fix(ci): drop unused build-args passthrough so the heap ceiling can't be overridden

Author: TheodoreSpeaks

.github/actions/docker-build/action.yml

@@ -19,10 +19,6 @@ inputs:
   tags:
     description: Comma-separated list of tags to push.
     required: true
-  build-args:
-    description: Newline-separated build args forwarded to the builder.
-    required: false
-    default: ''
 
 # Registry logins must already have run in the calling job — both backends read
 # the same ~/.docker/config.json. provenance/sbom stay off everywhere: the
@@ -44,7 +40,6 @@ runs:
         platforms: ${{ inputs.platforms }}
         push: true
         tags: ${{ inputs.tags }}
-        build-args: ${{ inputs.build-args }}
         provenance: false
         sbom: false
 
@@ -60,7 +55,9 @@ runs:
     # runners have 16 GB total and `next build` was getting OOM-killed (exit
     # 137) partway through. Only app.Dockerfile declares the arg; the other
     # images ignore it harmlessly, so it is set unconditionally rather than
-    # threaded per-image through every call site.
+    # threaded per-image through every call site. This is deliberately the only
+    # build arg the action passes — a general passthrough input would let a
+    # caller re-raise the ceiling and silently restore the OOM.
     - name: Build and push (GitHub)
       if: inputs.provider != '' && inputs.provider != 'blacksmith'
       uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -70,8 +67,6 @@ runs:
         platforms: ${{ inputs.platforms }}
         push: true
         tags: ${{ inputs.tags }}
-        build-args: |
-          NEXT_BUILD_HEAP_MB=4096
-          ${{ inputs.build-args }}
+        build-args: NEXT_BUILD_HEAP_MB=4096
         provenance: false
         sbom: false