Add base image upgrade script

.github/workflows/base-images-upgrade.yaml

@@ -0,0 +1,88 @@
+name: base-images-upgrade
+concurrency: base-images-upgrade
+on:
+  workflow_dispatch: {}
+  schedule:
+    # 10pm daily
+    - cron: '0 22 * * *'
+
+jobs:
+  base_image_upgrade_pr:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+
+    env:
+      SOURCE_BRANCH: "${{ github.ref_name }}"
+      SELF_UPGRADE_BRANCH: "base-image-bump-${{ github.ref_name }}"
+
+    steps:
+      - name: Fail if branch is not head of branch.
+        if: ${{ !startsWith(github.ref, 'refs/heads/') && env.SOURCE_BRANCH != '' && env.SELF_UPGRADE_BRANCH != '' }}
+        run: |
+          echo "This workflow should not be run on a non-branch-head."
+          exit 1
+
+      - uses: actions/checkout@v4
+
+      - id: go-version
+        run: |
+          make print-go-version >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ steps.go-version.outputs.result }}
+
+      - run: |
+          git checkout -B "$SELF_UPGRADE_BRANCH"
+
+      - run: |
+          make upgrade-base-images
+
+      - id: is-up-to-date
+        shell: bash
+        run: |
+          git_status=$(git status -s)
+          is_up_to_date="true"
+          if [ -n "$git_status" ]; then
+              is_up_to_date="false"
+              echo "The following changes will be committed:"
+              echo "$git_status"
+          fi
+          echo "result=$is_up_to_date" >> "$GITHUB_OUTPUT"
+
+      - if: ${{ steps.is-up-to-date.outputs.result != 'true' }}
+        run: |
+          git config --global user.name "cert-manager-bot"
+          git config --global user.email "cert-manager-bot@users.noreply.github.com"
+          git add -A && git commit -m "BOT: run 'make upgrade-klone' and 'make generate'" --signoff
+          git push -f origin "$SELF_UPGRADE_BRANCH"
+
+      - if: ${{ steps.is-up-to-date.outputs.result != 'true' }}
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { repo, owner } = context.repo;
+
+            const pulls = await github.rest.pulls.list({
+              owner: owner,
+              repo: repo,
+              head: owner + ':' + process.env.SELF_UPGRADE_BRANCH,
+              base: process.env.SOURCE_BRANCH,
+              state: 'open',
+            });
+
+            if (pulls.data.length < 1) {
+              await github.rest.pulls.create({
+                title: '[CI] Bump base image to latest available version on ' + process.env.SOURCE_BRANCH,
+                owner: owner,
+                repo: repo,
+                head: process.env.SELF_UPGRADE_BRANCH,
+                base: process.env.SOURCE_BRANCH,
+                body: [
+                  'This PR is auto-generated to bump the base images used for our OCI builds.',
+                ].join('\n'),
+              });
+            }

Makefile

@@ -67,6 +67,11 @@ include modules/tools/00_mod.mk
 patch-go-version:
 	@./scripts/patch_go_version.sh
 
+.PHONY: upgrade-base-images
+upgrade-base-images: | $(NEEDS_CRANE)
+	@CRANE=$(CRANE) \
+		./scripts/upgrade_base_images.sh
+
 ## SHA learning targets
 
 .PHONY: learn-tools-shas
@@ -83,6 +88,7 @@ help: ## Show this help
 	@echo "Usage: make [target] ..."
 	@echo
 	@echo "make patch-go-version"
+	@echo "make upgrade-base-images"
 	@echo
 	@echo "make learn-tools-shas"
 	@echo "make learn-image-shas"

scripts/upgrade_base_images.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+
+# Copyright 2022 The cert-manager Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# This script updates all found occurances of the base images listed below
+# it automatically fetches the latest digest for these images.
+
+base_images=(
+    "quay.io/jetstack/base-static"
+    "quay.io/jetstack/base-static-csi"
+)
+
+if [ -z "$CRANE" ]; then
+    echo "CRANE is not set"
+    exit 1
+fi
+
+# Find latest digests for each base image
+learn_data=()
+
+for image in "${base_images[@]}"; do
+    replace=$($CRANE digest "$image:latest")
+
+    learn_data+=("s|$image@.*$|$image@$replace|g")
+done
+
+# Update all files with the new digests
+
+script_dir=$(dirname "$(realpath "$0")")
+
+pushd "${script_dir}/.." > /dev/null
+
+# see https://stackoverflow.com/a/53408233
+sed_args='-i'''
+if [[ $(uname -s) == "Darwin" ]]; then
+	sed_args=(-i '')
+fi
+
+module_files=$(find ./modules/ -maxdepth 2 -name "00_mod.mk" -type f)
+
+for replace in "${learn_data[@]}"; do
+    for file in $module_files; do
+        sed "${sed_args[@]}" "$replace" "$file";
+    done
+done
+
+popd