Koosha Paridehpour 7da6e10c4e fix(docker): pin 4 CLI tools to exact versions (#12576) (#12703) ...

Merged. Verified all four pins resolve on npm before landing:

```
@openai/codex@0.153.2              0.153.2
@anthropic-ai/claude-code@2.1.260  2.1.260
droid@0.212.0                      0.212.0
openclaw@2026.9.1                  2026.9.1
```

The reproducibility argument holds — a floating `@latest` in a cached Docker layer means two builds of the same commit can ship different toolchains, and that is exactly the class of drift that makes a CI failure unattributable.

Worth flagging for whoever maintains this next: pinning trades drift for staleness, so these four now need a periodic bump or the image ships increasingly old CLIs. The comment block you added explains the why, which makes that bump a safe mechanical change instead of a judgment call.

Rebased onto `release/v3.8.51` (the PR was cut from `main`, ~3695 commits behind). Thanks.

2026-09-05 02:34:20 -03:00

20 KiB

Raw Blame History

View Raw