Add reproducible make targets for catalog and certified charts

- Add install-image-packer / install-chart-packer targets that fetch
  pinned binaries into bin/$(OS)_$(ARCH)
- Add update-chart-dependencies, update-certified-charts, update-catalog
  and verify-catalog targets; wire verify-catalog into verify
- Switch CI workflows to the new make targets for installing image-packer
  and updating chart dependencies

Signed-off-by: Tamal Saha <tamal@appscode.com>

Author: tamalsaha

.github/workflows/ci.yml

@@ -35,7 +35,6 @@ jobs:
           # install kubectl
           curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.31.0/bin/linux/amd64/kubectl
           chmod +x ./kubectl
-          sudo mv ./kubectl /usr/local/bin/kubectl
 
       - name: Run checks
         run: |

.github/workflows/cve-report.yml

@@ -37,11 +37,8 @@ jobs:
 
     - name: Install image packer
       run: |
-        cd /tmp
-        curl -fsSL -O https://github.com/kmodules/image-packer/releases/latest/download/image-packer-linux-amd64.tar.gz
-        tar -xvf image-packer-linux-amd64.tar.gz
-        chmod +x image-packer-linux-amd64
-        sudo mv image-packer-linux-amd64 /usr/local/bin/image-packer
+        make install-image-packer
+        echo "$(pwd)/bin/linux_amd64" >> "$GITHUB_PATH"
 
     - name: Generate report
       run: |

.github/workflows/publish-oci.yml

@@ -59,5 +59,5 @@ jobs:
           CHART_REPOSITORY: ${{ secrets.CHART_REPOSITORY }}
         run: |
           export REGISTRY_0=oci://ghcr.io/appscode-charts
-          ./hack/scripts/update-chart-dependencies.sh
+          make update-chart-dependencies
           $RUNNER_WORKSPACE/$(basename $CHART_REPOSITORY)/hack/scripts/publish-oci-charts.sh $(pwd)

.github/workflows/release.yml

@@ -53,7 +53,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.LGTM_GITHUB_TOKEN }}
           CHART_REPOSITORY: ${{ secrets.CHART_REPOSITORY }}
         run: |
-          ./hack/scripts/update-chart-dependencies.sh
+          make update-chart-dependencies
           cd $RUNNER_WORKSPACE/$(basename $CHART_REPOSITORY)
           GIT_TAG=${GITHUB_REF#"refs/tags/"}
           if [[ $GIT_TAG =~ "-alpha." ]] || [[ $GIT_TAG =~ "-beta." ]]; then

Makefile

@@ -227,6 +227,50 @@ manifests: gen-crds gen-schema patch-schema gen-chart-doc
 .PHONY: gen
 gen: codegen manifests
 
+BIN_DIR ?= $(CURDIR)/bin/$(OS)_$(ARCH)
+
+.PHONY: install-image-packer
+install-image-packer:
+	@mkdir -p $(BIN_DIR)
+	curl -fsSL -o $(BIN_DIR)/image-packer.tar.gz https://github.com/kmodules/image-packer/releases/latest/download/image-packer-$(OS)-$(ARCH).tar.gz
+	tar -xzf $(BIN_DIR)/image-packer.tar.gz -C $(BIN_DIR)
+	chmod +x $(BIN_DIR)/image-packer-$(OS)-$(ARCH)
+	mv $(BIN_DIR)/image-packer-$(OS)-$(ARCH) $(BIN_DIR)/image-packer
+	rm -f $(BIN_DIR)/image-packer.tar.gz
+
+.PHONY: install-chart-packer
+install-chart-packer:
+	@mkdir -p $(BIN_DIR)
+	curl -fsSL -o $(BIN_DIR)/chart-packer.tar.gz https://github.com/kmodules/chart-packer/releases/latest/download/chart-packer-$(OS)-$(ARCH).tar.gz
+	tar -xzf $(BIN_DIR)/chart-packer.tar.gz -C $(BIN_DIR)
+	chmod +x $(BIN_DIR)/chart-packer-$(OS)-$(ARCH)
+	mv $(BIN_DIR)/chart-packer-$(OS)-$(ARCH) $(BIN_DIR)/chart-packer
+	rm -f $(BIN_DIR)/chart-packer.tar.gz
+
+.PHONY: update-chart-dependencies
+update-chart-dependencies:
+	./hack/scripts/update-chart-dependencies.sh
+
+.PHONY: update-certified-charts
+update-certified-charts: update-chart-dependencies install-chart-packer
+	rm -rf charts/ace-installer-certified charts/ace-installer-certified-crds
+	PATH="$(BIN_DIR):$$PATH" chart-packer crd-less --input charts/ace-installer --output charts
+	PATH="$(BIN_DIR):$$PATH" chart-packer crd-only --input charts/ace-installer --output charts
+	@$(MAKE) gen-chart-doc --no-print-directory
+	helm dependency update charts/ace-installer-certified
+	@# Revert Chart.lock if the only change is the `generated:` timestamp line
+	@if ! git diff --quiet -- charts/ace-installer-certified/Chart.lock; then \
+		changed=$$(git diff -U0 -- charts/ace-installer-certified/Chart.lock | grep -E '^[+-]' | grep -vE '^(\+\+\+|---)' | grep -vE '^[+-]generated:'); \
+		if [ -z "$$changed" ]; then \
+			echo "Reverting charts/ace-installer-certified/Chart.lock (only generated: timestamp changed)"; \
+			git checkout -- charts/ace-installer-certified/Chart.lock; \
+		fi; \
+	fi
+
+.PHONY: update-catalog
+update-catalog: update-certified-charts install-image-packer
+	PATH="$(BIN_DIR):$$PATH" ./hack/scripts/update-catalog.sh
+
 CHART_REGISTRY     ?= appscode
 CHART_REGISTRY_URL ?= https://charts.appscode.com/stable/
 CHART_VERSION      ?=
@@ -398,7 +442,7 @@ $(BUILD_DIRS):
 dev: gen fmt
 
 .PHONY: verify
-verify: verify-gen verify-modules
+verify: verify-gen verify-modules verify-catalog
 
 .PHONY: verify-modules
 verify-modules:
@@ -414,6 +458,12 @@ verify-gen: gen fmt
 		echo "generated files are out of date, run make gen"; exit 1; \
 	fi
 
+.PHONY: verify-catalog
+verify-catalog: update-catalog
+	@if !(git diff --exit-code HEAD); then \
+		echo "catalog image lists are out of date, run ./hack/scripts/update-catalog.sh"; exit 1; \
+	fi
+
 .PHONY: add-license
 add-license:
 	@echo "Adding license header"