fix(pullImage): force pull when platform is requested

Cubic flagged on PR #1856 that the `image inspect` cache-check inside
pullImage is platform-agnostic — a different-arch variant of the same
image name will satisfy it, so the requested platform silently
diverges from what's actually on disk.

Fix: short-circuit the cache check when `imagePlatform` is set and
always invoke the explicit pull (which then carries `--platform` to
docker). Pulls are idempotent: if the requested variant is already
local, `docker pull` returns "Image is up to date" quickly.

Tightens the integration test by dropping `pullPolicy: "always"` —
the new short-circuit is now the path under test.

Identified by cubic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: inistor

src/job.ts

@@ -1265,6 +1265,16 @@ If you know what you're doing and would like to suppress this warning, use one o
             await actualPull();
             return;
         }
+        // The `image inspect` cache check is platform-agnostic — a different-arch
+        // variant of the same image name will satisfy it, causing the requested
+        // platform to silently differ from what's actually on disk. Force a pull
+        // when a specific platform was requested so the matching manifest is
+        // guaranteed locally. Pulls are idempotent: if the variant is already
+        // cached, `docker pull` short-circuits with "Image is up to date".
+        if (imagePlatform) {
+            await actualPull();
+            return;
+        }
         try {
             await Utils.spawn([this.argv.containerExecutable, "image", "inspect", imageToPull]);
         } catch {

tests/test-cases/image/integration.test.ts

@@ -132,15 +132,17 @@ test.concurrent("image <image-platform>", async () => {
     const writeStreams = new WriteStreamsMock();
 
     await handler({
-        pullPolicy: "always",
         cwd: "tests/test-cases/image",
         job: ["image-platform"],
         stateDir: ".gitlab-ci-local-image-platform",
     }, writeStreams);
 
     // The "pulled" log line includes the requested platform, proving --platform
     // was forwarded to `docker pull` rather than silently dropped. Use `.*` to
-    // span the chalk ANSI escape codes between tokens.
+    // span the chalk ANSI escape codes between tokens. We deliberately don't
+    // pass `pullPolicy: "always"` — the platform-aware short-circuit inside
+    // pullImage forces a pull whenever a platform is set, regardless of whether
+    // a different-arch variant of the same image happens to be cached locally.
     expect(writeStreams.stdoutLines.join("\n")).toMatch(/pulled.*alpine.*linux\/amd64/);
 
     // The job runs successfully on the host (linux/amd64 matches the CI runner arch).