fix(ci): pin release validation dependency images

Author: mahmut-Abi

.github/workflows/release.yml

@@ -31,6 +31,8 @@ jobs:
       checkout_ref: ${{ steps.vars.outputs.checkout_ref }}
       control_image: ${{ steps.vars.outputs.control_image }}
       control_image_name: ${{ steps.vars.outputs.control_image_name }}
+      dataplane_image: ${{ steps.vars.outputs.dataplane_image }}
+      dashboard_image: ${{ steps.vars.outputs.dashboard_image }}
 
     steps:
       - name: Compute release metadata
@@ -51,12 +53,16 @@ jobs:
           checkout_ref="refs/tags/${release_tag}"
           control_image_name="ghcr.io/${owner_lc}/nantian-controlplane"
           control_image="${control_image_name}:${release_tag}"
+          dataplane_image="ghcr.io/${owner_lc}/dataplane:${release_tag}"
+          dashboard_image="ghcr.io/${owner_lc}/dashboard:${release_tag}"
 
           {
             echo "release_tag=${release_tag}"
             echo "checkout_ref=${checkout_ref}"
             echo "control_image=${control_image}"
             echo "control_image_name=${control_image_name}"
+            echo "dataplane_image=${dataplane_image}"
+            echo "dashboard_image=${dashboard_image}"
           } >>"${GITHUB_OUTPUT}"
 
   security-scans:
@@ -106,8 +112,8 @@ jobs:
       CLUSTER_NAME: release-validation
       GATEWAY_API_VERSION: v1.5.1
       CONTROLPLANE_IMAGE: ${{ needs.metadata.outputs.control_image }}
-      DATAPLANE_IMAGE: ghcr.io/nantian-gw/dataplane:latest
-      DASHBOARD_IMAGE: ghcr.io/nantian-gw/dashboard:latest
+      DATAPLANE_IMAGE: ${{ needs.metadata.outputs.dataplane_image }}
+      DASHBOARD_IMAGE: ${{ needs.metadata.outputs.dashboard_image }}
       CONFORMANCE_EXPERIMENTAL: "true"
       ALL_FEATURES: "true"
 

scripts/ci/ci_assets_test.go

@@ -193,6 +193,30 @@ func TestReleaseWorkflowUsesCurrentCIEntrypoints(t *testing.T) {
 	}
 }
 
+func TestReleaseWorkflowUsesReleaseTaggedDependencyImages(t *testing.T) {
+	contents := string(readFile(t, repoPath(".github", "workflows", "release.yml")))
+
+	for _, want := range []string{
+		`dataplane_image: ${{ steps.vars.outputs.dataplane_image }}`,
+		`dashboard_image: ${{ steps.vars.outputs.dashboard_image }}`,
+		`DATAPLANE_IMAGE: ${{ needs.metadata.outputs.dataplane_image }}`,
+		`DASHBOARD_IMAGE: ${{ needs.metadata.outputs.dashboard_image }}`,
+	} {
+		if !strings.Contains(contents, want) {
+			t.Fatalf("release workflow missing %q", want)
+		}
+	}
+
+	for _, unwanted := range []string{
+		`DATAPLANE_IMAGE: ghcr.io/nantian-gw/dataplane:latest`,
+		`DASHBOARD_IMAGE: ghcr.io/nantian-gw/dashboard:latest`,
+	} {
+		if strings.Contains(contents, unwanted) {
+			t.Fatalf("release workflow must not pin dependency image to %q", unwanted)
+		}
+	}
+}
+
 func TestSecurityScanWorkflowUsesExistingHelper(t *testing.T) {
 	contents := string(readFile(t, repoPath(".github", "workflows", "security-scans.yml")))
 	helperPath := repoPath("scripts", "ci", "run-security-scans.sh")