update-flux.yaml

name: Update-Flux

on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 1" # Run at 12:00 AM every Monday

jobs:
  update-flux:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Flux CLI
        uses: fluxcd/flux2/action@main
        with:
          version: "latest"

      - name: Update Flux
        run: flux install --export > ./kubernetes/infra/flux/gotk-components.yaml

      - name: Install Required Tools
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
          curl -L https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -o /usr/local/bin/yq
          chmod +x /usr/local/bin/yq

      - name: Pin Docker Image Tags to Digests
        run: |
          FILE="./kubernetes/infra/flux/gotk-components.yaml"
          TMP_FILE="./kubernetes/infra/flux/gotk-components.tmp.yaml"

          while IFS= read -r line; do
            if [[ "$line" =~ image:\ (.+):([a-zA-Z0-9_.-]+)$ ]]; then
              IMAGE="${BASH_REMATCH[1]}"
              TAG="${BASH_REMATCH[2]}"
              DIGEST=$(skopeo inspect docker://$IMAGE:$TAG | jq -r '.Digest')

              PINNED_IMAGE="$IMAGE:$TAG@$DIGEST"

              line="${line//${BASH_REMATCH[0]}/image: $PINNED_IMAGE}"
            fi
            echo "$line" >> "$TMP_FILE"
          done < "$FILE"

          mv "$TMP_FILE" "$FILE"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Commit and Push Changes
        id: commit
        run: |
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"
          if [ -n "$(git status --porcelain)" ]; then
            git add .
            git commit -m "Pin Docker image tags to digests"
            git checkout -b gh-actions/flux-update
            git push --set-upstream origin gh-actions/flux-update
            echo "changes=true" >> $GITHUB_OUTPUT
          else
            echo "No changes to commit."
            echo "changes=false" >> $GITHUB_OUTPUT
          fi
        shell: bash

      - name: Create Pull Request
        if: steps.commit.outputs.changes == 'true'
        run: gh pr create -B master -H gh-actions/flux-update --title 'Update Flux with Pinned Digests' --body 'Updates flux components using Flux CLI and pins Docker image tags to digests'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}