#!/usr/bin/env python3
"""Render only a supplied immutable image; no floating defaults can deploy."""
import os
from pathlib import Path
import re

image = os.environ.get('IMAGE_REFERENCE', '')
if not re.fullmatch(r'forgejo\.coulomb\.social/coulomb/rapp-playwright@sha256:[a-f0-9]{64}', image):
    raise SystemExit('IMAGE_REFERENCE must be the published rapp-playwright sha256 reference')
source = Path('manifests/workload.yaml').read_text()
rendered = source.replace('${IMAGE_REFERENCE}', image)
if '${' in rendered:
    raise SystemExit('unresolved template field')
out = Path('.rendered')
out.mkdir(exist_ok=True)
(out / 'workload.yaml').write_text(rendered)
(out / 'namespace.yaml').write_text(rendered.split('---',1)[0])
print(out / 'workload.yaml')