From ab37c5403a1f6983e930d9519d91f8d5feb63a56 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 27 Jun 2026 16:26:39 +0100
Subject: [PATCH] docker: hardcode BUILD_ENV_IMAGE tag in COPY --from=

'COPY --from=${BUILD_ENV_IMAGE}' is rejected by BuildKit:
  failed to solve: failed to parse stage name "${BUILD_ENV_IMAGE}":
    invalid reference format: repository name
    (library/${BUILD_ENV_IMAGE}) must be lowercase

A COPY --from= can only reference either a local stage of the
same Dockerfile, or a static image reference. ARG interpolation
in the stage name is not supported.

Replace the ARG + interpolation with the pinned tag in all
three Dockerfile.runtime* files. Bumping the build-env image
now means updating Dockerfile, Dockerfile.backend, and the three
Dockerfile.runtime* in lockstep.
---
 Dockerfile.runtime       | 9 ++++-----
 Dockerfile.runtime.api   | 3 +--
 Dockerfile.runtime.blogs | 3 +--
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/Dockerfile.runtime b/Dockerfile.runtime
index 84f743d8..984d5eee 100644
--- a/Dockerfile.runtime
+++ b/Dockerfile.runtime
@@ -31,11 +31,10 @@ FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
 
 WORKDIR /app
 
-# 1. Copier l'artefact publié depuis l'image de build. On ne référence
-#    pas pazof/yavsc-build-env:latest directement — le contexte de
-#    build (compose ou CI) contrôle quelle image source est utilisée.
-ARG BUILD_ENV_IMAGE=pazof/yavsc-build-env:debian12-dotnet10-android36-v1
-COPY --from=${BUILD_ENV_IMAGE} /app/publish/Yavsc.Org/ ./
+# 1. Copier l'artefact publié depuis l'image de build. On référence
+#    l'image de build par son tag pinné : changer le tag veut dire
+#    modifier les trois Dockerfile.runtime* en même temps.
+COPY --from=pazof/yavsc-build-env:debian12-dotnet10-android36-v1 /app/publish/Yavsc.Org/ ./
 
 # 2. appsettings-org.json : injecté via BuildKit secret mount.
 #    Le /run/secrets/... est un tmpfs éphémère, on copie dans /app puis
diff --git a/Dockerfile.runtime.api b/Dockerfile.runtime.api
index 2090730b..e0b2bd25 100644
--- a/Dockerfile.runtime.api
+++ b/Dockerfile.runtime.api
@@ -15,8 +15,7 @@ FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
 
 WORKDIR /app
 
-ARG BUILD_ENV_IMAGE=pazof/yavsc-build-env:debian12-dotnet10-android36-v1
-COPY --from=${BUILD_ENV_IMAGE} /app/publish/Yavsc.Api/ ./
+COPY --from=pazof/yavsc-build-env:debian12-dotnet10-android36-v1 /app/publish/Yavsc.Api/ ./
 
 RUN --mount=type=secret,id=yavsc_appsettings,dst=/run/secrets/yavsc_appsettings \
     cp /run/secrets/yavsc_appsettings /app/appsettings-org.json \
diff --git a/Dockerfile.runtime.blogs b/Dockerfile.runtime.blogs
index b3827b5c..33e515f9 100644
--- a/Dockerfile.runtime.blogs
+++ b/Dockerfile.runtime.blogs
@@ -16,8 +16,7 @@ FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
 
 WORKDIR /app
 
-ARG BUILD_ENV_IMAGE=pazof/yavsc-build-env:debian12-dotnet10-android36-v1
-COPY --from=${BUILD_ENV_IMAGE} /app/publish/Yavsc.Blogs/ ./
+COPY --from=pazof/yavsc-build-env:debian12-dotnet10-android36-v1 /app/publish/Yavsc.Blogs/ ./
 
 RUN --mount=type=secret,id=yavsc_appsettings,dst=/run/secrets/yavsc_appsettings \
     cp /run/secrets/yavsc_appsettings /app/appsettings-org.json \