@gamecrate/cli 2.0.0 → 2.1.0

package/dist/gamecrate.js

@@ -4496,8 +4496,8 @@ import { join as join15 } from "node:path";
 
 // src/image/base.ts
 var RUNTIME_BASE = {
-  xvfb: "ghcr.io/rimworks/gamecrate/runtime-base@sha256:bb56228089823908bc3f6452ba3eb10f35f395813b2358758080452201ee4792",
-  proton: "ghcr.io/rimworks/gamecrate/runtime-base-proton@sha256:55ee5e995a88207074ac455fc1932adb57239da66536bed26041436cb7f44fea"
+  xvfb: "ghcr.io/rimworks/gamecrate/runtime-base:1",
+  proton: "ghcr.io/rimworks/gamecrate/runtime-base-proton:1"
 };
 function resolveBase(kind, override) {
   if (kind === "none")
@@ -4722,6 +4722,12 @@ async function craneMutateLabels(ref, labels) {
   args.push("-t", ref);
   await runOnce(craneArgv([], ref, [args]), `crane mutate ${ref}`);
 }
+async function craneDigest(ref, platform) {
+  const argv = craneArgv([], ref, [["crane", "digest", "--platform", platform, ref]]);
+  const { code, stdout } = await capture(argv);
+  const digest = stdout.trim();
+  return code === 0 && digest.startsWith("sha256:") ? digest : null;
+}
 async function craneLabels(ref) {
   const { code, stdout } = await capture(craneArgv([], ref, [["crane", "config", ref]]));
   if (code !== 0)
@@ -4922,6 +4928,7 @@ async function cell(input, opts, ctx) {
     mkdirSync4(layers, { recursive: true });
     const tar = join15(layers, `${branch.name}-${variant.name}-${version}.tar`);
     const base = resolveBase(variant.base, opts.baseOverride);
+    const baseDigest = base === null ? null : await resolvedBase(base, opts.platform);
     const versioned = `${input.image}:${tags[0]}`;
     try {
       say(`appending onto ${base ?? "scratch"}`);
@@ -4937,14 +4944,14 @@ async function cell(input, opts, ctx) {
       if (opts.push) {
         say(`pushing ${versioned}`);
         await cranePush(tar, versioned);
-        await craneMutateLabels(versioned, labelsFor(input, ctx, base));
+        await craneMutateLabels(versioned, labelsFor(input, ctx, baseDigest));
         for (const tag of tags.slice(1))
           await craneTag(versioned, tag);
       }
       if (opts.load && base !== null) {
         say(`loading ${versioned}`);
         await dockerLoad(tar, versioned);
-        await dockerLabel(versioned, labelsFor(input, ctx, base));
+        await dockerLabel(versioned, labelsFor(input, ctx, baseDigest));
         for (const tag of tags.slice(1))
           await dockerTag(versioned, `${input.image}:${tag}`);
       }
@@ -4975,6 +4982,12 @@ async function download(input, opts, ctx, say) {
   }
   return (await pending).dir;
 }
+async function resolvedBase(base, platform) {
+  if (base.includes("@sha256:"))
+    return base;
+  const digest = await craneDigest(base, platform);
+  return digest === null ? base : `${base.split(":")[0]}@${digest}`;
+}
 function labelsFor(input, ctx, base) {
   const labels = {
     "gamecrate.variant": ctx.variant.name,
@@ -7480,7 +7493,7 @@ function published2(value) {
 }
 
 // src/index.ts
-var VERSION = "2.0.0";
+var VERSION = "2.1.0";
 async function main(argv) {
   const supervised = supervisedDir(argv);
   try {

package/dist/types/image/base.d.ts

@@ -1,7 +1,7 @@
 export type BaseKind = 'xvfb' | 'proton' | 'none';
 /**
- * Pinned by digest, never by tag: a rebuilt base would otherwise change under released code.
- * These are the linux/amd64 manifests, not the index a push reports. See landmines.md.
+ * A major tag, so an apt fix in a base reaches a released cli without a new release. Each built
+ * image records the digest this resolved to, which is what makes that safe. See landmines.md.
  */
 export declare const RUNTIME_BASE: Readonly<Record<'xvfb' | 'proton', string>>;
 /**

package/dist/types/image/crane.d.ts

@@ -23,5 +23,10 @@ export declare function cranePush(tar: string, ref: string): Promise<void>;
 /** Runs after the push, never before. A moving tag only moves once the real tag is there. */
 export declare function craneTag(ref: string, tag: string): Promise<void>;
 export declare function craneMutateLabels(ref: string, labels: Record<string, string>): Promise<void>;
+/**
+ * The platform manifest a tag resolves to, so an image records the base it was built on rather
+ * than the moving tag. Never the index digest: that is not what a runtime pulls.
+ */
+export declare function craneDigest(ref: string, platform: string): Promise<string | null>;
 /** null when the image or its config cannot be read. An empty record means no labels. */
 export declare function craneLabels(ref: string): Promise<Record<string, string> | null>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gamecrate/cli",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Run a modded game in a container, with mods resolved from your local checkouts.",
   "license": "MIT",
   "type": "module",