From 16a804b80b1bb50e4869c90ef42790ee5b819a04 Mon Sep 17 00:00:00 2001
From: Erich Blume <blume.erich@gmail.com>
Date: Fri, 20 Feb 2026 19:58:26 -0800
Subject: [PATCH] Pin container versions for devpi, cv, and quartz

- devpi: Pin devpi-server==6.19.1 and devpi-web==5.0.1
- cv: Add ARG CV_VERSION=1.0.3 (matches latest Forgejo package release)
- quartz: Pin nginx base to 1.28.2-alpine (ARG NGINX_VERSION)
- Update service-versions.yaml with correct version values
- Mark pin-container-versions Mikado card as complete

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 containers/cv/Dockerfile                  | 2 ++
 containers/devpi/Dockerfile               | 7 ++++++-
 containers/quartz/Dockerfile              | 4 +++-
 docs/how-to/zot/pin-container-versions.md | 1 -
 service-versions.yaml                     | 8 ++++----
 5 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/containers/cv/Dockerfile b/containers/cv/Dockerfile
index a36f8bc..e9ab6eb 100644
--- a/containers/cv/Dockerfile
+++ b/containers/cv/Dockerfile
@@ -6,6 +6,8 @@
 #
 # The container downloads the tarball on startup, extracts it, and serves with nginx.
 
+ARG CV_VERSION=1.0.3
+
 FROM nginx:alpine
 
 # Install curl for downloading release assets
diff --git a/containers/devpi/Dockerfile b/containers/devpi/Dockerfile
index 6c9cdc8..feb4451 100644
--- a/containers/devpi/Dockerfile
+++ b/containers/devpi/Dockerfile
@@ -1,7 +1,12 @@
 FROM python:3.12-slim
 
+ARG DEVPI_SERVER_VERSION=6.19.1
+ARG DEVPI_WEB_VERSION=5.0.1
+
 # Install devpi-server and devpi-web
-RUN pip install --no-cache-dir devpi-server devpi-web
+RUN pip install --no-cache-dir \
+    devpi-server==${DEVPI_SERVER_VERSION} \
+    devpi-web==${DEVPI_WEB_VERSION}
 
 # Create non-root user
 RUN useradd -r -u 1000 devpi && mkdir -p /devpi && chown devpi:devpi /devpi
diff --git a/containers/quartz/Dockerfile b/containers/quartz/Dockerfile
index 63e5757..ccea993 100644
--- a/containers/quartz/Dockerfile
+++ b/containers/quartz/Dockerfile
@@ -6,7 +6,9 @@
 #
 # The container downloads the tarball on startup, extracts it, and serves with nginx.
 
-FROM nginx:alpine
+ARG NGINX_VERSION=1.28.2
+
+FROM nginx:${NGINX_VERSION}-alpine
 
 # Install curl for downloading release assets
 RUN apk add --no-cache curl
diff --git a/docs/how-to/zot/pin-container-versions.md b/docs/how-to/zot/pin-container-versions.md
index 30bce73..3c6d61a 100644
--- a/docs/how-to/zot/pin-container-versions.md
+++ b/docs/how-to/zot/pin-container-versions.md
@@ -1,7 +1,6 @@
 ---
 title: Pin Container Versions
 modified: 2026-02-20
-status: active
 tags:
   - how-to
   - containers
diff --git a/service-versions.yaml b/service-versions.yaml
index dee07c7..21aed07 100644
--- a/service-versions.yaml
+++ b/service-versions.yaml
@@ -169,22 +169,22 @@ services:
   - name: devpi
     type: hybrid
     last-reviewed: null
-    current-version: null
+    current-version: "6.19.1"
     upstream-source: https://github.com/devpi/devpi/releases
 
   - name: cv
     type: hybrid
     last-reviewed: null
-    current-version: null
+    current-version: "1.0.3"
     upstream-source: null
     notes: Personal static site, no upstream
 
   - name: docs
     type: hybrid
     last-reviewed: null
-    current-version: null
+    current-version: "1.28.2"
     upstream-source: https://github.com/jackyzha0/quartz/releases
-    notes: Quartz static site generator
+    notes: Quartz static site generator; container version tracks nginx base
 
   - name: forgejo-runner
     type: hybrid