ci: rebuild runtime golden images on lockfile changes

.gitea/workflows/ci-cd.yml

@@ -292,6 +292,22 @@ jobs:
           fi
           docker buildx inspect --bootstrap
 
+          lockfile_sha="$(sha256sum uv.lock | awk '{ print $1 }')"
+
+          golden_usable() {
+            local ref="$1"
+
+            docker run --rm "${ref}:${GOLDEN_TAG}" \
+              bash -c "
+                set -euo pipefail
+                test -f /app/uv.lock
+                test \"\$(sha256sum /app/uv.lock | awk '{ print \$1 }')\" = '${lockfile_sha}'
+                /app/.venv/bin/python - <<'PY'
+import polymorphic
+PY
+              "
+          }
+
           ensure_golden() {
             local target="$1"
             local ref="$2"
@@ -299,7 +315,8 @@ jobs:
             if [ "${target}" = "celery-deps-base" ]; then
               build_args+=(--build-arg "GOLDEN_WEB_IMAGE=${WEB_GOLDEN_REF}:${GOLDEN_TAG}")
             fi
-            if docker buildx imagetools inspect "${ref}:${GOLDEN_TAG}" >/dev/null 2>&1; then
+            if docker buildx imagetools inspect "${ref}:${GOLDEN_TAG}" >/dev/null 2>&1 \
+              && golden_usable "${ref}"; then
               return 0
             fi