#236: also pin the node helper images in workflows

release.yml and drill.yml ran throwaway `docker run node:22.15-alpine`
helpers outside the pin; the drift check now also fails on any
node:<other>-alpine reference in .gitea/workflows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

.gitea/workflows/ci.yml

@@ -81,6 +81,10 @@ jobs:
             echo "workflows must use node-version-file, not a literal version"
             bad=1
           fi
+          if grep -rnE 'node:[0-9][^ ]*-alpine' .gitea/workflows | grep -v "node:${ver}-alpine"; then
+            echo "a workflow references a different node image than node:${ver}-alpine"
+            bad=1
+          fi
           if ! grep -q "\"node\": \">=${ver}\"" package.json; then
             echo "package.json engines floor does not match ${ver}"
             bad=1

.gitea/workflows/drill.yml

@@ -55,7 +55,7 @@ jobs:
           } > comment.md
           # JSON-encode via a node container — the runner image guarantees
           # only git/curl/docker, not python or node.
-          docker run --rm -i node:22.15-alpine node -e \
+          docker run --rm -i node:22.15.1-alpine node -e \
             'const fs=require("fs");process.stdout.write(JSON.stringify({body:fs.readFileSync(0,"utf8")}))' \
             < comment.md > comment.json
           curl -sf -X POST \

.gitea/workflows/release.yml

@@ -54,7 +54,7 @@ jobs:
               echo '_No database migrations in this release._'
             fi
           } > notes.md
-          TAG=$TAG docker run --rm -i -e TAG node:22.15-alpine node -e \
+          TAG=$TAG docker run --rm -i -e TAG node:22.15.1-alpine node -e \
             'const fs=require("fs");const body=fs.readFileSync(0,"utf8");process.stdout.write(JSON.stringify({tag_name:process.env.TAG,name:process.env.TAG,body}))' \
             < notes.md > release.json
           curl -sf -X POST \