Organize local infrastructure and Vault secrets by service ownership

infra/local/scripts/images.sh

@@ -0,0 +1,24 @@
+# Resolve maintained stable aliases to exact numeric tags and digests.
+get() { curl -fsS --connect-timeout 10 --max-time 60 "$1"; }
+image() (
+ repo=$1; alias=$2
+ digest=$(get "https://hub.docker.com/v2/repositories/$repo/tags/$alias" | jq -er '.digest | select(test("^sha256:[a-f0-9]{64}$"))') || exit 1
+ tag=$(get "https://hub.docker.com/v2/repositories/$repo/tags?page_size=100" | jq -er --arg digest "$digest" '
+ [.results[] | select(.digest==$digest) | .name | select(test("^[0-9]+\\.[0-9]+(\\.[0-9]+)?(-alpine)?$"))]
+ | sort_by(split("-")[0] | split(".") | map(tonumber)) | last // error("No stable numeric tag matches digest")') || exit 1
+ printf '%s:%s@%s\n' "$repo" "$tag" "$digest"
+)
+images() (
+ go=$(get 'https://go.dev/dl/?mode=json' | jq -er '.[0] | select(.stable) | .version | select(test("^go[0-9]+\\.[0-9]+\\.[0-9]+$"))') || exit 1
+ for spec in VAULT_IMAGE:hashicorp/vault:latest MONGO_IMAGE:library/mongo:latest NATS_IMAGE:library/nats:latest CADDY_IMAGE:library/caddy:alpine "GO_IMAGE:library/golang:${go#go}-alpine" UBUNTU_IMAGE:library/ubuntu:latest; do
+  key=${spec%%:*}; rest=${spec#*:}; repo=${rest%:*}; alias=${rest##*:}
+  ref=$(image "$repo" "$alias") || exit 1
+  printf '%s=%s\n' "$key" "$ref" >> "$WORK/images.env"
+ done
+ commit=$(get https://api.github.com/repos/flutter/flutter/commits/stable | jq -er '.sha | select(test("^[a-f0-9]{40}$"))') || exit 1
+ git ls-remote --tags https://github.com/flutter/flutter.git > "$WORK/flutter-tags" || exit 1
+ tag=$(jq -Rrs --arg commit "$commit" '[split("\n")[] | split("\t") | select(.[0]==$commit) | .[1] | sub("^refs/tags/";"") | select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))] | sort_by(split(".")|map(tonumber)) | last // error("Flutter stable has no stable release tag")' "$WORK/flutter-tags") || exit 1
+ printf 'FLUTTER_VERSION=%s\nFLUTTER_COMMIT=%s\n' "$tag" "$commit" >> "$WORK/images.env"
+ cat "$WORK/images.env" | write "$STATE/images.env"
+ cat "$STATE/images.env"
+)