From bb29cc6bdb28f61bfbeda93da52cf0d6e4c3c633 Mon Sep 17 00:00:00 2001
From: safavimohadeseh78 <safavimohadeseh78@gmail.com>
Date: Thu, 22 Oct 2026 13:01:49 +0330
Subject: [PATCH] fix: pin the E2E backend SHA in the frontend contract

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .gitea/workflows/ci.yml         |  5 +++--
 e2e/backend.contract.json       |  3 ++-
 scripts/ci-checkout-backend.mjs | 12 +++++++-----
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 22b1638..e07bc1c 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -54,8 +54,9 @@ jobs:
       - name: Require pinned backend ref (SHA or tag)
         run: |
           if [ -z "${E2E_BACKEND_REF}" ]; then
-            echo "Set repository variable E2E_BACKEND_REF to a backend commit SHA. No fallback to main."
-            exit 1
+            E2E_BACKEND_REF="$(node -e "const c=require('./e2e/backend.contract.json'); const r=String(c.pinnedRef||''); if(!/^[0-9a-f]{40}$/i.test(r)){console.error('pinnedRef must be a full SHA'); process.exit(1)} process.stdout.write(r)")"
+            echo "E2E_BACKEND_REF=${E2E_BACKEND_REF}" >> "$GITHUB_ENV"
+            echo "Repository variable unset; using committed pinnedRef"
           fi
           echo "E2E_BACKEND_REF=${E2E_BACKEND_REF}"
 
diff --git a/e2e/backend.contract.json b/e2e/backend.contract.json
index f07ad6a..cfe0f4a 100644
--- a/e2e/backend.contract.json
+++ b/e2e/backend.contract.json
@@ -2,5 +2,6 @@
   "repositoryUrl": "https://get.feep.ir/gold_land/gold_land_server.git",
   "checkoutPath": "backend-nest",
   "localRef": "",
-  "notes": "CI: set variable E2E_BACKEND_REF to backend commit SHA (required). Local clone: set E2E_BACKEND_REF or localRef. Local sibling: set E2E_BACKEND_ROOT to ../backend-nest and skip ci:checkout-backend."
+  "pinnedRef": "dfb20ca92cb13f1d25c6aca64b6256c09176e603",
+  "notes": "CI uses E2E_BACKEND_REF when set, otherwise pinnedRef (full SHA only). Never falls back to main. Local sibling: E2E_BACKEND_ROOT=../backend-nest and skip ci:checkout-backend."
 }
diff --git a/scripts/ci-checkout-backend.mjs b/scripts/ci-checkout-backend.mjs
index 7deda53..5e2ef49 100644
--- a/scripts/ci-checkout-backend.mjs
+++ b/scripts/ci-checkout-backend.mjs
@@ -18,20 +18,22 @@ if (!existsSync(contractPath)) {
   process.exit(1)
 }
 
-/** @type {{ repositoryUrl: string; checkoutPath: string; localRef?: string }} */
+/** @type {{ repositoryUrl: string; checkoutPath: string; localRef?: string; pinnedRef?: string }} */
 const contract = JSON.parse(readFileSync(contractPath, 'utf8'))
 
 const envRef = process.env.E2E_BACKEND_REF?.trim()
 let ref = envRef
 
-if (isCi) {
-  if (!ref) {
+if (isCi && !ref) {
+  ref = contract.pinnedRef?.trim()
+  if (!/^[0-9a-f]{40}$/i.test(ref ?? '')) {
     console.error(
-      'E2E backend ref is required in CI. Set repository variable E2E_BACKEND_REF to a full commit SHA (or immutable tag). Silent fallback to main is disabled.',
+      'E2E backend ref is required in CI. Set E2E_BACKEND_REF or pinnedRef in e2e/backend.contract.json to a full commit SHA. Silent fallback to main is disabled.',
     )
     process.exit(1)
   }
-} else if (!ref) {
+  console.log('E2E_BACKEND_REF unset; using committed pinnedRef')
+} else if (!isCi && !ref) {
   ref = contract.localRef?.trim()
   if (!ref) {
     console.error(