cron-dependency-update.yml

name: (Cron) Dependency Update

on:
  schedule:
    - cron: 0 5 * * 1
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  pull-requests: write
  issues: read

jobs:
  check:
    name: Check for new versions
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Install Task
        uses: arduino/setup-task@v2.0.0
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Check for new versions
        env:
          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
          TERM: xterm-256color
        run: task dependency:update

      - name: Run linters
        run: task lint

      - name: Commit and push changes (conditional)
        if: env.VERSION_TAG != ''
        uses: devops-infra/action-commit-push@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          target_branch: dependency/${{ env.VERSION_BRANCH }}
          commit_message: ⬆️ Bump for ${{ env.VERSION_TAG }}

      - name: Get template
        run: task git:get-pr-template

      - name: Create pull request
        if: env.VERSION_TAG != ''
        uses: devops-infra/action-pull-request@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          title: ⬆️ Bump for ${{ env.VERSION_TAG }}
          template: .tmp/PULL_REQUEST_TEMPLATE.md
          get_diff: true

  build-and-push:
    name: Build and push
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    needs: [check]
    env:
      VERSION_PREFIX: test-
    strategy:
      fail-fast: false
      matrix:
        flavor: [slim, plain, aws-azure-gcp]
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Install Task
        uses: arduino/setup-task@v2.0.0
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Install QEMU
        uses: docker/setup-qemu-action@v4
        with:
          image: tonistiigi/binfmt:latest
          platforms: amd64,arm64

      - name: Build and push
        env:
          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
          DOCKER_BUILDKIT: 1
          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TERM: xterm-256color
        run: |
          VERSION="$(task version:get)"
          TF_VERSION=$(printf "%s" "$VERSION" | sed -E \
            's/^tf-([0-9]+\.[0-9]+\.[0-9]+)-ot-[0-9]+\.[0-9]+\.[0-9]+-tg-[0-9]+\.[0-9]+\.[0-9]+$/\1/')
          OT_VERSION=$(printf "%s" "$VERSION" | sed -E \
            's/^tf-[0-9]+\.[0-9]+\.[0-9]+-ot-([0-9]+\.[0-9]+\.[0-9]+)-tg-[0-9]+\.[0-9]+\.[0-9]+$/\1/')
          TG_VERSION=$(printf "%s" "$VERSION" | sed -E \
            's/^tf-[0-9]+\.[0-9]+\.[0-9]+-ot-[0-9]+\.[0-9]+\.[0-9]+-tg-([0-9]+\.[0-9]+\.[0-9]+)$/\1/')
          TFLINT_VERSION=$(sed -nE 's/^ARG TFLINT_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
          HCLEDIT_VERSION=$(sed -nE 's/^ARG HCLEDIT_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
          SOPS_VERSION=$(sed -nE 's/^ARG SOPS_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
          AWS_VERSION=$(sed -nE 's/^ARG AWS_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
          GCP_VERSION=$(sed -nE 's/^ARG GCP_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
          AZ_VERSION=$(sed -nE 's/^ARG AZ_VERSION=([0-9.]+)$/\1/p' Dockerfile | head -1)
          {
            echo "TF_VERSION=${TF_VERSION}"
            echo "OT_VERSION=${OT_VERSION}"
            echo "TG_VERSION=${TG_VERSION}"
            echo "TFLINT_VERSION=${TFLINT_VERSION}"
            echo "HCLEDIT_VERSION=${HCLEDIT_VERSION}"
            echo "SOPS_VERSION=${SOPS_VERSION}"
            echo "AWS_VERSION=${AWS_VERSION}"
            echo "GCP_VERSION=${GCP_VERSION}"
            echo "AZ_VERSION=${AZ_VERSION}"
          } >> "$GITHUB_ENV"
          docker buildx create --use || true
          task login
          task push-${{ matrix.flavor }}
          GHCR_IMAGE="ghcr.io/devops-infra/docker-terragrunt"
          DOCKER_IMAGE="devopsinfra/docker-terragrunt"
          docker pull "${GHCR_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}"
          docker pull "${GHCR_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}"
          docker pull "${DOCKER_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${TF_VERSION}-tg-${TG_VERSION}"
          docker pull "${DOCKER_IMAGE}:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${OT_VERSION}-tg-${TG_VERSION}"

      - name: Cont.Struc.Test - ${{ matrix.flavor }} (TF image)
        uses: plexsystems/container-structure-test-action@v0.3.0
        with:
          image: >-
            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}
          config: tests/${{ matrix.flavor }}.yml

      - name: Cont.Struc.Test - ${{ matrix.flavor }} (OT image)
        uses: plexsystems/container-structure-test-action@v0.3.0
        with:
          image: >-
            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}
          config: tests/${{ matrix.flavor }}.yml

      - name: Cont.Struc.Test - Terraform
        uses: plexsystems/container-structure-test-action@v0.3.0
        with:
          image: >-
            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-tf-${{ env.TF_VERSION }}-tg-${{ env.TG_VERSION }}
          config: tests/tf.yml

      - name: Cont.Struc.Test - OpenTofu
        uses: plexsystems/container-structure-test-action@v0.3.0
        with:
          image: >-
            devopsinfra/docker-terragrunt:${{ env.VERSION_PREFIX }}${{ matrix.flavor }}-ot-${{ env.OT_VERSION }}-tg-${{ env.TG_VERSION }}
          config: tests/ot.yml