feat: finish Pi and workspace management updates

tools/tht/internal/pi/commands.go

@@ -42,7 +42,7 @@ type settingsFileSnapshot struct {
 var internalIdentityHeaders = []string{
 	"-H", "x-thoth-principal-issuer: tht",
 	"-H", "x-thoth-principal-subject: tht-maintenance",
-	"-H", "x-thoth-principal-display-name: Tht maintenance",
+		"-H", "x-thoth-principal-display-name: Tht maintenance",
 	"-H", "x-thoth-is-admin: 1",
 }
 

tools/tht/internal/pi/version.go

@@ -0,0 +1,46 @@
+package pi
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+)
+
+var defaultPiArgPattern = regexp.MustCompile(`^ARG[[:space:]]+PI_VERSION[[:space:]]*=(.*)$`)
+
+// ReadPinnedVersion reads the repository's declared Pi runtime version. It deliberately reads
+// only the default ARG, not the later ARG PI_VERSION declarations used by build stages.
+func ReadPinnedVersion(projectDirectory string) (string, error) {
+	path := filepath.Join(projectDirectory, "docker", "core.Dockerfile")
+	file, err := os.Open(path)
+	if err != nil {
+		return "", fmt.Errorf("read Pi version pin: %w", err)
+	}
+	defer file.Close()
+
+	var version string
+	count := 0
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		match := defaultPiArgPattern.FindStringSubmatch(strings.TrimSuffix(scanner.Text(), "\r"))
+		if len(match) != 2 {
+			continue
+		}
+		count++
+		version = strings.TrimSpace(match[1])
+	}
+	if err := scanner.Err(); err != nil {
+		return "", fmt.Errorf("read Pi version pin: %w", err)
+	}
+	if count != 1 {
+		return "", errors.New("docker/core.Dockerfile must contain exactly one default PI_VERSION")
+	}
+	if _, err := parseSemanticVersion(version); err != nil {
+		return "", errors.New("docker/core.Dockerfile contains an invalid Pi version")
+	}
+	return version, nil
+}

tools/tht/internal/pi/version_test.go

@@ -0,0 +1,52 @@
+package pi
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestReadPinnedVersionReadsTheSingleDefaultPiArg(t *testing.T) {
+	root := t.TempDir()
+	writeCoreDockerfile(t, root, "ARG PI_VERSION=0.81.0\nARG PI_VERSION\n")
+
+	got, err := ReadPinnedVersion(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "0.81.0" {
+		t.Fatalf("ReadPinnedVersion() = %q, want 0.81.0", got)
+	}
+}
+
+func TestReadPinnedVersionRejectsMissingDuplicateAndMalformedPins(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		file string
+		want string
+	}{
+		{name: "missing", file: "# no default\n", want: "one default PI_VERSION"},
+		{name: "duplicate", file: "ARG PI_VERSION=0.80.3\nARG PI_VERSION=0.81.0\n", want: "one default PI_VERSION"},
+		{name: "malformed", file: "ARG PI_VERSION=latest\n", want: "invalid Pi version"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			root := t.TempDir()
+			writeCoreDockerfile(t, root, test.file)
+			_, err := ReadPinnedVersion(root)
+			if err == nil || !strings.Contains(err.Error(), test.want) {
+				t.Fatalf("ReadPinnedVersion() error = %v, want %q", err, test.want)
+			}
+		})
+	}
+}
+
+func writeCoreDockerfile(t *testing.T, root, contents string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Join(root, "docker"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "docker", "core.Dockerfile"), []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}