Resolve "latest" from appcast.json instead of the channel link

[ctalledo]

On Linux, docker-desktop-build-url: latest read //channel/link from appcast.xml — a static channel pointer, not the newest build. It returns build 228796 while the feed holds 4.89.0 and 4.90.0, so every caller asking for latest silently installs a release many versions behind.

Now reads appcast.json and takes the highest build number among items at full visibility. Collapses three steps into one, drops the get-xml-info dependency, and stops interpolating the input straight into the shell.

Verified against the live feed: resolves to 238018 (4.89.0); 4.90.0 is present but still at visibility 99.

[maxcleme]

We recently move to appcast.json instead of appcast.xml, the following would be more accurate and stable. It should also make the whole action.yml simpler.

curl -s https://desktop.docker.com/linux/main/amd64/appcast.json \
  | jq -r '.Items
           | map(select(.Visibility == "100"))
           | max_by(.BuildNumber | tonumber)
           | .Artifacts[] | select(.Type == "deb") | .URL'

[ctalledo]

Thanks @maxcleme — switched to appcast.json, and you're right that it collapses the whole thing: three steps become one and the get-xml-info dependency is gone.

I kept your jq almost verbatim, with one guard. When no item is at full visibility it fails confusingly:

jq: error (at appcast.json:0): Cannot iterate over null (null)

so there's now an if length == 0 then empty else ... end and an explicit message instead.

Verified against the live feed: resolves to 238018 (4.89.0), since 4.90.0 is still at visibility 99. Also moved the build-url input out of the shell interpolation and into env: while I was in there.

[ctalledo]

Hi @maxcleme, @lorenrh, could you help me merge this PR (I don't have permission to do so). Thanks! 🙏

[lorenrh]

hey @ctalledo we don't have permission either, maybe @docker/desktop-platform-go might have enough permissions?

[ctalledo]

hey @ctalledo we don't have permission either, maybe @docker/desktop-platform-go might have enough permissions?

Thanks @lorenrh, I'll ask them.