From 47eec47a310ff8df13a857feec24978e92379e90 Mon Sep 17 00:00:00 2001
From: Timmy <timmy@stackchain.ai>
Date: Wed, 19 Aug 2026 08:14:43 +0000
Subject: [PATCH] ci: install pinned image test dependency

---
 .gitea/workflows/quality.yml | 4 +++-
 requirements-test.txt        | 1 +
 tests/ci-workflow.test.js    | 8 ++++++++
 3 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 requirements-test.txt

diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml
index a1230e5..1ebb92a 100644
--- a/.gitea/workflows/quality.yml
+++ b/.gitea/workflows/quality.yml
@@ -24,7 +24,9 @@ jobs:
           node-version: 22
           cache: npm
       - name: Install reproducibly
-        run: npm ci
+        run: |
+          npm ci
+          python3 -m pip install --break-system-packages -r requirements-test.txt
       - name: Install browser
         run: npx playwright install --with-deps chromium
       - name: Unit and security tests
diff --git a/requirements-test.txt b/requirements-test.txt
new file mode 100644
index 0000000..e7cc6c1
--- /dev/null
+++ b/requirements-test.txt
@@ -0,0 +1 @@
+Pillow==12.3.0
diff --git a/tests/ci-workflow.test.js b/tests/ci-workflow.test.js
index e8f8cc0..4ec3878 100644
--- a/tests/ci-workflow.test.js
+++ b/tests/ci-workflow.test.js
@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises';
 
 const workflowPath = new URL('../.gitea/workflows/quality.yml', import.meta.url);
 const diffCheckPath = new URL('../scripts/check_diff.sh', import.meta.url);
+const pythonRequirementsPath = new URL('../requirements-test.txt', import.meta.url);
 
 test('Gitea CI gates pull requests and main with the reproducible quality suite', async () => {
   const workflow = await readFile(workflowPath, 'utf8');
@@ -14,6 +15,7 @@ test('Gitea CI gates pull requests and main with the reproducible quality suite'
   assert.match(workflow, /^    timeout-minutes: 15$/m);
   assert.match(workflow, /fetch-depth: 0/);
   assert.match(workflow, /npm ci/);
+  assert.match(workflow, /python3 -m pip install --break-system-packages -r requirements-test\.txt/);
   assert.match(workflow, /npm test/);
   assert.match(workflow, /npm run test:ui/);
   assert.match(workflow, /npm run test:photo/);
@@ -22,6 +24,12 @@ test('Gitea CI gates pull requests and main with the reproducible quality suite'
   assert.match(workflow, /npm run check:diff/);
 });
 
+test('CI pins the Python image dependency required by the full unit suite', async () => {
+  const requirements = await readFile(pythonRequirementsPath, 'utf8');
+
+  assert.match(requirements, /^Pillow==12\.3\.0$/m);
+});
+
 test('diff hygiene checks only the pull request or latest commit range', async () => {
   const script = await readFile(diffCheckPath, 'utf8');