build(ci): consolidate database, builder and mockery pins - #9069

Summary

This PR consolidates CI and deployment pins that had drifted away from the versions DevLake is actually developed and operated against. It replaces floating database image tags in the E2E workflow and the Kubernetes sample manifest, refreshes the builder-image publish workflow, and lifts every mockery installation site to a single current version.

There are no Go module changes, no schema or migration-script changes, no API changes and no frontend changes. Nothing here alters product behaviour: the diff is limited to CI workflows, the Kubernetes sample manifest, the builder images and the mockery bootstrap.

.github/workflows/build-builder.yml
.github/workflows/golangci-lint.yml
.github/workflows/test-e2e.yml
.github/workflows/test.yml
backend/Dockerfile.local
backend/Makefile
backend/scripts/install-mockery.sh
devops/deployment/k8s/k8s-deploy.yaml
devops/docker/lake-builder/Dockerfile

1. build(ci): pin active database images

Historical artefacts under devops/releases/** are intentionally left untouched.

2. ci(builder): refresh runner and login action

Buildx was evaluated and deliberately not introduced: the workflow's direct docker build has no concrete need for it, and mixing that in would hide a build-system change behind a pin refresh.

3. build(deps): bump mockery to 3.7.4

Follow-up to #9029, which introduced mockery v3.7.2. All active installation sites move in lockstep so the CI bootstrap, the Makefile target and the builder images cannot drift apart:

The two pinned archive checksums were verified against the official vektra/mockery v3.7.4 checksum.txt:

d5eef52e238a4262b78ab5a93811826a8bfcff7b0128133c6597e3bf2f0f7337  mockery_3.7.4_Linux_x86_64.tar.gz
fe591f9ef5ada76c3dee4b8f451aad6748d002e9713fab4bad26b194ff826c4b  mockery_3.7.4_Linux_arm64.tar.gz

make mock under v3.7.4 regenerates all 65 mock files with an identical tree hash, so no generated code is part of this PR. The v3 configuration files .mockery.core.yml and .mockery.helpers.yml are unchanged, as is their required ordering (helper mocks import generated core mocks).

Dropped: the Super-Linter migration

An earlier revision of this PR also migrated .github/workflows/yaml-lint.yml from the archived github/super-linter/slim@v4 to super-linter/super-linter/slim@… (v8.7.0). That commit has been removed.

The first CI attempt on this branch returned startup_failure for the yaml-lint workflow, with no jobs started. The cause is the ASF allowed-actions policy: github/super-linter is permitted, but the super-linter/super-linter organisation is not on the allowlist, so the workflow is rejected before it starts. This repository already carries a precedent for that constraint in .github/workflows/codespell.yml.action-blocked-by-asf.

.github/workflows/yaml-lint.yml is therefore left untouched in this PR. The migration is still worth doing — the github/super-linter repository ends at v7 and the maintained continuation is the new namespace — but it needs an ASF INFRA request to allowlist the action first. Happy to file that separately, or to follow whatever route the maintainers prefer.

Validation

• YAML parser over all four changed workflows and the K8s manifest
• kubectl apply --dry-run=client --validate=false on the K8s manifest
• bash -n backend/scripts/install-mockery.sh
• SHA-256 comparison against the official mockery v3.7.4 release checksum.txt
• make mock with mockery v3.7.4: 65 files regenerated, zero diff
• make build: all plugins, mocks, Swagger generation and the server
• make unit-test-go: exit code 0, 554 passing packages, no failures

Fork-CI runs, 9/9 green, covering builder image, lint (go), migration-script-lint, unit-test, e2e (mysql), e2e (postgres), config-ui, check Apache license header and check grafana dashboards:

An e2e (postgres) job was added to the fork-CI harness for this proof, because the previous harness only ran MySQL and therefore never exercised the postgres:18.4 pin. The builder image is rebuilt from devops/docker/lake-builder/Dockerfile on the branch, so both runs also validate the mockery 3.7.4 installation.

Note on an earlier Error 1091

An early fork-CI run of this branch failed in e2e (mysql) on Error 1091 in the Jira TestMigrationSchema. That was not caused by the MySQL pin: a baseline run without any of these files reproduced it identically. The root cause was the GORM v1.31 upgrade in #9061 and was fixed there. The run on the plain main baseline confirms the mysql:8.4.11 pin itself is sound.

This PR is independent of #9061 — it applies cleanly to main and is CI-verified on that base.