Cron job to check for and update images

[kfox1111]

This patch adds a cron job to check images for updates and propose a PR with updated versions when one is found and a new version is available.

Running it, it already discovers 3 updates at the time of this writing.

It does have an issue with reformatting comments and removing white space. We may want to just go along with the reformatting the first time.

fixes: #221

[kfox1111]

@marcofranssen Its failing shellcheck with:
./.github/scripts/update-tags.sh:38:85: note: Double quote to prevent globbing and word splitting. [SC2086]

But the non double quoted variable substitution is actually critical to its proper functioning.

[kfox1111]

Fixed

[kfox1111]

Ok. This version doesn't touch whitespace and comments. Can see an example of what it produced here:
#290

[kfox1111]

That introduced a biug... fixing.

[kfox1111]

Fixed.

[marcofranssen]

Thinking again on this, isn't it better if the upstream project checks for vulnerabilities in the images? Maybe contribute it there on the images we are using.

In the end it doesn't help us to detect the vulnerability if the upstream doesn't make a release. I think we should just check for new version like dependabot does. Checking for vulnerabilities seems to be something that shouldn't be part of this helm-charts repo, but should be handled in the upstream projects we depend on (hence why I advised to use chainguard images), then we can have a job that checks for new releases.

IMHO we should close this PR as image scanning shouldn't be our responsibility as in the end it doesn't give us value in the sense of having patches for those things we detect, those patches will only arrive if the upstream detects them, hence why I advise to contribute this over there in the upstream projects.

[faisal-memon]

Thinking again on this, isn't it better if the upstream project checks for vulnerabilities in the images? Maybe contribute it there on the images we are using.

In the end it doesn't help us to detect the vulnerability if the upstream doesn't make a release. I think we should just check for new version like dependabot does. Checking for vulnerabilities seems to be something that shouldn't be part of this helm-charts repo, but should be handled in the upstream projects we depend on (hence why I advised to use chainguard images), then we can have a job that checks for new releases.

IMHO we should close this PR as image scanning shouldn't be our responsibility as in the end it doesn't give us value in the sense of having patches for those things we detect.

I agree with the above. In the end if we are just staying up to date on the latest versions then we are just as good. The code to do that should be much simpler. I spent a good chunk of time reviewing but could not wrap my head around the scripts. I wish I had your scripting skills @kfox1111.

With so many other pr's to review i'm not sure how much more time i can spend on this one.

[kfox1111]

Thinking again on this, isn't it better if the upstream project checks for vulnerabilities in the images? Maybe contribute it there on the images we are using.

In the end it doesn't help us to detect the vulnerability if the upstream doesn't make a release. I think we should just check for new version like dependabot does. Checking for vulnerabilities seems to be something that shouldn't be part of this helm-charts repo, but should be handled in the upstream projects we depend on (hence why I advised to use chainguard images), then we can have a job that checks for new releases.

IMHO we should close this PR as image scanning shouldn't be our responsibility as in the end it doesn't give us value in the sense of having patches for those things we detect, those patches will only arrive if the upstream detects them, hence why I advise to contribute this over there in the upstream projects.

Chainguard releases daily. So if we do what you suggest, we will be patching our charts, daily. The container scanner part of the pr does just one thing. Squash patching version when no cve's are fixed so we're not having to cut releases constantly to deal with the fact that chainguard releases daily and we can't easily tell which ones are important to update (actual cve's fixed) vs just a new daily image was built. We could consider not doing the trivy stuff if we stopped using chainguard as they are the only images doing such constant releases.

[kfox1111]

Are we trying to throw the baby out with the bathwater? When I joined up, I think the only one that knew how the .github tests worked was Marco. It was ok. Things were better with the tests then without them.

Perhaps this is in that category. We are only better off with this in place then without it. That not everyone knows all the gory details of how it works in its entirety, is not great, but we're still better off with it IMO.

Based on how complex it became in bash, its probably better to rewrite this in something more well known such as python. I propose though that we can merge this, as is, and when other, more pressing issues are out of the way, we can do that then. I'm afraid we're letting the perfect stand in the way of the good enough here.

[kfox1111]

Ok. With Edwin's help, we got it converted over to read into a bash array. This fixes the shellcheck issue so we don't have to squash it. Thanks Edwin!

[edwbuck]

Worked with Kevin to get all BASH passing shellcheck.

Led to actually documenting the different flags in the input YAML as different flags (previously there were not an array, but a string).

Led to changes to pull each array item into a bash array,

Led to the ability to properly quote that array on expansion.

[edwbuck]

@faisal-memon @marcofranssen @mrsabath Can we get a second review here? This is nearly ready to merge.

[faisal-memon]

@faisal-memon @marcofranssen @mrsabath Can we get a second review here? This is nearly ready to merge.

@edwbuck Any thoughts on the concerns posted earlier and the alternatives presented?

[marcofranssen]

LGTM 🚀