fix: pin the E2E backend SHA in the frontend contract

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/ci.yml

@@ -54,8 +54,9 @@ jobs:
       - name: Require pinned backend ref (SHA or tag)
         run: |
           if [ -z "${E2E_BACKEND_REF}" ]; then
-            echo "Set repository variable E2E_BACKEND_REF to a backend commit SHA. No fallback to main."
-            exit 1
+            E2E_BACKEND_REF="$(node -e "const c=require('./e2e/backend.contract.json'); const r=String(c.pinnedRef||''); if(!/^[0-9a-f]{40}$/i.test(r)){console.error('pinnedRef must be a full SHA'); process.exit(1)} process.stdout.write(r)")"
+            echo "E2E_BACKEND_REF=${E2E_BACKEND_REF}" >> "$GITHUB_ENV"
+            echo "Repository variable unset; using committed pinnedRef"
           fi
           echo "E2E_BACKEND_REF=${E2E_BACKEND_REF}"
 

e2e/backend.contract.json

@@ -2,5 +2,6 @@
   "repositoryUrl": "https://get.feep.ir/gold_land/gold_land_server.git",
   "checkoutPath": "backend-nest",
   "localRef": "",
-  "notes": "CI: set variable E2E_BACKEND_REF to backend commit SHA (required). Local clone: set E2E_BACKEND_REF or localRef. Local sibling: set E2E_BACKEND_ROOT to ../backend-nest and skip ci:checkout-backend."
+  "pinnedRef": "dfb20ca92cb13f1d25c6aca64b6256c09176e603",
+  "notes": "CI uses E2E_BACKEND_REF when set, otherwise pinnedRef (full SHA only). Never falls back to main. Local sibling: E2E_BACKEND_ROOT=../backend-nest and skip ci:checkout-backend."
 }

scripts/ci-checkout-backend.mjs

@@ -18,20 +18,22 @@ if (!existsSync(contractPath)) {
   process.exit(1)
 }
 
-/** @type {{ repositoryUrl: string; checkoutPath: string; localRef?: string }} */
+/** @type {{ repositoryUrl: string; checkoutPath: string; localRef?: string; pinnedRef?: string }} */
 const contract = JSON.parse(readFileSync(contractPath, 'utf8'))
 
 const envRef = process.env.E2E_BACKEND_REF?.trim()
 let ref = envRef
 
-if (isCi) {
-  if (!ref) {
+if (isCi && !ref) {
+  ref = contract.pinnedRef?.trim()
+  if (!/^[0-9a-f]{40}$/i.test(ref ?? '')) {
     console.error(
-      'E2E backend ref is required in CI. Set repository variable E2E_BACKEND_REF to a full commit SHA (or immutable tag). Silent fallback to main is disabled.',
+      'E2E backend ref is required in CI. Set E2E_BACKEND_REF or pinnedRef in e2e/backend.contract.json to a full commit SHA. Silent fallback to main is disabled.',
     )
     process.exit(1)
   }
-} else if (!ref) {
+  console.log('E2E_BACKEND_REF unset; using committed pinnedRef')
+} else if (!isCi && !ref) {
   ref = contract.localRef?.trim()
   if (!ref) {
     console.error(