Auto-update docker dependency image SHAs

[siggy]

Followup from #115.

The Rust proxy and Go Docker images rely on base dependency images with
hard-coded SHA's:

gcr.io/runconduit/go-deps depends on

• Gopkg.lock
• Dockerfile-go-deps

gcr.io/runconduit/proxy-deps depends on

• Cargo.lock
• proxy/Dockerfile-deps

If any of these files change, we should auto-update all relevant Dockerfile's:

GO_DEPS_SHA=$(sh -c ". bin/_tag.sh && go_deps_sha")
PROXY_DEPS_SHA=$(sh -c ". bin/_tag.sh && proxy_deps_sha")

find . -type f -name 'Dockerfile*' -exec sed -i '' -e 's/gcr\.io\/runconduit\/go-deps:[^ ]*/gcr\.io\/runconduit\/go-deps:'$GO_DEPS_SHA'/g' {} \;
find . -type f -name 'Dockerfile*' -exec sed -i '' -e 's/gcr\.io\/runconduit\/proxy-deps:[^ ]*/gcr\.io\/runconduit\/proxy-deps:'$PROXY_DEPS_SHA'/g' {} \;

[olix0r]

At that point, is there any advantage to using fixed tags in the dockerfiles? We can accomplish the same thing using a symbolic tag and making the scripts ensure the symbolic tag is up-to-date.

[siggy]

Per offline convo, the requirements:

• don't allow ci to auto-update files
• when the SHAs in the Dockerfile's are out of sync with the source tree, consider it a dirty build, and fail ci
• updating the SHAs is the responsibility of the person who made the dependency changes, make it easy and obvious how to update the SHAs