# Resolve maintained stable aliases to exact numeric tags and digests.
get() { curl -fsS --connect-timeout 10 --max-time 60 "$1"; }
image() (
 repo=$1; alias=$2
 digest=$(get "https://hub.docker.com/v2/repositories/$repo/tags/$alias" | jq -er '.digest | select(test("^sha256:[a-f0-9]{64}$"))') || exit 1
 tag=$(get "https://hub.docker.com/v2/repositories/$repo/tags?page_size=100" | jq -er --arg digest "$digest" '
 [.results[] | select(.digest==$digest) | .name | select(test("^[0-9]+\\.[0-9]+(\\.[0-9]+)?(-alpine)?$"))]
 | sort_by(split("-")[0] | split(".") | map(tonumber)) | last // error("No stable numeric tag matches digest")') || exit 1
 printf '%s:%s@%s\n' "$repo" "$tag" "$digest"
)
images() (
 go=$(get 'https://go.dev/dl/?mode=json' | jq -er '.[0] | select(.stable) | .version | select(test("^go[0-9]+\\.[0-9]+\\.[0-9]+$"))') || exit 1
 for spec in VAULT_IMAGE:hashicorp/vault:latest MONGO_IMAGE:library/mongo:latest NATS_IMAGE:library/nats:latest CADDY_IMAGE:library/caddy:alpine "GO_IMAGE:library/golang:${go#go}-alpine" UBUNTU_IMAGE:library/ubuntu:latest; do
  key=${spec%%:*}; rest=${spec#*:}; repo=${rest%:*}; alias=${rest##*:}
  ref=$(image "$repo" "$alias") || exit 1
  printf '%s=%s\n' "$key" "$ref" >> "$WORK/images.env"
 done
 commit=$(get https://api.github.com/repos/flutter/flutter/commits/stable | jq -er '.sha | select(test("^[a-f0-9]{40}$"))') || exit 1
 git ls-remote --tags https://github.com/flutter/flutter.git > "$WORK/flutter-tags" || exit 1
 tag=$(jq -Rrs --arg commit "$commit" '[split("\n")[] | split("\t") | select(.[0]==$commit) | .[1] | sub("^refs/tags/";"") | select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))] | sort_by(split(".")|map(tonumber)) | last // error("Flutter stable has no stable release tag")' "$WORK/flutter-tags") || exit 1
 printf 'FLUTTER_VERSION=%s\nFLUTTER_COMMIT=%s\n' "$tag" "$commit" >> "$WORK/images.env"
 cat "$WORK/images.env" | write "$STATE/images.env"
 cat "$STATE/images.env"
)
# Production pins: one resolution for every node of a cluster, so all of them
# run the same build. Written outside .local/dev; copied to the servers.
prod_images() (
 ref=$(image hashicorp/vault latest) || exit 1
 printf 'VAULT_IMAGE=%s\n' "$ref" | write "$PWD/.local/prod/images.env"
 cat "$PWD/.local/prod/images.env"
)