ci: install pinned image test dependency

.gitea/workflows/quality.yml

@@ -24,7 +24,9 @@ jobs:
           node-version: 22
           cache: npm
       - name: Install reproducibly
-        run: npm ci
+        run: |
+          npm ci
+          python3 -m pip install --break-system-packages -r requirements-test.txt
       - name: Install browser
         run: npx playwright install --with-deps chromium
       - name: Unit and security tests

requirements-test.txt

@@ -0,0 +1 @@
+Pillow==12.3.0

tests/ci-workflow.test.js

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises';
 
 const workflowPath = new URL('../.gitea/workflows/quality.yml', import.meta.url);
 const diffCheckPath = new URL('../scripts/check_diff.sh', import.meta.url);
+const pythonRequirementsPath = new URL('../requirements-test.txt', import.meta.url);
 
 test('Gitea CI gates pull requests and main with the reproducible quality suite', async () => {
   const workflow = await readFile(workflowPath, 'utf8');
@@ -14,6 +15,7 @@ test('Gitea CI gates pull requests and main with the reproducible quality suite'
   assert.match(workflow, /^    timeout-minutes: 15$/m);
   assert.match(workflow, /fetch-depth: 0/);
   assert.match(workflow, /npm ci/);
+  assert.match(workflow, /python3 -m pip install --break-system-packages -r requirements-test\.txt/);
   assert.match(workflow, /npm test/);
   assert.match(workflow, /npm run test:ui/);
   assert.match(workflow, /npm run test:photo/);
@@ -22,6 +24,12 @@ test('Gitea CI gates pull requests and main with the reproducible quality suite'
   assert.match(workflow, /npm run check:diff/);
 });
 
+test('CI pins the Python image dependency required by the full unit suite', async () => {
+  const requirements = await readFile(pythonRequirementsPath, 'utf8');
+
+  assert.match(requirements, /^Pillow==12\.3\.0$/m);
+});
+
 test('diff hygiene checks only the pull request or latest commit range', async () => {
   const script = await readFile(diffCheckPath, 'utf8');