image-deps-updater.yaml

name: Update image deps

on:
  schedule:
    - cron: '0 4 * * *'
  workflow_dispatch:
    inputs:
      overwrite:
        description: 'Overwrite the existing image tags'
        required: false
        default: 'true'
jobs:
  build-3rd-party-images:
    runs-on: ubuntu-20.04
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Get tags
      id: get-tags
      run: |
        set -euo pipefail

        # We're only using the APKINDEX files to get the versions, so it doesn't matter which arch we use

        curl -LO --fail --show-error https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz
        tar -xzvf APKINDEX.tar.gz

        minio_version=$(< APKINDEX grep -A1 "^P:minio$" | tail -n 1 | sed -n -e 's/V://p' | tr -d '\n')
        rqlite_version=$(< APKINDEX grep -A1 "^P:rqlite$" | tail -n 1 | sed -n -e 's/V://p' | tr -d '\n')
        dex_version=$(< APKINDEX grep -A1 "^P:dex$" | tail -n 1 | sed -n -e 's/V://p' | tr -d '\n')

        sed "s/__MINIO_VERSION__/$minio_version/g" deploy/minio/apko.yaml.tmpl > deploy/minio/apko.yaml
        sed "s/__RQLITE_VERSION__/$rqlite_version/g" deploy/rqlite/apko.yaml.tmpl > deploy/rqlite/apko.yaml
        sed "s/__DEX_VERSION__/$dex_version/g" deploy/dex/apko.yaml.tmpl > deploy/dex/apko.yaml

        {
          echo "minio-tag=$minio_version"
          echo "rqlite-tag=$rqlite_version"
          echo "dex-tag=$dex_version"
        } >> "$GITHUB_OUTPUT"

    - name: Build and push minio image
      uses: ./.github/actions/build-dep-image-with-apko
      with:
        apko-config: deploy/minio/apko.yaml
        image-name: index.docker.io/kotsadm/minio:${{ steps.get-tags.outputs.minio-tag }}
        registry-username: ${{ secrets.DOCKERHUB_USER }}
        registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
        overwrite: ${{ github.event.inputs.overwrite }}

    - name: Build and push rqlite image
      uses: ./.github/actions/build-dep-image-with-apko
      with:
        apko-config: deploy/rqlite/apko.yaml
        image-name: index.docker.io/kotsadm/rqlite:${{ steps.get-tags.outputs.rqlite-tag }}
        registry-username: ${{ secrets.DOCKERHUB_USER }}
        registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
        overwrite: ${{ github.event.inputs.overwrite }}

    - name: Build and push dex image
      uses: ./.github/actions/build-dep-image-with-apko
      with:
        apko-config: deploy/dex/apko.yaml
        image-name: index.docker.io/kotsadm/dex:${{ steps.get-tags.outputs.dex-tag }}
        registry-username: ${{ secrets.DOCKERHUB_USER }}
        registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
        overwrite: ${{ github.event.inputs.overwrite }}


  update-image-deps:
    needs: [build-3rd-party-images]
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: '^1.20.0'

      - name: Run Update Script
        env:
          GITHUB_AUTH_TOKEN: ${{ secrets.GH_PAT }}
        run: |
          go run ./cmd/imagedeps

      - name: Create Pull Request # creates a PR if there are differences
        uses: peter-evans/create-pull-request@v7
        id: cpr
        with:
          token: ${{ secrets.GH_PAT }}
          commit-message: Update KOTS image dependency tags
          title: 'Automated KOTS Image Dependency Tag Update'
          branch: automation/image-dependencies
          delete-branch: true
          labels: |
            automated-pr
            images
            type::security
          draft: false
          base: "main"
          body: "Automated changes by the [image-deps-updater](https://github.com/replicatedhq/kots/blob/main/.github/workflows/image-deps-updater.yaml) GitHub action"

      - name: Check outputs
        if: ${{ steps.cpr.outputs.pull-request-number }}
        run: |
          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

      - name: Slack Notification
        if: ${{ steps.cpr.outputs.pull-request-number }}
        uses: slackapi/slack-github-action@v1.27.0
        with: 
          payload: |
            {
              "pull_request_url": "${{steps.cpr.outputs.pull-request-url}}"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.KOTS_IMAGE_DEPS_SLACK_WEBHOOK }}