fix(sync): pin stable upstream digest resolution

Author: JSONbored

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 
 ARG UPSTREAM_VERSION=v0.6.9
-ARG UPSTREAM_IMAGE_DIGEST=sha256:f415c4085489b4e154f2374786fd604b41ff11d3f56b6d1050fa28fa214f1130
+ARG UPSTREAM_IMAGE_DIGEST=sha256:3d899b3eced520d8d3166a3d53184cbb1356670fb52d050f94f8e62e59754d70
 ARG PGVECTOR_VERSION=0.8.2
 FROM ghcr.io/we-promise/sure@${UPSTREAM_IMAGE_DIGEST}
 

scripts/check-upstream.py

@@ -108,7 +108,7 @@ def latest_github_tag(repo: str, stable_only: bool) -> str:
     return sorted(candidates, key=version_sort_key)[-1]
 
 
-def latest_ghcr_digest(image: str, tag: str = "latest") -> str:
+def ghcr_digest_for_tag(image: str, tag: str) -> str:
     token_data = http_json(f"https://ghcr.io/token?scope=repository:{image}:pull")
     if not isinstance(token_data, dict) or not token_data.get("token"):
         fail(f"Could not get GHCR token for {image}")
@@ -133,14 +133,47 @@ def latest_ghcr_digest(image: str, tag: str = "latest") -> str:
         with urllib.request.urlopen(request, timeout=30) as response:
             digest = response.headers.get("docker-content-digest", "").strip()
     except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            raise LookupError(f"Tag not found: {image}:{tag}") from exc
         fail(f"HTTP error while requesting GHCR manifest for {image}:{tag}: {exc.code} {exc.reason}")
     except urllib.error.URLError as exc:
         fail(f"Network error while requesting GHCR manifest for {image}:{tag}: {exc.reason}")
     if not digest:
-        fail(f"Could not determine digest for GHCR image {image}:{tag}")
+        raise LookupError(f"Digest header missing: {image}:{tag}")
     return digest
 
 
+def latest_ghcr_digest(image: str, latest_version: str, stable_only: bool) -> str:
+    # For stable-only tracking, resolve digest from the exact version tag instead of
+    # floating tags like "latest", which may point at prerelease images.
+    candidates: list[str] = []
+
+    if latest_version:
+        candidates.append(latest_version)
+        if latest_version.startswith("v"):
+            candidates.append(latest_version[1:])
+
+    if stable_only:
+        candidates.append("stable")
+    else:
+        candidates.append("latest")
+
+    seen: set[str] = set()
+    for candidate in candidates:
+        if not candidate or candidate in seen:
+            continue
+        seen.add(candidate)
+        try:
+            return ghcr_digest_for_tag(image, candidate)
+        except LookupError:
+            continue
+
+    fail(
+        f"Could not determine digest for GHCR image {image} using candidates: "
+        + ", ".join(candidates)
+    )
+
+
 def read_local_version(config: dict[str, object]) -> str:
     version_source = str(config.get("version_source", "")).strip()
     version_key = str(config.get("version_key", "")).strip()
@@ -250,7 +283,11 @@ def main() -> None:
     current_version = read_local_version(upstream)
     current_digest = read_local_digest(upstream)
     latest_version = latest_github_tag(str(upstream.get("repo", "")).strip(), stable_only)
-    latest_digest = latest_ghcr_digest(str(upstream.get("image", "")).strip(), "latest")
+    latest_digest = latest_ghcr_digest(
+        str(upstream.get("image", "")).strip(),
+        latest_version,
+        stable_only,
+    )
     version_update_available = latest_version != current_version
     digest_update_available = latest_digest != current_digest
     updates_available = version_update_available