fix(images): build against the resolved version, not latest

images/ansible-mcp/Dockerfile

@@ -1,7 +1,8 @@
 FROM node:24-alpine3.24@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf AS build
 
+ARG VERSION
 WORKDIR /app
-RUN npm install @ansible/ansible-mcp-server
+RUN npm install @ansible/ansible-mcp-server@${VERSION}
 
 FROM gcr.io/distroless/nodejs24-debian13@sha256:7cca079bad19303c78cd874a5da79832441985a216b767196507d69b8784a698
 COPY --from=build /app /app

images/context7-mcp/Dockerfile

@@ -1,7 +1,8 @@
 FROM node:24-alpine3.24@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf AS build
 
+ARG VERSION
 WORKDIR /app
-RUN npm install @upstash/context7-mcp
+RUN npm install @upstash/context7-mcp@${VERSION}
 
 FROM gcr.io/distroless/nodejs24-debian13@sha256:7cca079bad19303c78cd874a5da79832441985a216b767196507d69b8784a698
 COPY --from=build /app /app

images/flux-mcp/Dockerfile

@@ -8,10 +8,10 @@ ARG OWNER
 ARG BINARY
 ARG REPOSITORY
 ARG TARGETARCH
+ARG VERSION
 
-RUN apk add --no-cache curl jq tar && \
-  RELEASE=$(curl -sSL https://api.github.com/repos/${OWNER}/${REPOSITORY}/releases/latest | jq -r '.tag_name | split("v")[1]') && \
-  curl -sSL "https://github.com/${OWNER}/${REPOSITORY}/releases/latest/download/${BINARY}_${RELEASE}_linux_${TARGETARCH}.tar.gz" \
+RUN apk add --no-cache curl tar && \
+  curl -sSL "https://github.com/${OWNER}/${REPOSITORY}/releases/download/v${VERSION}/${BINARY}_${VERSION}_linux_${TARGETARCH}.tar.gz" \
     | tar xzf - -C /usr/local/bin/ "${BINARY}"
 
 FROM gcr.io/distroless/static-debian13@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe

images/github-mcp/Dockerfile

@@ -6,14 +6,15 @@ FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4
 ARG OWNER
 ARG BINARY
 ARG TARGETARCH
+ARG VERSION
 
 RUN apk add --no-cache curl tar && \
   case "${TARGETARCH}" in \
     amd64) ARCH=x86_64 ;; \
     arm64) ARCH=arm64 ;; \
     *) ARCH="${TARGETARCH}" ;; \
   esac && \
-  curl -sSL "https://github.com/${OWNER}/${BINARY}/releases/latest/download/${BINARY}_Linux_${ARCH}.tar.gz" \
+  curl -sSL "https://github.com/${OWNER}/${BINARY}/releases/download/v${VERSION}/${BINARY}_Linux_${ARCH}.tar.gz" \
     | tar xzf - -C /usr/local/bin/ "${BINARY}"
 
 FROM gcr.io/distroless/static-debian13@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe

images/grafana-mcp/Dockerfile

@@ -6,14 +6,15 @@ FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4
 ARG OWNER
 ARG BINARY
 ARG TARGETARCH
+ARG VERSION
 
 RUN apk add --no-cache curl tar && \
   case "${TARGETARCH}" in \
     amd64) ARCH=x86_64 ;; \
     arm64) ARCH=arm64 ;; \
     *) ARCH="${TARGETARCH}" ;; \
   esac && \
-  curl -sSL "https://github.com/${OWNER}/${BINARY}/releases/latest/download/${BINARY}_Linux_${ARCH}.tar.gz" \
+  curl -sSL "https://github.com/${OWNER}/${BINARY}/releases/download/v${VERSION}/${BINARY}_Linux_${ARCH}.tar.gz" \
     | tar xzf - -C /usr/local/bin/ "${BINARY}"
 
 FROM gcr.io/distroless/static-debian13@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe

images/humble-cli/Dockerfile

@@ -1,9 +1,10 @@
 FROM golang:1.27-alpine3.24@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125 AS build
-RUN apk add --no-cache curl jq tar && \
+ARG VERSION
+RUN apk add --no-cache curl tar && \
   repo_owner="smbl64" \
   repo_name="humble-cli" \
   arch=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/') && \
-  curl -sSL https://github.com/${repo_owner}/${repo_name}/releases/latest/download/humble-cli-linux-${arch}.tar.gz | tar xzf - -C /usr/local/bin/ humble-cli-linux-${arch} && \
+  curl -sSL https://github.com/${repo_owner}/${repo_name}/releases/download/v${VERSION}/humble-cli-linux-${arch}.tar.gz | tar xzf - -C /usr/local/bin/ humble-cli-linux-${arch} && \
   mv /usr/local/bin/humble-cli-linux-${arch} /usr/local/bin/humble-cli
 RUN ls -la /usr/local/bin
 

images/paperless-mcp/Dockerfile

@@ -7,13 +7,13 @@ FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4
 
 ARG OWNER
 ARG REPO
+ARG VERSION
 
-RUN apk add --no-cache curl jq tar && \
-  TAG="$(curl -sSL "https://api.github.com/repos/${OWNER}/${REPO}/releases/latest" | jq -r .tag_name)" && \
+RUN apk add --no-cache curl tar && \
   mkdir -p /src && \
-  curl -sSL "https://github.com/${OWNER}/${REPO}/archive/refs/tags/${TAG}.tar.gz" \
+  curl -sSL "https://github.com/${OWNER}/${REPO}/archive/refs/tags/v${VERSION}.tar.gz" \
     | tar xzf - --strip-components=1 -C /src && \
-  printf '%s' "${TAG#v}" > /src/.version
+  printf '%s' "${VERSION}" > /src/.version
 
 FROM mcr.microsoft.com/dotnet/sdk:10.0@sha256:e1ffd2a92ae84c1291bc1b6887501f8af98e6331e7af6d4c8d37168c5e87a64c AS build
 

images/terraform-mcp/Dockerfile

@@ -6,11 +6,11 @@ FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4
 ARG OWNER
 ARG BINARY
 ARG TARGETARCH
+ARG VERSION
 
-RUN apk add --no-cache curl jq unzip && \
-  RELEASE=$(curl -sSL "https://api.github.com/repos/${OWNER}/${BINARY}/releases/latest" | jq -r '.tag_name | split("v")[1]') && \
-  curl -sSLO "https://releases.hashicorp.com/${BINARY}/${RELEASE}/${BINARY}_${RELEASE}_linux_${TARGETARCH}.zip" && \
-  unzip -jq "${BINARY}_${RELEASE}_linux_${TARGETARCH}.zip" "${BINARY}" -d /usr/local/bin/
+RUN apk add --no-cache curl unzip && \
+  curl -sSLO "https://releases.hashicorp.com/${BINARY}/${VERSION}/${BINARY}_${VERSION}_linux_${TARGETARCH}.zip" && \
+  unzip -jq "${BINARY}_${VERSION}_linux_${TARGETARCH}.zip" "${BINARY}" -d /usr/local/bin/
 
 FROM gcr.io/distroless/static-debian13@sha256:f2ea2709ac8db56323cbd7d014277f32cb572d9ea124b0076f7aafe5980678fe