fix(Dockerfile): 驗證 Codex 安裝腳本並鎖定外掛市集版本

Dockerfile

@@ -4,8 +4,9 @@ FROM alpine:latest
 ENV CODEX_NON_INTERACTIVE=1
 ENV CODEX_INSTALL_DIR=/usr/local/bin
 ENV CODEX_HOME=/root/.codex
-ENV CODEX_PLUGINS="jsc@doc jsc@code-review"
-ENV CODEX_PLUGIN_MARKETPLACES="https://gitea.jsc.idv.tw/plugins/doc.git https://gitea.jsc.idv.tw/plugins/code-review.git"
+ARG CODEX_INSTALL_SHA256=73eb367137d151eabe89590a1d1a08a9c2fe2800a656bffac3c5707b62b42683
+ARG CODEX_DOC_MARKETPLACE_REF=f8da961328a85f267b4402566e127310370169da
+ARG CODEX_CODE_REVIEW_MARKETPLACE_REF=9e016edff016d58f4d64e0a5468220d35a0f657b
 
 # 安裝必要的工具
 RUN apk add --no-cache --no-check-certificate bash ca-certificates curl git jq util-linux
@@ -15,13 +16,16 @@ RUN install_script="$(mktemp)" \
     && curl -fsSL --retry 3 --retry-delay 2 --max-time 120 \
         https://chatgpt.com/codex/install.sh \
         -o "$install_script" \
+    && echo "${CODEX_INSTALL_SHA256}  ${install_script}" | sha256sum -c - \
     && sh "$install_script" \
     && codex --version \
     && rm -f "$install_script"
 
 # 安裝技能
-RUN for marketplace in $CODEX_PLUGIN_MARKETPLACES; do codex plugin marketplace add "$marketplace"; done \
-    && for plugin in $CODEX_PLUGINS; do codex plugin add "$plugin"; done
+RUN codex plugin marketplace add "https://gitea.jsc.idv.tw/plugins/doc.git" --ref "$CODEX_DOC_MARKETPLACE_REF" \
+    && codex plugin marketplace add "https://gitea.jsc.idv.tw/plugins/code-review.git" --ref "$CODEX_CODE_REVIEW_MARKETPLACE_REF" \
+    && codex plugin add "jsc@doc" \
+    && codex plugin add "jsc@code-review"
 
 COPY entrypoint.sh /entrypoint.sh