Replace image validity check with shell script

Signed-off-by: Tom Wieczorek <[email protected]>

.github/workflows/go.yml

@@ -85,6 +85,32 @@ jobs:
       target-os: linux
       target-arch: amd64
 
+  check-images:
+    name: "Check :: Images"
+    needs: [build-k0s]
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: "Workflow run :: Checkout"
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: "Download :: Airgap image list"
+        uses: actions/download-artifact@v4
+        with:
+          name: airgap-image-list-linux-amd64
+
+      - name: "Check :: Image validity"
+        run: |
+          mkdir -p embedded-bins/staging/linux/bin
+          make --touch airgap-images.txt
+          make check-image-validity
+
   generate-sbom:
     name: "Build :: SBOM"
     needs: [build-k0s]
@@ -144,9 +170,6 @@ jobs:
           make --touch codegen
           make check-unit
 
-      - name: Validate OCI images manifests
-        run: make check-image-validity
-
   unittests-k0s-windows-amd64:
     name: "Unit tests :: windows-amd64"
     runs-on: windows-2022

Makefile

@@ -259,8 +259,8 @@ check-unit: go.sum codegen
 	CGO_CFLAGS='$(BUILD_CGO_CFLAGS)' $(GO) test -tags=hack $(GO_TEST_RACE) -ldflags='$(LD_FLAGS)' `$(GO) list -tags=hack $(GO_CHECK_UNIT_DIRS)`
 
 .PHONY: check-image-validity
-check-image-validity: go.sum
-	$(GO) run -tags=hack hack/validate-images/main.go -architectures amd64,arm64,arm
+check-image-validity: go.sum airgap-images.txt
+	hack/validate-images.sh <airgap-images.txt
 
 .PHONY: clean-gocache
 clean-gocache:

hack/validate-images.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env sh
+#shellcheck disable=SC3043
+
+set -eu
+
+check_platforms() {
+  # shellcheck disable=SC2016
+  local filter='
+    $ARGS.positional - [.manifests[].platform | "\(.os)/\(.architecture)"]
+    | if length == 0 then "ok" else "missing platforms: " + join(", ") end
+  '
+  docker manifest inspect -- "$image" | jq --args -r "$filter" -- "$@"
+}
+
+ret=0
+while read -r image; do
+  case "$image" in
+  */envoy-distroless:*) set -- linux/amd64 linux/arm64 ;;
+  *) set -- linux/amd64 linux/arm64 linux/arm ;;
+  esac
+
+  printf 'Checking image validity for %s ... ' "$image" >&2
+  check=$(check_platforms "$@")
+  if [ "$check" != "ok" ]; then
+    ret=1
+    printf '\033[31m%s\033[0m\n' "$check" >&2
+  else
+    printf '\033[32mok: %s\033[0m\n' "$*" >&2
+  fi
+done
+
+exit $ret