fix(infra): pin OpenZaak/NRC image tags; add smoke log capture on failure (refs #30)

latest bumped to OpenZaak 1.29.0 (2026-06-18) and open-notificaties
updated (2026-06-22), breaking oz-init in compose-smoke.  Pin all four
compose files to stable patch releases:

  open-zaak:            1.28.2  (was :latest -> 1.29.0)
  open-notificaties:    1.16.1  (was :latest)

Tags are still overridable via OPENZAAK_TAG / OPENNOTIFICATIES_TAG env vars.

Also adds two if: failure() steps to the compose-smoke CI job: one that
dumps the last 100 lines of oz-init / nrc-init / acl / bff logs, and one
that tears the stack down cleanly, so future failures are self-diagnosing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -48,3 +48,9 @@ jobs:
     steps:
       - uses: https://github.com/actions/checkout@v4
       - run: make smoke
+      - name: dump container logs on failure
+        if: failure()
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init nrc-init acl bff 2>&1 || true
+      - name: tear down on failure
+        if: failure()
+        run: docker compose -f infra/docker-compose.yml down --volumes 2>&1 || true

infra/docker-compose.yml

@@ -44,7 +44,7 @@ services:
     networks: [cg]
 
   oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: &oz-env
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker
       SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
@@ -75,7 +75,7 @@ services:
     networks: [cg]
 
   openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: *oz-env
     healthcheck:
       test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -91,7 +91,7 @@ services:
     networks: [cg]
 
   oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: *oz-env
     command: /celery_worker.sh
     depends_on:
@@ -121,7 +121,7 @@ services:
     networks: [cg]
 
   nrc-init:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: &nrc-env
       DJANGO_SETTINGS_MODULE: nrc.conf.docker
       SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
@@ -153,7 +153,7 @@ services:
     networks: [cg]
 
   nrc-web:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: *nrc-env
     healthcheck:
       test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -169,7 +169,7 @@ services:
     networks: [cg]
 
   nrc-celery:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: *nrc-env
     command: /celery_worker.sh
     depends_on:

infra/opennotificaties/docker-compose.yml

@@ -30,7 +30,7 @@ services:
     networks: [cg]
 
   nrc-init:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: &nrc-env
       DJANGO_SETTINGS_MODULE: nrc.conf.docker
       SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
@@ -60,7 +60,7 @@ services:
     networks: [cg]
 
   nrc-web:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: *nrc-env
     healthcheck:
       test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -76,7 +76,7 @@ services:
     networks: [cg]
 
   nrc-celery:
-    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-latest}
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: *nrc-env
     command: /celery_worker.sh
     depends_on:

infra/openzaak/docker-compose.yml

@@ -29,7 +29,7 @@ services:
     networks: [cg]
 
   oz-init:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: &oz-env
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker
       SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
@@ -64,7 +64,7 @@ services:
     networks: [cg]
 
   openzaak:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: *oz-env
     healthcheck:
       test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -80,7 +80,7 @@ services:
     networks: [cg]
 
   oz-celery:
-    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: *oz-env
     command: /celery_worker.sh
     depends_on: