Improve historical version logic

It's rare but it's possible that a tagged version exists as a GitHub release
but not as a docker image. Try a few different versions if the tag does not
exist in the docker registry.

.github/workflows/semgrep-rules-test-historical.yml

@@ -37,10 +37,7 @@ jobs:
     - name: grab historical semgrep version
       env:
         GH_TOKEN: ${{ github.token }}
-      run: |
-        SEMGREP_OLD_VERSION=$(gh api --method GET /repos/returntocorp/semgrep/releases | jq -r '.[].tag_name' | sed -n 10p | tr -d v)
-        echo $SEMGREP_OLD_VERSION
-        echo "SEMGREP_OLD_VERSION=$SEMGREP_OLD_VERSION" >> $GITHUB_ENV
+      run: scripts/historical-semgrep-version
     - name: validate rules on historical semgrep version
       run: |
         docker run --rm -v ${GITHUB_WORKSPACE}/semgrep-rules:/src returntocorp/semgrep:${SEMGREP_OLD_VERSION} semgrep --validate --config /src

scripts/historical-semgrep-version

@@ -0,0 +1,17 @@
+#!/bin/bash
+HISTORICAL_VERSIONS=10
+RETRIES=3
+
+versions=$(gh api --method GET /repos/returntocorp/semgrep/releases | jq 'reverse' | jq -r '.[].tag_name' | tail "-n${HISTORICAL_VERSIONS}" | head -n "${RETRIES}" | tr -d v)
+
+for version in $(echo "${versions}"); do
+  docker pull "returntocorp/semgrep:${version}"
+  if [[ "$?" == 0 ]]; then
+    echo "${version}"
+    echo "SEMGREP_OLD_VERSION=${version}" >> "${GITHUB_ENV}"
+    exit 0
+  fi
+done
+
+echo "Could not determine historical version, tried: $(echo ${versions})"
+exit 1