From 5d581a35e49f93bf2f0aa36df0419fc6bc0141a6 Mon Sep 17 00:00:00 2001
From: Matthias Mair <code@mjmair.com>
Date: Fri, 26 Jun 2026 01:55:36 +0200
Subject: [PATCH] chore(backend): harden gh setup (#12262)

* pin plugin creator version

* hard pin install script
---
 .github/workflows/frontend.yaml | 5 +++--
 contrib/container/Dockerfile    | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/frontend.yaml b/.github/workflows/frontend.yaml
index 2585d982d9..7065f6f054 100644
--- a/.github/workflows/frontend.yaml
+++ b/.github/workflows/frontend.yaml
@@ -15,6 +15,7 @@ on:
 env:
   python_version: 3.12
   node_version: 24
+  plugin_creator_version: 1.20.0
   # The OS version must be set per job
   server_start_sleep: 60
 
@@ -153,7 +154,7 @@ jobs:
         run: cd src/frontend && npx playwright install-deps
       - name: Install Sample Plugin
         run: |
-          pip install -U inventree-plugin-creator
+          pip install -U inventree-plugin-creator==${{ env.plugin_creator_version }}
           create-inventree-plugin --default
           cd MyCustomPlugin && pip install -e . && cd frontend && npm install && npm run translate && npm run build
       - name: Run Playwright tests
@@ -235,7 +236,7 @@ jobs:
         run: cd src/frontend && npx playwright install-deps
       - name: Install Sample Plugin
         run: |
-          pip install -U inventree-plugin-creator
+          pip install -U inventree-plugin-creator==${{ env.plugin_creator_version }}
           create-inventree-plugin --default
           cd MyCustomPlugin && pip install -e . && cd frontend && npm install && npm run translate && npm run build
       - name: Playwright [${{ matrix.shard }} / 4]
diff --git a/contrib/container/Dockerfile b/contrib/container/Dockerfile
index 16418375e6..de1ab6ce8e 100644
--- a/contrib/container/Dockerfile
+++ b/contrib/container/Dockerfile
@@ -119,7 +119,8 @@ RUN pip install --user --require-hashes -r base_requirements.txt --no-cache-dir
     rm -rf /root/.cache/pip
 
 # Install frontend build dependencies
-RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.5/install.sh | bash && \
+# pinned to v0.40.5
+RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/1889911f0841e669de0be5bd02c737a3f1fd20fa/install.sh | bash && \
     bash -c "export NVM_DIR="$HOME/.nvm" && source $HOME/.nvm/nvm.sh && \
     nvm install $NODE_VERSION && corepack enable yarn && yarn config set network-timeout 600000 -g"
 RUN bash -c "source $HOME/.nvm/nvm.sh && cd '${INVENTREE_HOME}' && invoke int.frontend-compile --extract"