Pinned Ghost-CLI install to shipped lockfile versions

[acburdine]

ref https://linear.app/ghost/issue/PLA-324

• install Ghost-CLI from source rather than npm so we can install deps with pnpm
• add Ghost-CLI sha unwrapping to versions.sh
• remove pnpm/node-gyp leftover caches from Ghost install

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5400b5af-5ce1-4f9e-bd0e-15e525d76ef5

📥 Commits

Reviewing files that changed from the base of the PR and between 4ef4edb and f234999.

📒 Files selected for processing (5)

• 6/alpine3.23/Dockerfile
• 6/bookworm/Dockerfile
• Dockerfile.template
• versions.json
• versions.sh

---

Walkthrough

The version tooling now resolves the Ghost-CLI stable tag to a commit SHA and stores it with the CLI version. The Dockerfile template and generated Alpine and Bookworm Dockerfiles install Ghost-CLI from that pinned commit with frozen pnpm dependencies. They verify the package version, link the executable, remove build dependencies and package-manager caches, and use ENV KEY=value syntax.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• TryGhost/docker-library-ghost#477: Updates Ghost-CLI version metadata and Dockerfile installation to a pinned source commit.

Suggested reviewers: docker-library-bot, ghost-slimer

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: installing Ghost-CLI from pinned lockfile versions.
Description check	✅ Passed	The description accurately covers the source installation, SHA handling, and cache cleanup changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/cli-pin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}