docker-base-distro/.gitea/workflows/update-check.yaml

name: Check for Upstream Stable Updates

on:
  schedule:
    # Daily at 8am UTC
    - cron: '0 8 * * *'
  workflow_dispatch:

permissions:
  contents: read

env:
  IMAGE_NAME: base-distro

jobs:
  check-wolfi:
    name: Check Wolfi package updates
    runs-on: ubuntu-latest
    outputs:
      updated: ${{ steps.check.outputs.updated }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Install apko
        run: |
          APKO_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
          APKO_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
          curl -fsSL "https://github.com/chainguard-dev/apko/releases/latest/download/apko_${APKO_OS}_${APKO_ARCH}.tar.gz" | tar xz -C /usr/local/bin apko          

      - name: Check for Wolfi package updates
        id: check
        run: |
          # Resolve current packages for each variant and compare with last known state
          UPDATED=false

          for config in apko/base.yaml apko/build.yaml apko/dotnet-runtime.yaml apko/dotnet-sdk.yaml apko/flutter-sdk.yaml; do
            VARIANT=$(basename "$config" .yaml)
            echo "Checking $VARIANT..."

            # Resolve package versions (dry-run build to see resolved versions)
            RESOLVED=$(apko resolve "$config" 2>&1 || true)
            HASH=$(echo "$RESOLVED" | sha256sum | cut -d' ' -f1)

            echo "$VARIANT=$HASH" >> "$GITHUB_OUTPUT"
            echo "  Hash: $HASH"
          done

          echo "updated=$UPDATED" >> "$GITHUB_OUTPUT"          

  check-dotnet:
    name: Check .NET stable releases
    runs-on: ubuntu-latest
    outputs:
      new_version: ${{ steps.check.outputs.new_version }}
      current_version: ${{ steps.check.outputs.current_version }}
    steps:
      - name: Check latest .NET stable release
        id: check
        run: |
          # Query the .NET release metadata for the latest stable SDK
          LATEST=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
            | jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-sdk"] | sort_by(. | split(".") | map(tonumber)) | last')

          echo "Latest .NET stable SDK: $LATEST"
          echo "new_version=$LATEST" >> "$GITHUB_OUTPUT"

          # Check if we already have a rebuild tag for this version
          CURRENT_TAG="${LATEST}"
          echo "current_version=$CURRENT_TAG" >> "$GITHUB_OUTPUT"          

  check-flutter:
    name: Check Flutter stable releases
    runs-on: ubuntu-latest
    outputs:
      new_version: ${{ steps.check.outputs.new_version }}
      has_new: ${{ steps.check.outputs.has_new }}
    steps:
      - name: Check latest Flutter stable release
        id: check
        run: |
          LATEST=$(curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json" \
            | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')

          echo "Latest Flutter stable: $LATEST"
          echo "new_version=$LATEST" >> "$GITHUB_OUTPUT"

          # Check if a release with this tag already exists (use -sS, not -f, so 404 doesn't fail)
          EXISTING=$(curl -sS \
            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/v${LATEST}" \
            | jq -r '.tag_name // empty')

          if [ -n "$EXISTING" ]; then
            echo "Release v${LATEST} already exists, skipping"
            echo "has_new=false" >> "$GITHUB_OUTPUT"
          else
            echo "New Flutter stable version found: $LATEST"
            echo "has_new=true" >> "$GITHUB_OUTPUT"
          fi          

  rebuild:
    name: Rebuild and push all variants
    needs: [check-wolfi, check-dotnet, check-flutter]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - config: apko/base.yaml
            variant: base
          - config: apko/build.yaml
            variant: build
          - config: apko/dotnet-runtime.yaml
            variant: dotnet-runtime
          - config: apko/dotnet-sdk.yaml
            variant: dotnet-sdk
          - config: apko/flutter-sdk.yaml
            variant: flutter-sdk
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Install apko
        run: |
          APKO_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
          APKO_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
          curl -fsSL "https://github.com/chainguard-dev/apko/releases/latest/download/apko_${APKO_OS}_${APKO_ARCH}.tar.gz" | tar xz -C /usr/local/bin apko          

      - name: Login to Docker Registry
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Build and push image
        run: |
          apko publish ${{ matrix.config }} \
            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest          

      - name: Install Docker Scout
        run: |
          curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh -o install-scout.sh
          sh install-scout.sh          

      - name: Docker Scout CVE Scan
        run: |
          docker pull ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest
          docker scout cves ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest --only-severity critical,high          

  notify-flutter:
    name: Create release for new Flutter version
    needs: [check-flutter]
    if: needs.check-flutter.outputs.has_new == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Create Gitea release
        run: |
          VERSION="${{ needs.check-flutter.outputs.new_version }}"
          echo "Creating release v${VERSION} for new Flutter stable..."

          curl -fsSL -X POST \
            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
            -H "Content-Type: application/json" \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases" \
            -d "{
              \"tag_name\": \"v${VERSION}\",
              \"name\": \"v${VERSION} - Flutter ${VERSION}\",
              \"body\": \"Automated release triggered by Flutter stable ${VERSION} detection.\n\nUpstream: https://docs.flutter.dev/release/release-notes\",
              \"draft\": false,
              \"prerelease\": false
            }"

          echo "Release v${VERSION} created successfully"