ci: restore external package integration

ci/fetch-platform.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Fetches the exact Ekklesia source revision Signage's external-package integration runs against.
+# The ref is fetched only to make the pinned object reachable; the checkout is always by full SHA.
+set -Eeuo pipefail
+
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+out="$root/build/platform"
+
+fail() {
+  echo "fetch-platform: $*" >&2
+  exit 1
+}
+
+(($# == 0)) || fail "this command takes no arguments."
+
+pin() {
+  local value
+  value="$(sed -n "s/^$1=//p" "$root/ci/platform.env")"
+  [[ -n "$value" ]] || fail "ci/platform.env has no $1."
+  printf '%s' "$value"
+}
+
+repository="$(pin EKKLESIA_PLATFORM_REPOSITORY)"
+ref="$(pin EKKLESIA_PLATFORM_REF)"
+commit="$(pin EKKLESIA_PLATFORM_COMMIT)"
+[[ "$commit" =~ ^[0-9a-f]{40}$ ]] || fail "EKKLESIA_PLATFORM_COMMIT must be a full commit SHA."
+[[ "$ref" == refs/* ]] || fail "EKKLESIA_PLATFORM_REF must be a full Git ref."
+
+rm -rf "$out"
+mkdir -p "$out"
+git -C "$out" init --quiet
+git -C "$out" remote add origin "$repository"
+git -C "$out" fetch --quiet --no-tags --depth=1 origin "+${ref}:refs/remotes/pinned" ||
+  fail "cannot fetch the pinned platform ref."
+[[ "$(git -C "$out" rev-parse refs/remotes/pinned)" == "$commit" ]] ||
+  fail "the pinned ref does not resolve to EKKLESIA_PLATFORM_COMMIT."
+git -C "$out" -c advice.detachedHead=false checkout --quiet --detach "$commit"
+rm -rf "$out/.git"
+echo "fetch-platform: Ekklesia ${commit}"