diff --git a/.github/renovate.json5 b/.github/renovate.json5 index c3926acc..c134f23d 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -7,12 +7,11 @@ { customType: 'regex', managerFilePatterns: [ - 'modules/cert-manager/**/*.mk', - 'modules/tools/**/*.mk', + 'modules/**/*.mk', ], matchStrings: [ - '(?:^|\\r\\n|\\r|\\n)#\\s*renovate:\\s*datasource=(?\\S+)\\s+packageName=(?\\S+)(?:^|\\r\\n|\\r|\\n)\\S+ \\+= \\S+=(?\\S+)', - '(?:^|\\r\\n|\\r|\\n)#\\s*renovate:\\s*datasource=(?\\S+)\\s+packageName=(?\\S+)(?:^|\\r\\n|\\r|\\n)\\S+ (:|\\?)= (?\\S+)' + '(?:^|\\r\\n|\\r|\\n)#\\s*renovate:\\s*datasource=(?\\S+)\\s+packageName=(?\\S+)(?:^|\\r\\n|\\r|\\n)\\S+\\s+(?:\\+=\\s+[^=]*=|(:|\\?)\\s*=\\s*)(?[^\\s:@]+)\\s*(?:\\r\\n|\\r|\\n|$)', + '(?:^|\\r\\n|\\r|\\n)#\\s*renovate:\\s*datasource=(?\\S+)(?:\\s+packageName=(?\\S+))?(?:^|\\r\\n|\\r|\\n)\\S+\\s+:=\\s+(?[^@:\\s]+):(?[^@\\s]+)(?:@(?sha256:[a-f0-9]+))?', ], }, { diff --git a/.github/workflows/base-images-upgrade.yaml b/.github/workflows/base-images-upgrade.yaml deleted file mode 100644 index de133fc6..00000000 --- a/.github/workflows/base-images-upgrade.yaml +++ /dev/null @@ -1,97 +0,0 @@ -name: base-images-upgrade -concurrency: base-images-upgrade -on: - workflow_dispatch: {} - schedule: - # 10pm daily - - cron: '0 22 * * *' - -permissions: - contents: read - -jobs: - base_image_upgrade_pr: - runs-on: ubuntu-latest - - permissions: - contents: write - pull-requests: write - - env: - SOURCE_BRANCH: "${{ github.ref_name }}" - SELF_UPGRADE_BRANCH: "base-image-bump-${{ github.ref_name }}" - - steps: - - name: Fail if branch is not head of branch. - if: ${{ !startsWith(github.ref, 'refs/heads/') && env.SOURCE_BRANCH != '' && env.SELF_UPGRADE_BRANCH != '' }} - run: | - echo "This workflow should not be run on a non-branch-head." - exit 1 - - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - id: go-version - run: | - make print-go-version >> "$GITHUB_OUTPUT" - - - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 - with: - go-version: ${{ steps.go-version.outputs.result }} - - - run: | - git checkout -B "$SELF_UPGRADE_BRANCH" - - - run: | - make upgrade-base-images - - - id: is-up-to-date - shell: bash - run: | - git_status=$(git status -s) - is_up_to_date="true" - if [ -n "$git_status" ]; then - is_up_to_date="false" - echo "The following changes will be committed:" - echo "$git_status" - fi - echo "result=$is_up_to_date" >> "$GITHUB_OUTPUT" - - - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} - run: | - git config --global user.name "cert-manager-bot" - git config --global user.email "cert-manager-bot@users.noreply.github.com" - git add -A && git commit -m "BOT: run 'make upgrade-klone' and 'make generate'" --signoff - git push -f origin "$SELF_UPGRADE_BRANCH" - - - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 - with: - script: | - const { repo, owner } = context.repo; - - const pulls = await github.rest.pulls.list({ - owner: owner, - repo: repo, - head: owner + ':' + process.env.SELF_UPGRADE_BRANCH, - base: process.env.SOURCE_BRANCH, - state: 'open', - }); - - if (pulls.data.length < 1) { - const result = await github.rest.pulls.create({ - title: '[CI] Bump base image to latest available version on ' + process.env.SOURCE_BRANCH, - owner: owner, - repo: repo, - head: process.env.SELF_UPGRADE_BRANCH, - base: process.env.SOURCE_BRANCH, - body: [ - 'This PR is auto-generated to bump the base images used for our OCI builds.', - ].join('\n'), - }); - await github.rest.issues.addLabels({ - owner, - repo, - issue_number: result.data.number, - labels: ['skip-review'] - }); - } diff --git a/Makefile b/Makefile index 63399bf7..d7662651 100644 --- a/Makefile +++ b/Makefile @@ -88,11 +88,6 @@ include modules/generate-verify/02_mod.mk ## Upgrade targets -.PHONY: upgrade-base-images -upgrade-base-images: | $(NEEDS_CRANE) - @CRANE=$(CRANE) \ - ./scripts/upgrade_base_images.sh - # Upgrade the kind images to the latest available version from # the kind release description. This script is useful when kind publishes # a new kubernetes image and updates the kind release description. @@ -135,7 +130,6 @@ test-e2e: help: ## Show this help @echo "Usage: make [target] ..." @echo - @echo "make upgrade-base-images" @echo "make upgrade-kind-images" @echo @echo "make learn-golang-shas" diff --git a/modules/oci-build/00_mod.mk b/modules/oci-build/00_mod.mk index 252e376b..c04da188 100644 --- a/modules/oci-build/00_mod.mk +++ b/modules/oci-build/00_mod.mk @@ -13,12 +13,12 @@ # limitations under the License. # Use distroless as minimal base image to package the manager binary -# To get latest SHA run "crane digest quay.io/jetstack/base-static:latest" -base_image_static := quay.io/jetstack/base-static@sha256:dc719ea428e9b88843862bd8de896bbe974088bc838d000a33f091a835744c33 +# renovate: datasource=docker +base_image_static := quay.io/jetstack/base-static:latest@sha256:dc719ea428e9b88843862bd8de896bbe974088bc838d000a33f091a835744c33 # Use custom apko-built image as minimal base image to package the manager binary -# To get latest SHA run "crane digest quay.io/jetstack/base-static-csi:latest" -base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:83a2ffc4266da49036b08fef76e8f424a76b12ab870a702231bb4132ae3dbb88 +# renovate: datasource=docker +base_image_csi-static := quay.io/jetstack/base-static-csi:latest@sha256:83a2ffc4266da49036b08fef76e8f424a76b12ab870a702231bb4132ae3dbb88 # Utility functions fatal_if_undefined = $(if $(findstring undefined,$(origin $1)),$(error $1 is not set)) diff --git a/scripts/upgrade_base_images.sh b/scripts/upgrade_base_images.sh deleted file mode 100755 index ec6ecd2b..00000000 --- a/scripts/upgrade_base_images.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/usr/bin/env bash - -# Copyright 2022 The cert-manager Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o errexit -set -o nounset -set -o pipefail - -# This script updates all found occurrences of the base images listed below -# it automatically fetches the latest digest for these images. - -base_images=( - "quay.io/jetstack/base-static" - "quay.io/jetstack/base-static-csi" -) - -if [ -z "$CRANE" ]; then - echo "CRANE is not set" - exit 1 -fi - -# Find latest digests for each base image -learn_data=() - -for image in "${base_images[@]}"; do - replace=$($CRANE digest "$image:latest") - - learn_data+=("s|$image@.*$|$image@$replace|g") -done - -# Update all files with the new digests - -script_dir=$(dirname "$(realpath "$0")") - -pushd "${script_dir}/.." > /dev/null - -# see https://stackoverflow.com/a/53408233 -sed_args='-i''' -if [[ $(uname -s) == "Darwin" ]]; then - sed_args=(-i '') -fi - -module_files=$(find ./modules/ -maxdepth 2 -name "00_mod.mk" -type f) - -for replace in "${learn_data[@]}"; do - for file in $module_files; do - sed "${sed_args[@]}" "$replace" "$file"; - done -done - -popd