feat(docker): pin installed docker version

Signed-off-by: Emilien Escalle <emilien.escalle@escemi.com>

Author: neilime

actions/docker/setup/README.md

@@ -59,6 +59,11 @@ Shared action to configure Docker tooling and OCI registry authentication.
     # ```
     buildkitd-config-inline: ""
 
+    # Docker version to install when Docker must be provisioned.
+    # When set, this action installs the requested version even if Docker is already available on the runner.
+    # See https://github.com/docker/setup-docker-action#inputsversion for supported formats.
+    version: ""
+
     # Optional built images payload used to resolve manifest publication registries.
     # When provided, registry authentication targets are inferred from the built image data.
     built-images: ""
@@ -92,6 +97,9 @@ Shared action to configure Docker tooling and OCI registry authentication.
 |                               | See <https://github.com/docker/setup-buildx-action#inputs>.                                                                                      |              |             |
 |                               | Example for insecure registry:                                                                                                                   |              |             |
 |                               | <!-- textlint-disable --><pre lang="ini">[registry."my-registry.local:5000"]&#13; http = true&#13; insecure = true</pre><!-- textlint-enable --> |              |             |
+| **`version`**                 | Docker version to install when Docker must be provisioned.                                                                                       | **false**    | -           |
+|                               | When set, this action installs the requested version even if Docker is already available on the runner.                                          |              |             |
+|                               | See <https://github.com/docker/setup-docker-action#inputsversion> for supported formats.                                                         |              |             |
 | **`built-images`**            | Optional built images payload used to resolve manifest publication registries.                                                                   | **false**    | -           |
 |                               | When provided, registry authentication targets are inferred from the built image data.                                                           |              |             |
 | **`setup-buildx`**            | Whether to install and configure Docker Buildx.                                                                                                  | **false**    | `true`      |

actions/docker/setup/action.yml

@@ -385,13 +385,35 @@ runs:
 
     - id: detect-docker
       uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        # FIXME: upgrade version when available (https://hub.docker.com/r/dockereng/cli-bin/tags)
+        EXPECTED_DOCKER_VERSION: 29.5.2
       with:
         script: |
           const dockerPath = await io.which('docker', false);
-          core.setOutput('exists', dockerPath ? 'true' : 'false');
 
-    - if: steps.detect-docker.outputs.exists != 'true'
+          if (!dockerPath) {
+            core.setOutput('docker-install-version', process.env.EXPECTED_DOCKER_VERSION);
+            return;
+          }
+
+          try {
+            const { stdout } = await exec.getExecOutput('docker', ['version', '--format', '{{.Server.Version}}']);
+            const dockerVersion = stdout.trim();
+
+            // Check if the detected Docker version is the same as the expected version.
+            if (dockerVersion !== process.env.EXPECTED_DOCKER_VERSION) {
+              core.setOutput('docker-install-version', process.env.EXPECTED_DOCKER_VERSION);
+            }
+          } catch (error) {
+            core.warning(`Failed to detect Docker version, defaulting to expected version: ${error}`);
+            core.setOutput('docker-install-version', process.env.EXPECTED_DOCKER_VERSION);
+          };
+
+    - if: steps.detect-docker.outputs.docker-install-version
       uses: docker/setup-docker-action@0234bb73ccb40f0c430b795634f9247e2b5c2d23 # v5.2.0
+      with:
+        version: ${{ steps.detect-docker.outputs.docker-install-version }}
 
     - if: inputs.setup-buildx != 'false'
       uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

actions/helm/release-chart/README.md

@@ -137,7 +137,7 @@ This action requires the following permissions on the repository:
 | **`tag`**                   | The release tag to set to chart                                                                                                                                                                            | **true**     | -                                |
 | **`update-tag-paths`**      | List of YAML paths to update with the tag.                                                                                                                                                                 | **false**    | `.version,.appVersion`           |
 |                             | Comma separated list of paths.                                                                                                                                                                             |              |                                  |
-| **`ref`**                   | The git ref to checkout before releasing the chart.                                                                                                                                                        | **false**    | -                                |
+| **`ref`**                   | The Git ref to checkout before releasing the chart.                                                                                                                                                        | **false**    | -                                |
 |                             | Can be a branch, tag or commit SHA.                                                                                                                                                                        |              |                                  |
 
 <!-- inputs:end -->

actions/helm/release-chart/action.yml

@@ -67,7 +67,7 @@ inputs:
     default: ".version,.appVersion"
   ref:
     description: |
-      The git ref to checkout before releasing the chart.
+      The Git ref to checkout before releasing the chart.
       Can be a branch, tag or commit SHA.
     required: false