Skip to content

Commit 392dd15

Browse files
Shubhranshu153Shubhranshu153
authored
feat: add workflow to create pr to update deb dependencies (#1458)
Signed-off-by: Shubhranshu Mahapatra <[email protected]>
1 parent b20ae88 commit 392dd15

File tree

2 files changed

+211
-0
lines changed

2 files changed

+211
-0
lines changed

‎.github/workflows/update-ubuntu-finch-dependencies.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: update-ubuntu-dependencies
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
schedule:
8+
- cron: '0 9 * * *' # Run daily at 9 AM UTC
9+
workflow_dispatch:
10+
11+
jobs:
12+
update-dependencies:
13+
runs-on: ubuntu-latest
14+
outputs:
15+
changed: ${{ steps.changes.outputs.changed }}
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@v4
19+
20+
- name: Run dependency update
21+
run: |
22+
cd contrib/packaging/deb
23+
chmod +x update-dependencies.sh
24+
./update-dependencies.sh
25+
26+
- name: Check for changes
27+
id: changes
28+
run: |
29+
if git diff --quiet contrib/packaging/deb/package.sh; then
30+
echo "changed=false" >> $GITHUB_OUTPUT
31+
else
32+
echo "changed=true" >> $GITHUB_OUTPUT
33+
fi
34+
35+
ubuntu-e2e-tests:
36+
needs: update-dependencies
37+
if: needs.update-dependencies.outputs.changed == 'true'
38+
uses: ./.github/workflows/e2e-ubuntu.yaml
39+
secrets: inherit
40+
with:
41+
arch: ubuntu-x86-64
42+
output-arch: amd64
43+
44+
create-pr:
45+
needs: [update-dependencies, ubuntu-e2e-tests]
46+
if: needs.update-dependencies.outputs.changed == 'true'
47+
runs-on: ubuntu-latest
48+
steps:
49+
- name: Checkout
50+
uses: actions/checkout@v4
51+
52+
- name: Create or update PR
53+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
54+
with:
55+
token: ${{ secrets.GITHUB_TOKEN }}
56+
signoff: true
57+
commit-message: 'chore: update debian dependencies'
58+
title: 'chore: update debian dependencies'
59+
body: |
60+
This PR updates the following dependencies to their latest versions:
61+
62+
- finch-daemon
63+
- nerdctl
64+
- buildkit
65+
- soci-snapshotter
66+
- CNI plugins
67+
- cosign
68+
69+
This is an automated update created by the dependency update workflow. Review the changes before approving.
70+
branch: update-dependencies
71+
delete-branch: true

‎contrib/packaging/deb/update-dependencies.sh‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
6+
PACKAGE_SH="$SCRIPT_DIR/package.sh"
7+
8+
# Function to get latest tag from GitHub API
9+
get_latest_tag() {
10+
local repo="$1"
11+
curl -s "https://api.github.com/repos/$repo/tags" | \
12+
grep '"name":' | \
13+
head -1 | \
14+
cut -d'"' -f4 | \
15+
sed 's/^v//'
16+
}
17+
18+
# Function to get commit hash for a tag
19+
get_commit_for_tag() {
20+
local repo="$1"
21+
local tag="$2"
22+
[[ $tag != v* ]] && tag="v$tag"
23+
curl -s "https://api.github.com/repos/$repo/commits/$tag" | \
24+
grep '"sha":' | \
25+
head -1 | \
26+
cut -d'"' -f4
27+
}
28+
29+
# Function to get BuildKit version from nerdctl Dockerfile
30+
get_buildkit_version() {
31+
local nerdctl_tag="$1"
32+
[[ $nerdctl_tag != v* ]] && nerdctl_tag="v$nerdctl_tag"
33+
34+
local dockerfile_url="https://raw.githubusercontent.com/containerd/nerdctl/$nerdctl_tag/Dockerfile"
35+
local dockerfile_content=$(curl -s "$dockerfile_url")
36+
37+
local buildkit_version=$(echo "$dockerfile_content" | grep -E '^ARG BUILDKIT_VERSION=' | cut -d'=' -f2 | sed 's/@BINARY$//' | sed 's/^v//')
38+
39+
echo "$buildkit_version"
40+
}
41+
42+
# Function to get cni plugin version from nerdctl Dockerfile
43+
get_cni_plugin_version() {
44+
local nerdctl_tag="$1"
45+
[[ $nerdctl_tag != v* ]] && nerdctl_tag="v$nerdctl_tag"
46+
47+
local dockerfile_url="https://raw.githubusercontent.com/containerd/nerdctl/$nerdctl_tag/Dockerfile"
48+
local dockerfile_content=$(curl -s "$dockerfile_url")
49+
50+
local cni_plugin_version=$(echo "$dockerfile_content" | grep -E '^ARG CNI_PLUGINS_VERSION=' | cut -d'=' -f2 | sed 's/@BINARY$//' | sed 's/^v//')
51+
52+
echo "$cni_plugin_version"
53+
}
54+
55+
# Function to get Cosign version from nerdctl Dockerfile
56+
get_cosign_version() {
57+
local nerdctl_tag="$1"
58+
[[ $nerdctl_tag != v* ]] && nerdctl_tag="v$nerdctl_tag"
59+
60+
local dockerfile_url="https://raw.githubusercontent.com/containerd/nerdctl/$nerdctl_tag/Dockerfile"
61+
local dockerfile_content=$(curl -s "$dockerfile_url")
62+
63+
# Extract Cosign version from COPY instruction
64+
# Current Format: COPY --from=ghcr.io/sigstore/cosign/cosign:v2.2.3@sha256:... /ko-app/cosign /usr/local/bin/cosign
65+
local cosign_version=$(echo "$dockerfile_content" | grep -E 'COPY --from=ghcr.io/sigstore/cosign/cosign:' | sed -E 's/.*cosign:v([0-9]+\.[0-9]+\.[0-9]+).*/\1/' | head -1)
66+
67+
echo "$cosign_version"
68+
}
69+
70+
# Function to update dependency in package.sh
71+
update_dependency() {
72+
local name="$1"
73+
local new_release="$2"
74+
local new_commit="$3"
75+
local temp_file=$(mktemp)
76+
77+
sed \
78+
-e "s/${name}_RELEASE=\"[^\"]*\"/${name}_RELEASE=\"$new_release\"/" \
79+
-e "s/${name}_COMMIT=\"[^\"]*\"/${name}_COMMIT=\"$new_commit\"/" \
80+
"$PACKAGE_SH" > "$temp_file"
81+
82+
mv "$temp_file" "$PACKAGE_SH"
83+
}
84+
85+
echo "Updating dependencies in package.sh..."
86+
87+
# Update finch-daemon
88+
echo "Updating finch-daemon..."
89+
FINCHD_LATEST=$(get_latest_tag "runfinch/finch-daemon")
90+
FINCHD_COMMIT=$(get_commit_for_tag "runfinch/finch-daemon" "$FINCHD_LATEST")
91+
update_dependency "FINCHD" "$FINCHD_LATEST" "$FINCHD_COMMIT"
92+
93+
# Update nerdctl
94+
echo "Updating nerdctl..."
95+
NERDCTL_LATEST=$(get_latest_tag "containerd/nerdctl")
96+
NERDCTL_COMMIT=$(get_commit_for_tag "containerd/nerdctl" "$NERDCTL_LATEST")
97+
update_dependency "NERDCTL" "$NERDCTL_LATEST" "$NERDCTL_COMMIT"
98+
99+
# Get BuildKit version from nerdctl Dockerfile
100+
echo "Getting BuildKit version from nerdctl Dockerfile..."
101+
BUILDKIT_VERSION=$(get_buildkit_version "$NERDCTL_LATEST")
102+
103+
# Get Cosign version from nerdctl Dockerfile
104+
echo "Getting Cosign version from nerdctl Dockerfile..."
105+
COSIGN_VERSION=$(get_cosign_version "$NERDCTL_LATEST")
106+
107+
# Update buildkit with version from nerdctl
108+
echo "Updating buildkit to version $BUILDKIT_VERSION..."
109+
BUILDKIT_COMMIT=$(get_commit_for_tag "moby/buildkit" "$BUILDKIT_VERSION")
110+
update_dependency "BUILDKIT" "$BUILDKIT_VERSION" "$BUILDKIT_COMMIT"
111+
112+
# Update soci-snapshotter
113+
echo "Updating soci-snapshotter..."
114+
SOCI_LATEST=$(get_latest_tag "awslabs/soci-snapshotter")
115+
SOCI_COMMIT=$(get_commit_for_tag "awslabs/soci-snapshotter" "$SOCI_LATEST")
116+
update_dependency "SOCI" "$SOCI_LATEST" "$SOCI_COMMIT"
117+
118+
# Update CNI plugins
119+
echo "Updating CNI plugins..."
120+
CNI_LATEST=$(get_cni_plugin_version "$NERDCTL_LATEST")
121+
CNI_COMMIT=$(get_commit_for_tag "containernetworking/plugins" "$CNI_LATEST")
122+
update_dependency "CNI" "$CNI_LATEST" "$CNI_COMMIT"
123+
124+
# Update cosign with version from nerdctl
125+
echo "Updating cosign to version $COSIGN_VERSION..."
126+
if [ -n "$COSIGN_VERSION" ]; then
127+
COSIGN_COMMIT=$(get_commit_for_tag "sigstore/cosign" "$COSIGN_VERSION")
128+
update_dependency "COSIGN" "$COSIGN_VERSION" "$COSIGN_COMMIT"
129+
else
130+
echo "WARNING: Failed to extract cosign version from nerdctl Dockerfile"
131+
fi
132+
133+
echo "Dependencies updated successfully!"
134+
echo "Updated versions:"
135+
echo " finch-daemon: $FINCHD_LATEST"
136+
echo " nerdctl: $NERDCTL_LATEST"
137+
echo " buildkit: $BUILDKIT_VERSION"
138+
echo " soci-snapshotter: $SOCI_LATEST"
139+
echo " CNI plugins: $CNI_LATEST"
140+
echo " cosign: $COSIGN_VERSION"

0 commit comments

Comments
 (0)