Run source fetch in pinned CI container

tools/fetch_sources.py

@@ -7,20 +7,22 @@ import argparse
 import hashlib
 import json
 from pathlib import Path, PurePosixPath
-import subprocess
 import tarfile
 import tempfile
+import urllib.parse
 import urllib.request
 
 
 def _revision(remote: str, branch: str) -> str:
-    result = subprocess.run(
-        ["git", "ls-remote", remote, f"refs/heads/{branch}"],
-        check=True,
-        capture_output=True,
-        text=True,
-    )
-    revision = result.stdout.split(maxsplit=1)[0] if result.stdout.strip() else ""
+    parsed = urllib.parse.urlparse(remote)
+    parts = parsed.path.removesuffix(".git").strip("/").split("/")
+    if parsed.scheme != "https" or len(parts) != 2:
+        raise ValueError(f"unsupported Forgejo remote {remote!r}")
+    owner, repo = (urllib.parse.quote(part, safe="") for part in parts)
+    branch_name = urllib.parse.quote(branch, safe="")
+    url = f"{parsed.scheme}://{parsed.netloc}/api/v1/repos/{owner}/{repo}/branches/{branch_name}"
+    with urllib.request.urlopen(url, timeout=30) as response:
+        revision = json.load(response).get("commit", {}).get("id", "")
     if len(revision) != 40 or any(char not in "0123456789abcdef" for char in revision):
         raise ValueError(f"{remote}: could not resolve a clean 40-hex {branch} revision")
     return revision