8000 Enable SHA pinning with incremental container images numbers by andreaTP · Pull Request #12110 · keycloak/keycloak · GitHub
[go: up one dir, main page]

Skip to content

Enable SHA pinning with incremental container images numbers - #12110

Closed
andreaTP wants to merge 1 commit into
keycloak:mainfrom
andreaTP:issue-11463
Closed

andreaTP wants to merge 1 commit into
keycloak:mainfrom
andreaTP:issue-11463

Conversation

@andreaTP
Copy link
Copy Markdown
Contributor

Resolves #11463

Comment thread .github/workflows/release-container.yml Resolved
@abstractj
abstractj requested review from ASzc, hmlnarik and pskopek May 19, 2022 13:52
@abstractj abstractj self-assigned this May 19, 2022
@abstractj
abstractj requested a review from stianst May 23, 2022 12:20
echo "-${c}"
break
fi
done
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This loop doesn't seem necessary.

With anonymous access to the quay API, we can list all th 8000 e current tags, and determine what the next value for c should be from that:

curl -sSfL 'https://quay.io/api/v1/repository/keycloak/keycloak/tag/? class="pl-pds">' | jq -r '.tags | .[] | .name' | head
nightly
latest
18.0
18.0.0
legacy
18.0.0-legacy
17.0.1-legacy
17.0
17.0.1
17.0.0-legacy

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I read correctly the documentation:
https://docs.quay.io/api/swagger/#!/tag/listRepoTags
the endpoint you are suggesting will return a paged result and the order is not specified.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, that's true. The order does seem to be the time of modification, but that's not specified. Here's a more complete solution:

#!/bin/bash

set -xeuo pipefail

repo="${1:-keycloak/keycloak}"
original_tag="${2:-18.0.0}"

tmp_json="$(mktemp)"
tmp_tags="$(mktemp)"
trap "rm -f '$tmp_json' '$tmp_tags'" EXIT
page=1
while true
do
    curl -sSfL "https://quay.io/api/v1/repository/$repo/tag/? class="pl-smi">$page" > "$tmp_json"
    jq -r '.tags | .[] | .name' "$tmp_json" >> "$tmp_tags"

    if jq '.has_additional' "$tmp_json" | grep -qxF 'true'
    then
        (( page+=1 ))
    else
        break
    fi
done

c="$(sort -Vu "$tmp_tags" | grep -F "$original_tag" | grep -Ee '-[0-9]+$' | tail -n1 | rev | cut -d- -f1 | rev || true)"
[ -n "$c" ] || c=0
(( c+=1 ))

echo "New suffix: $c"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the update @ASzc !
This is again a similar tradeoff as the other PR 🙂 , I do believe that plain docker commands are preferable for this task since they work with any Docker registry.
Also, the overall complexity of your proposed solution (although shows great bash skills 🙂 ) seems to be a little higher than my proposal.

It would be nice to have a third opinion to break the tie, cc. @abstractj @stianst

type=ref,event=branch
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{version}},suffix=${{ env.INCREMENTAL }}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suffix may require you to add the separator (e.g. -) in there too? It's not well documented...

https://github.com/docker/metadata-action#typesemver doesn't really say much

Copy link
Copy Markdown
Cont 8000 ributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@abstractj
abstractj requested a review from iankko June 1, 2022 18:37
@andreaTP andreaTP closed this Jun 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Quay image tags overwritten? SHAs purged?

3 participants

0