Repository navigation
Bump Chainguard Images #62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Bump Chainguard Images | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 12 * * *" | |
| jobs: | |
| update-chainguard-images: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout ci repository | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: syntasso/ci | |
| - name: Checkout enterprise-kratix repository | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: syntasso/enterprise-kratix | |
| path: enterprise-kratix | |
| ssh-key: ${{ secrets.ENTERPRISE_KRATIX_DEPLOY_KEY_READ_PUSH }} | |
| - uses: hashicorp/setup-terraform@v4 | |
| - name: Fetch terraform outputs and place into env variables | |
| working-directory: enterprise-kratix/terraform | |
| run: | | |
| terraform init -upgrade | |
| terraform output --json > credentials.json | |
| echo "ASSUME_CI_ECR_READ_WRITE_ROLE_ARN=$(yq eval '.assume_ci_ecr_read_write_role_arn.value' credentials.json --output-format=yaml)" >> "$GITHUB_ENV" | |
| echo "CI_USER_ACCESS_KEY_ID=$(yq eval '.ci_user_access_key_id.value' credentials.json --output-format=yaml)" >> "$GITHUB_ENV" | |
| echo "CI_USER_SECRET_ACCESS_KEY=$(yq eval '.ci_user_secret_access_key.value' credentials.json --output-format=yaml)" >> "$GITHUB_ENV" | |
| echo "REGION=$(yq eval '.aws_region.value' credentials.json --output-format=yaml)" >> "$GITHUB_ENV" | |
| env: | |
| TF_TOKEN_app_terraform_io: ${{ secrets.TF_TOKEN_app_terraform_io }} | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ env.CI_USER_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ env.CI_USER_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ env.REGION }} | |
| role-to-assume: ${{ env.ASSUME_CI_ECR_READ_WRITE_ROLE_ARN }} | |
| role-session-name: chainguard | |
| role-skip-session-tagging: true | |
| - name: Mirror latest Chainguard SHAs to ECR | |
| working-directory: enterprise-kratix | |
| run: | | |
| echo "Validating the credentials have been properly set, this should echo 5 characters:" | |
| echo $AWS_SESSION_TOKEN | cut -c1-5 | |
| docker login --username AWS -p $(aws ecr get-login-password --region us-east-1) 001004308489.dkr.ecr.us-east-1.amazonaws.com | |
| latest_wolfi="$(docker pull cgr.dev/chainguard/wolfi-base:latest 2>/dev/null | grep -o 'sha256:[a-fA-F0-9]\+' | cut -d':' -f2)" | |
| latest_static="$(docker pull cgr.dev/chainguard/static:latest 2>/dev/null | grep -o 'sha256:[a-fA-F0-9]\+' | cut -d':' -f2)" | |
| latest_gitbase="$(docker pull cgr.dev/chainguard/git:latest 2>/dev/null | grep -o 'sha256:[a-fA-F0-9]\+' | cut -d':' -f2)" | |
| latest_golang="$(docker pull cgr.dev/chainguard/go:latest 2>/dev/null | grep -o 'sha256:[a-fA-F0-9]\+' | cut -d':' -f2)" | |
| latest_node="$(docker pull cgr.dev/chainguard/node:latest 2>/dev/null | grep -o 'sha256:[a-fA-F0-9]\+' | cut -d':' -f2)" | |
| echo "latest_wolfi=$latest_wolfi" >> "$GITHUB_ENV" | |
| echo "latest_static=$latest_static" >> "$GITHUB_ENV" | |
| echo "latest_gitbase=$latest_gitbase" >> "$GITHUB_ENV" | |
| echo "latest_golang=$latest_golang" >> "$GITHUB_ENV" | |
| echo "latest_node=$latest_node" >> "$GITHUB_ENV" | |
| ./scripts/mirror-chainguard-images.bash $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node | |
| echo "Docker build and push complete" | |
| - name: Bump SKE dockerfile base images to latest Chainguard SHA | |
| working-directory: enterprise-kratix | |
| run: | | |
| ./scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node Dockerfile.ske-platform | |
| ./scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node Dockerfile.ske-quick-start-installer | |
| ./scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node backstage-controller/Dockerfile | |
| ./scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node headlamp-ske/Dockerfile | |
| ./scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node k8s-health-agent/Dockerfile | |
| ./scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node ske-cortex-controller/Dockerfile | |
| ./scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node ske-operator/Dockerfile | |
| ./scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node ske-platform-image/Dockerfile | |
| git config user.name "syntassodev" | |
| git config user.email "kratix@syntasso.io" | |
| echo "Updated Dockerfiles to latest sha" | |
| changed_files=$(git status --porcelain | awk '{print $2}' | grep -E '(^|/)Dockerfile(\..+)?$' || true) | |
| echo "checking for local diffs..." | |
| if [[ -z "$changed_files" ]]; then | |
| echo "No local changes to commit." | |
| exit 0 | |
| fi | |
| echo "$changed_files" | while IFS= read -r file; do | |
| git add "$file" | |
| done | |
| echo "Changes made, committing and pushing..." | |
| git commit -m "feat: updating Chainguard SHA" | |
| git stash | |
| git pull origin main --rebase | |
| git push origin main | |
| - name: Checkout ske-image repository | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: syntasso/ske-images | |
| ssh-key: ${{ secrets.SKE_IMAGES_DEPLOY_KEY_READ_PUSH }} | |
| path: ske-images | |
| - name: Update SKE images to latest Chainguard SHA | |
| working-directory: ske-images | |
| run: | | |
| image_dirs=$(find . -mindepth 1 -maxdepth 1 -type d | cut -c 3- | grep -v '^\.') | |
| for image_dir in $image_dirs; do | |
| if [ ! -f "${image_dir}/Dockerfile" ]; then | |
| continue | |
| fi | |
| pushd $image_dir | |
| ${{ github.workspace }}/enterprise-kratix/scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node Dockerfile | |
| popd | |
| done | |
| git config user.name "syntassodev" | |
| git config user.email "kratix@syntasso.io" | |
| echo "Updated Dockerfiles to latest sha" | |
| echo "Checking for local diffs..." | |
| if git diff --quiet -- '*/Dockerfile'; then | |
| echo "No local changes to commit." | |
| exit 0 | |
| fi | |
| echo "Changes made, committing and pushing..." | |
| git add -- '*/Dockerfile' | |
| git commit -m "feat: updating Chainguard SHA in SKE images" | |
| git push origin main | |
| - name: Checkout port-controller repository | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: syntasso/ske-port-controller | |
| ssh-key: ${{ secrets.PORT_CONTROLLER_READ_WRITE_KEY }} | |
| path: port-controller | |
| - name: Update Port Controller image to latest Chainguard SHA | |
| working-directory: port-controller | |
| run: | | |
| dockerfile_path=ske-port-controller/Dockerfile | |
| ${{ github.workspace }}/enterprise-kratix/scripts/bump-dockerfile-to-latest-chainguard-sha $latest_wolfi $latest_static $latest_gitbase $latest_golang $latest_node $dockerfile_path | |
| git config user.name "syntassodev" | |
| git config user.email "kratix@syntasso.io" | |
| echo "Updated Dockerfiles to latest sha" | |
| changed_files=$(git status --porcelain | awk '{print $2}' | grep -E '(^|/)Dockerfile(\..+)?$' || true) | |
| echo "checking for local diffs..." | |
| if [[ -z "$changed_files" ]]; then | |
| echo "No local changes to commit." | |
| exit 0 | |
| fi | |
| echo "$changed_files" | while IFS= read -r file; do | |
| git add "$file" | |
| done | |
| echo "Changes made, committing and pushing..." | |
| git commit -m "feat: updating Chainguard SHA" | |
| git stash | |
| git pull origin main --rebase | |
| git push origin main |