From a36f25cfc3d395f5c05c44d2decf24300a989c46 Mon Sep 17 00:00:00 2001
From: Marcel <marcel@familienarchiv>
Date: Mon, 11 May 2026 11:59:18 +0200
Subject: [PATCH] fix(infra): pin minio/mc client tag

Removes the implicit `:latest` from the create-buckets bootstrap
container. Pins to RELEASE.2025-08-13T08-35-41Z so a breaking change in
mc CLI syntax cannot silently brick deploys.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 docker-compose.prod.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 539e9f84..1fdbd6c5 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -77,7 +77,8 @@ services:
   # Runs once per `docker compose up` and exits 0; `--ignore-existing` and
   # the user-add fallback are safe on re-deploy.
   create-buckets:
-    image: minio/mc
+    # Pinned mc client release for reproducibility; Renovate keeps it current.
+    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
     depends_on:
       minio:
         condition: service_healthy