Add CNB Stack Images

[joshwlewis]

This PR introduces new images recipes and tags:

• heroku/heroku:18-cnb
• heroku/heroku:18-cnb-build
• heroku/heroku:20-cnb
• heroku/heroku:20-cnb-build
• heroku/heroku:22-cnb
• heroku/heroku:22-cnb-build

The *-cnb variants are CNB-compatible runtime stack images. The *-cnb-build variants are CNB-compatible build stack images. All of the new images are largely based on their non-cnb counterpart. These images are nearly identical to the heroku/pack:* images (generated in pack-images), which we intend to replace.

GUS-W-11227981.
GUS-W-9864812.

[edmorley]

I think the new cnb job will need to be run after the other jobs (as a workflow with requires etc), otherwise the new cnb images will pick up the old base image rather than the newly generated ones each time.

[edmorley]

As an added bonus, moving these images from the pack-images repo to here will also fix GUS-W-9864812 :-)

[edmorley]

I know this is in draft, but I took a quick look since excited to see these changes land :-)

I noticed that CI was passing, even though installed-packages.txt wasn't generated for each of the new images. eg:
https://app.circleci.com/pipelines/github/heroku/stack-images/100/workflows/cc23f05f-a175-4c68-8fe4-cfcec15d051b/jobs/343

Generated files differ from checked-in versions! Run bin/build.sh to regenerate them locally.

Changed files:
?? heroku-22-cnb-build/installed-packages.txt
?? heroku-22-cnb/installed-packages.txt

It seems there is a bug in that validation check? Either it's now completely broken on main, or else it doesn't handle missing files correctly, but still handles changed files.

I personally would be fine with skipping this validation check for the new CNB variants (eg a *-cnb* conditional in build.sh) - since we don't add any packages there, and having the check means any package changes in the underlying images now have to be updated in more places. However up to you.

Though would be good to fix the check at some point (eg another PR) regardless :-)

[joshwlewis]

I personally would be fine with skipping this validation check for the new CNB variants (eg a *-cnb* conditional in build.sh)

This was the approach I ended up taking. I looked at setting up symlinks for installed-packages.txt, but it wasn't compatible with the git status detection we were using =(.

[edmorley]

Thank you!

[edmorley]

@joshwlewis To save having to wait until the next stack image update to unblock the pack-images builder changes, one option that I'd be fine with would be for you to just locally pull/tag/push the newly generated *-cnb-*.nightly images to the latest (non-nightly) tags (especially since they'll just get overwritten in 2 weeks at the next stack image update anyway).

[edmorley]

@joshwlewis I've just triggered a new stack image release (for the libyaml addition), which means there are now official latest + v80 variants of the new images:
https://github.com/heroku/stack-images/releases/tag/v80
https://hub.docker.com/r/heroku/heroku/tags?page=1&name=cnb

As such, I'll delete the temporary nopack variants used for triggering the interim release:
https://hub.docker.com/r/heroku/heroku/tags?page=1&name=nopack