Move the test image pins out of test bodies and into testutil

indexing-service/pkg/aws/s3store_test.go

@@ -63,7 +63,7 @@ func createS3(t *testing.T) *url.URL {
 	// 2026-09-11 -- every tag, pinned releases included -- and archived the
 	// project, so there is no public image left to pull. fil-forge/minio builds
 	// it from source at the tag below.
-	container, err := minio.Run(t.Context(), "ghcr.io/fil-forge/minio:RELEASE.2025-10-15T17-29-55Z@sha256:2c4349a1a8dcb3549896109a5363250f77ee90b51f706dc8ceac2b88732a95e7")
+	container, err := minio.Run(t.Context(), testutil.MinioImage())
 	testcontainers.CleanupContainer(t, container)
 	require.NoError(t, err)
 

indexing-service/pkg/internal/testutil/images.go

@@ -0,0 +1,39 @@
+package testutil
+
+import "os"
+
+// The container images these tests pull, pinned by digest so a test result is
+// a function of the commit rather than of the registry. They live here rather
+// than inline at the call site so a pin sweep has one place to look per
+// module; see MONOREPO_TODO.md on why the Go population cannot be guarded the
+// way the compose one is.
+//
+// Each has an environment override, for pointing at a local build.
+const (
+	// Our own build of MinIO. Upstream withdrew minio/minio from Docker Hub on
+	// 2026-09-11 -- every tag, pinned releases included -- and archived the
+	// project, so there is no public image left to pull and no upstream release
+	// to track. fil-forge/minio builds this one from source at the tag below;
+	// bumping it is a deliberate act there, not a tag that moves underneath us.
+	defaultMinioImage = "ghcr.io/fil-forge/minio:RELEASE.2025-10-15T17-29-55Z@sha256:2c4349a1a8dcb3549896109a5363250f77ee90b51f706dc8ceac2b88732a95e7"
+
+	defaultValkeyImage = "valkey/valkey:7.2.5@sha256:57361de39073ea1ef5e7bcfd8068871b21c0a197f01d460e15511f27070fc49b"
+)
+
+// MinioImage is the MinIO image the object-store tests run against.
+// MINIO_IMAGE overrides it.
+func MinioImage() string {
+	if img := os.Getenv("MINIO_IMAGE"); img != "" {
+		return img
+	}
+	return defaultMinioImage
+}
+
+// ValkeyImage is the Valkey image the Redis-backed store tests run against.
+// VALKEY_IMAGE overrides it.
+func ValkeyImage() string {
+	if img := os.Getenv("VALKEY_IMAGE"); img != "" {
+		return img
+	}
+	return defaultValkeyImage
+}

indexing-service/pkg/redis/redisstore_test.go

@@ -360,7 +360,7 @@ func TestBatchingValueSetStore(t *testing.T) {
 
 	ctx := context.Background()
 	container, err := valkey.Run(ctx,
-		"valkey/valkey:7.2.5@sha256:57361de39073ea1ef5e7bcfd8068871b21c0a197f01d460e15511f27070fc49b",
+		testutil.ValkeyImage(),
 		valkey.WithSnapshotting(10, 1),
 		valkey.WithLogLevel(valkey.LogLevelVerbose),
 	)

swarf/internal/testutil/images.go

@@ -0,0 +1,24 @@
+package testutil
+
+import "os"
+
+// The container images these tests pull, pinned by digest so a test result is
+// a function of the commit rather than of the registry. They live here rather
+// than inline at the call site so a pin sweep has one place to look per
+// module; see MONOREPO_TODO.md on why the Go population cannot be guarded the
+// way the compose one is.
+//
+// This digest is the one the rest of the repository already pins for
+// postgres:16-alpine -- hilt, piri, sprue and smelt all name it. Agreeing with
+// them matters more than being current: two builds of one tag in one
+// repository is the failure rule 2 exists to prevent.
+const defaultPostgresImage = "postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685"
+
+// PostgresImage is the PostgreSQL image the store tests run against.
+// POSTGRES_IMAGE overrides it, for pointing at a local build.
+func PostgresImage() string {
+	if img := os.Getenv("POSTGRES_IMAGE"); img != "" {
+		return img
+	}
+	return defaultPostgresImage
+}

swarf/itest/happy_path_test.go

@@ -44,7 +44,7 @@ func TestRevocationHappyPath(t *testing.T) {
 	}
 	ctx := t.Context()
 	container, err := tcpostgres.Run(ctx,
-		"postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685",
+		testutil.PostgresImage(),
 		tcpostgres.WithDatabase("swarf"),
 		tcpostgres.WithUsername("swarf"),
 		tcpostgres.WithPassword("swarf"),

swarf/pkg/store/postgres/store_test.go

@@ -200,7 +200,7 @@ func newTestStore(t *testing.T) (*postgres.Store, *pgxpool.Pool) {
 	}
 	ctx := t.Context()
 	container, err := tcpostgres.Run(ctx,
-		"postgres:16-alpine@sha256:cf78e76683b9ca8c5733cbbdce6c9262b45b6767934dd0a95e671f9a0fc20685",
+		testutil.PostgresImage(),
 		tcpostgres.WithDatabase("swarf"),
 		tcpostgres.WithUsername("swarf"),
 		tcpostgres.WithPassword("swarf"),