How to find out the version of a package in a GitHub Action?

[kastl-ars]

Hi all,

is there a way to find out the current version of a package in a GitHub Action? When building an image based on Wolfi, it would be nice to tag the image with a useful version number.

As there are no releases, using something like the pozetroninc/github-action-get-latest-release@master action does not work...

Kind Regards,
Johannes

[xnox]

You can use something like https://github.com/jonjohnsonjr/apkrane to query package information.

[xnox]

Take a look at this Github action: https://github.com/kastl-ars/wolfi-pluto/blob/main/.github/workflows/apko_build.yml

It uses the pozetroninc/github-action-get-latest-release@master action to find out the latest pluto release and then adds this version as a tag to the resulting pluto container image.

This works, because Pluto very infrequently gets new releases. But it would use a wrong version number, if pluto got a new release and the pluto package for Wolfi was not yet rebuilt.

Hence I would like to use an Action that uses the actual version of the pluto package in Wolfi.

Sorry, my previous explanations might have been lacking details.

Before implementing a container image based on apkrane and using that as a GitHub action I wanted to ask, if such a tool already existed...

https://github.com/chainguard-images/actions/tree/main/apko-publish has option called "sbom-path" set that, apko will write out SBOM there (including package versions that are actually in the apko built image), parse that, use version tag from that.

Does that help? SBOM is source of truth w.r.t. image contents that was just built.

[xnox]

separately would it help if chainguard themselves publish the pluton image to avoid you needing to do all of that? =)

[kastl-ars]

separately would it help if chainguard themselves publish the pluton image to avoid you needing to do all of that? =)

That was just one example, but yes, I would like to see that. I already opened a PR for preparing that image, but recently all PRs were closed due to too many images apparently.

But my question was rather general, as Chainguard might not be willing to maintain an image for everything, so there may be images that I maintain myself and where such a solution would come in handy.

[kastl-ars]

https://github.com/chainguard-images/actions/tree/main/apko-publish has option called "sbom-path" set that, apko will write out SBOM there (including package versions that are actually in the apko built image), parse that, use version tag from that.

Does that help? SBOM is source of truth w.r.t. image contents that was just built.

Hmm, but then I would need to split up the action, as the apko-publish action already publishes the image. So I would need to switch to only building with apko, then parsing the SBOM and then somehow publish what was built before. Sounds rather convoluted to me at the moment.

TL;DR Apparently there is no out-of-the-box solution for my need. Maybe because nobody other than me had that need.

So I guess I will try to create a container image for apkrane and try to use that as a GitHub action...

[xnox]

https://github.com/chainguard-images/actions/tree/main/apko-publish has option called "sbom-path" set that, apko will write out SBOM there (including package versions that are actually in the apko built image), parse that, use version tag from that.
Does that help? SBOM is source of truth w.r.t. image contents that was just built.

Hmm, but then I would need to split up the action, as the apko-publish action already publishes the image. So I would need to switch to only building with apko, then parsing the SBOM and then somehow publish what was built before. Sounds rather convoluted to me at the moment.

TL;DR Apparently there is no out-of-the-box solution for my need. Maybe because nobody other than me had that need.

So I guess I will try to create a container image for apkrane and try to use that as a GitHub action...

normally the apkobuild is tagged as latest, or not tagged at all; and one retags pushed image with version tags, latest tags based on hash. tags are separate from the container hash.