image-deps-updater.yaml

name: Update image deps

on:
  schedule:
    - cron: '0 4 * * *'
  workflow_dispatch:
    inputs:
      overwrite:
        description: 'Overwrite the existing image tags'
        required: false
        default: 'true'
jobs:
  build-3rd-party-images:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v7

    - name: Get tags
      id: get-tags
      run: |
        set -euo pipefail

        # Get latest minio version from registry
        minio_version=$(skopeo list-tags docker://proxy.replicated.com/library/minio | \
          jq -r '.Tags[]' | \
          grep -E '^RELEASE\.[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}-[0-9]{2}-[0-9]{2}Z$' | \
          sort -V | \
          tail -n 1)

        # Get latest rqlite version from registry
        rqlite_version=$(skopeo list-tags docker://proxy.replicated.com/library/rqlite | \
          jq -r '.Tags[]' | \
          grep -E '[0-9]+\.[0-9]+\.[0-9]+$' | \
          sort -V | \
          tail -n 1)

        # Get latest dex version from registry
        dex_version=$(skopeo list-tags docker://proxy.replicated.com/library/dex | \
          jq -r '.Tags[]' | \
          grep -E '^v?[0-9]+\.[0-9]+\.[0-9]+$' | \
          sed 's/^v//' | \
          sort -V | \
          tail -n 1)

        {
          echo "minio-tag=$minio_version"
          echo "rqlite-tag=$rqlite_version"
          echo "dex-tag=$dex_version"
        } >> "$GITHUB_OUTPUT"

    - name: Copy minio image
      run: |
        skopeo copy --all \
          --dest-creds "${{ secrets.DOCKERHUB_USER }}:${{ secrets.DOCKERHUB_PASSWORD }}" \
          docker://proxy.replicated.com/library/minio:${{ steps.get-tags.outputs.minio-tag }} \
          docker://index.docker.io/kotsadm/minio:${{ steps.get-tags.outputs.minio-tag }}

    - name: Copy rqlite image
      run: |
        skopeo copy --all \
          --dest-creds "${{ secrets.DOCKERHUB_USER }}:${{ secrets.DOCKERHUB_PASSWORD }}" \
          docker://proxy.replicated.com/library/rqlite:${{ steps.get-tags.outputs.rqlite-tag }} \
          docker://index.docker.io/kotsadm/rqlite:${{ steps.get-tags.outputs.rqlite-tag }}

    - name: Copy dex image
      run: |
        skopeo copy --all \
          --dest-creds "${{ secrets.DOCKERHUB_USER }}:${{ secrets.DOCKERHUB_PASSWORD }}" \
          docker://proxy.replicated.com/library/dex:v${{ steps.get-tags.outputs.dex-tag }} \
          docker://index.docker.io/kotsadm/dex:${{ steps.get-tags.outputs.dex-tag }}


  update-image-deps:
    needs: [build-3rd-party-images]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod

      - name: Run Update Script
        env:
          GITHUB_AUTH_TOKEN: ${{ secrets.GH_PAT }}
        run: |
          go run ./cmd/imagedeps

      - name: Create Pull Request # creates a PR if there are differences
        uses: peter-evans/create-pull-request@v8
        id: cpr
        with:
          token: ${{ secrets.GH_PAT }}
          commit-message: Update KOTS image dependency tags
          title: 'Automated KOTS Image Dependency Tag Update'
          branch: automation/image-dependencies
          delete-branch: true
          labels: |
            automated-pr
            images
            type::security
          draft: false
          base: "main"
          body: "Automated changes by the [image-deps-updater](https://github.com/replicatedhq/kots/blob/main/.github/workflows/image-deps-updater.yaml) GitHub action"

      - name: Check outputs
        if: ${{ steps.cpr.outputs.pull-request-number }}
        run: |
          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

      - name: Slack Notification
        if: ${{ steps.cpr.outputs.pull-request-number }}
        uses: slackapi/slack-github-action@v4.0.0
        with:
          webhook: ${{ secrets.KOTS_IMAGE_DEPS_SLACK_WEBHOOK }}
          webhook-type: webhook-trigger
          payload: |
            pull_request_url: "${{steps.cpr.outputs.pull-request-url}}"