chore: move to tagging builds

Dockerfile

@@ -1,41 +1,55 @@
-# Base image
-FROM debian:trixie-slim
+# ==============================
+# Stage 1: Builder
+# ==============================
+FROM debian:trixie-slim@sha256:c85a2732e97694ea77237c61304b3bb410e0e961dd6ee945997a06c788c545bb AS builder
 
-# Set environment variables (DEBIAN_FRONTEND and LANG)
+# Set environment variables for noninteractive install
 ENV DEBIAN_FRONTEND=noninteractive \
     LANG=C.UTF-8
 
-# Install system dependencies
+# Install build and runtime dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    git \
-    bash \
-    openssh-client \
-    python3 \
-    python3-venv \
-    build-essential \
-    zlib1g-dev \
-    libffi-dev \
-    libssl-dev \
-    ruby-full \
-    ca-certificates \
+    python3 python3-venv build-essential \
+    curl git bash openssh-client \
+    ruby-full zlib1g-dev libffi-dev libssl-dev ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Node.js 22
+# Install Node.js 22 (latest patch for 22.x)
 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y nodejs \
     && npm install -g npm \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Jekyll and Bundler
+# Install Ruby gems: Jekyll and Bundler
 RUN gem install bundler jekyll
 
 # Create Python virtual environment for Ansible
 RUN python3 -m venv /opt/venv \
-    && /opt/venv/bin/pip install --no-cache-dir --upgrade pip ansible
+    && /opt/venv/bin/pip install --no-cache-dir --upgrade pip ansible==8.*
 
-# Update PATH globally for all shells/steps
-ENV PATH=/usr/local/bundle/bin:/opt/venv/bin:$PATH
+# ==============================
+# Stage 2: Runtime
+# ==============================
+FROM debian:trixie-slim@sha256:c85a2732e97694ea77237c61304b3bb410e0e961dd6ee945997a06c788c545bb
+
+# Set environment variables
+ENV DEBIAN_FRONTEND=noninteractive \
+    LANG=C.UTF-8 \
+    PATH=/usr/local/bundle/bin:/opt/venv/bin:$PATH
+
+# Install minimal runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 python3-venv \
+    curl git bash openssh-client \
+    ruby-full ca-certificates \
+    nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy built tools from builder
+COPY --from=builder /opt/venv /opt/venv
+COPY --from=builder /usr/local/bundle /usr/local/bundle
+COPY --from=builder /usr/lib/node_modules /usr/lib/node_modules
+COPY --from=builder /usr/bin/node /usr/bin/node
 
 # Create workspace
 WORKDIR /workspace
@@ -43,3 +57,5 @@ WORKDIR /workspace
 # Default shell
 SHELL ["/bin/bash", "-c"]
 
+# Expose environment for scripts
+ENV PATH="/opt/venv/bin:/usr/local/bundle/bin:$PATH"