf AS build
 
+ARG VERSION
 WORKDIR /app
-RUN npm install @upstash/context7-mcp
+RUN npm install @upstash/context7-mcp@${VERSION}
 
 FROM gcr.io/distroless/nodejs24-debian13@sha256:7cca079bad19303c78cd874a5da79832441985a216b767196507d69b8784a698
 COPY --from=build /app /app
diff --git a/images/flux-mcp/Dockerfile b/images/flux-mcp/Dockerfile
index 281e103..a5bb06e 100644
--- a/images/flux-mcp/Dockerfile
+++ b/images/flux-mcp/Dockerfile
@@ -8,10 +8,10 @@ ARG OWNER
 ARG BINARY
 ARG REPOSITORY
 ARG TARGETARCH
+ARG VERSION
 
-RUN apk add --no-cache curl jq tar && \
-  RELEASE=$(curl -sSL https://api.github.com/repos/${OWNER}/${REPOSITORY}/releases/latest | jq -r '.tag_name | split("v")[1]') && \
-  curl -sSL "https://github.com/${OWNER}/${REPOSITORY}/releases/latest/download/${BINARY}_${RELEASE}_linux_${TARGETARCH}.tar.gz" \
+RUN apk add --no-cache curl tar && \
+  curl -sSL "https://github.com/${OWNER}/${REPOSITORY}/releases/download/v${VERSION}/${BINARY}_${VERSION}_linux_${TARGETARCH}.tar.gz" \
     | tar xzf - -C /usr/local/bin/ "${BINARY}"
 
 FROM gcr.io/distroless/static-debian13@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe
diff --git a/images/github-mcp/Dockerfile b/images/github-mcp/Dockerfile
index 97d0b73..4f95ad1 100644
--- a/images/github-mcp/Dockerfile
+++ b/images/github-mcp/Dockerfile
@@ -6,6 +6,7 @@ FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4
 ARG OWNER
 ARG BINARY
 ARG TARGETARCH
+ARG VERSION
 
 RUN apk add --no-cache curl tar && \
   case "${TARGETARCH}" in \
@@ -13,7 +14,7 @@ RUN apk add --no-cache curl tar && \
     arm64) ARCH=arm64 ;; \
     *) ARCH="${TARGETARCH}" ;; \
   esac && \
-  curl -sSL "https://github.com/${OWNER}/${BINARY}/releases/latest/download/${BINARY}_Linux_${ARCH}.tar.gz" \
+  curl -sSL "https://github.com/${OWNER}/${BINARY}/releases/download/v${VERSION}/${BINARY}_Linux_${ARCH}.tar.gz" \
     | tar xzf - -C /usr/local/bin/ "${BINARY}"
 
 FROM gcr.io/distroless/static-debian13@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe
diff --git a/images/grafana-mcp/Dockerfile b/images/grafana-mcp/Dockerfile
index 3bf73ec..a357b51 100644
--- a/images/grafana-mcp/Dockerfile
+++ b/images/grafana-mcp/Dockerfile
@@ -6,6 +6,7 @@ FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4
 ARG OWNER
 ARG BINARY
 ARG TARGETARCH
+ARG VERSION
 
 RUN apk add --no-cache curl tar && \
   case "${TARGETARCH}" in \
@@ -13,7 +14,7 @@ RUN apk add --no-cache curl tar && \
     arm64) ARCH=arm64 ;; \
     *) ARCH="${TARGETARCH}" ;; \
   esac && \
-  curl -sSL "https://github.com/${OWNER}/${BINARY}/releases/latest/download/${BINARY}_Linux_${ARCH}.tar.gz" \
+  curl -sSL "https://github.com/${OWNER}/${BINARY}/releases/download/v${VERSION}/${BINARY}_Linux_${ARCH}.tar.gz" \
     | tar xzf - -C /usr/local/bin/ "${BINARY}"
 
 FROM gcr.io/distroless/static-debian13@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe
diff --git a/images/humble-cli/Dockerfile b/images/humble-cli/Dockerfile
index f1ddf93..4c37185 100644
--- a/images/humble-cli/Dockerfile
+++ b/images/humble-cli/Dockerfile
@@ -1,9 +1,10 @@
 FROM golang:1.27-alpine3.24@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125 AS build
-RUN apk add --no-cache curl jq tar && \
+ARG VERSION
+RUN apk add --no-cache curl tar && \
   repo_owner="smbl64" \
   repo_name="humble-cli" \
   arch=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/') && \
-  curl -sSL https://github.com/${repo_owner}/${repo_name}/releases/latest/download/humble-cli-linux-${arch}.tar.gz | tar xzf - -C /usr/local/bin/ humble-cli-linux-${arch} && \
+  curl -sSL https://github.com/${repo_owner}/${repo_name}/releases/download/v${VERSION}/humble-cli-linux-${arch}.tar.gz | tar xzf - -C /usr/local/bin/ humble-cli-linux-${arch} && \
   mv /usr/local/bin/humble-cli-linux-${arch} /usr/local/bin/humble-cli
 RUN ls -la /usr/local/bin
 
diff --git a/images/paperless-mcp/Dockerfile b/images/paperless-mcp/Dockerfile
index 599e94e..5075690 100644
--- a/images/paperless-mcp/Dockerfile
+++ b/images/paperless-mcp/Dockerfile
@@ -7,13 +7,13 @@ FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4
 
 ARG OWNER
 ARG REPO
+ARG VERSION
 
-RUN apk add --no-cache curl jq tar && \
-  TAG="$(curl -sSL "https://api.github.com/repos/${OWNER}/${REPO}/releases/latest" | jq -r .tag_name)" && \
+RUN apk add --no-cache curl tar && \
   mkdir -p /src && \
-  curl -sSL "https://github.com/${OWNER}/${REPO}/archive/refs/tags/${TAG}.tar.gz" \
+  curl -sSL "https://github.com/${OWNER}/${REPO}/archive/refs/tags/v${VERSION}.tar.gz" \
     | tar xzf - --strip-components=1 -C /src && \
-  printf '%s' "${TAG#v}" > /src/.version
+  printf '%s' "${VERSION}" > /src/.version
 
 FROM mcr.microsoft.com/dotnet/sdk:10.0@sha256:e1ffd2a92ae84c1291bc1b6887501f8af98e6331e7af6d4c8d37168c5e87a64c AS build
 
diff --git a/images/terraform-mcp/Dockerfile b/images/terraform-mcp/Dockerfile
index d480583..2cbbb1a 100644
--- a/images/terraform-mcp/Dockerfile
+++ b/images/terraform-mcp/Dockerfile
@@ -6,11 +6,11 @@ FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4
 ARG OWNER
 ARG BINARY
 ARG TARGETARCH
+ARG VERSION
 
-RUN apk add --no-cache curl jq unzip && \
-  RELEASE=$(curl -sSL "https://api.github.com/repos/${OWNER}/${BINARY}/releases/latest" | jq -r '.tag_name | split("v")[1]') && \
-  curl -sSLO "https://releases.hashicorp.com/${BINARY}/${RELEASE}/${BINARY}_${RELEASE}_linux_${TARGETARCH}.zip" && \
-  unzip -jq "${BINARY}_${RELEASE}_linux_${TARGETARCH}.zip" "${BINARY}" -d /usr/local/bin/
+RUN apk add --no-cache curl unzip && \
+  curl -sSLO "https://releases.hashicorp.com/${BINARY}/${VERSION}/${BINARY}_${VERSION}_linux_${TARGETARCH}.zip" && \
+  unzip -jq "${BINARY}_${VERSION}_linux_${TARGETARCH}.zip" "${BINARY}" -d /usr/local/bin/
 
 FROM gcr.io/distroless/static-debian13@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe