feat(moderation): let staff enforce room decisions and track delivery

.github/workflows/apply_pr_checks.yaml

@@ -124,7 +124,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Check Divine Coop setup guards
-        run: bash divine/test-coop-setup-guards.sh
+        run: |
+          bash divine/test-coop-setup-guards.sh
+          bash divine/test-coop-setup-concord.sh
 
   # jobs have to be defined in the root workflow file in order to be marked as
   # 'Required Checks' in GitHub CI
@@ -176,6 +178,9 @@ jobs:
       - name: Lint client
         run: docker compose run --rm --quiet-pull client npm run lint
 
+      - name: Test room moderation UI
+        run: docker compose run --rm --quiet-pull client npm test -- --run src/components/ConcordEnforcementStatus.test.tsx src/components/DiscordGuildConfirmation.test.tsx src/components/roomOperation.test.ts
+
       - name: Build client
         run: docker compose run --rm --quiet-pull client npm run build
 

Dockerfile

@@ -7,7 +7,7 @@
 # Docker's cache will let us skip installs when the dependencies haven't changed.
 # We build on debian because it has fewer dependency issues than Alpine for our
 # native modules, and we don't really care about the larger image size.
-FROM node:24.14.1-bullseye-slim AS server_base
+FROM node:24.14.1-bookworm-slim@sha256:b506e7321f176aae77317f99d67a24b272c1f09f1d10f1761f2773447d8da26c AS server_base
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
 
@@ -19,9 +19,9 @@ FROM server_base AS build_backend
 RUN npm run build
 
 # make a shared layer that can be the base for worker and api images.
-FROM node:24.14.1-bullseye-slim AS backend_base
+FROM node:24.14.1-bookworm-slim@sha256:b506e7321f176aae77317f99d67a24b272c1f09f1d10f1761f2773447d8da26c AS backend_base
 WORKDIR /app
-RUN apt-get update && apt-get install dumb-init
+RUN apt-get update && apt-get install -y --no-install-recommends dumb-init && rm -rf /var/lib/apt/lists/*
 COPY --from=build_backend ["/app/package.json", "/app/package-lock.json", "./"]
 RUN npm ci --omit=dev
 COPY --from=build_backend /app/transpiled ./
@@ -49,7 +49,7 @@ CMD ["node", "bin/run-worker-or-job.js"]
 # The K8s db-migrate Job provides the command at runtime (e.g.,
 #   npm run db:update -- --env staging --db api-server-pg
 # ). Falls back to --help if no command is given.
-FROM node:24.14.1-bullseye-slim AS build_migrator
+FROM node:24.14.1-bookworm-slim@sha256:b506e7321f176aae77317f99d67a24b272c1f09f1d10f1761f2773447d8da26c AS build_migrator
 WORKDIR /app
 RUN groupadd -r migrator && useradd -r -g migrator -u 1001 migrator
 ENV NPM_CONFIG_CACHE=/tmp/.npm

client/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.14.1-bullseye-slim AS client_base
+FROM node:24.14.1-bookworm-slim@sha256:b506e7321f176aae77317f99d67a24b272c1f09f1d10f1761f2773447d8da26c AS client_base
 WORKDIR /app
 
 # ARG is used to get the release id into the ENV from the command line, and then