add a workflow to update base image shas

Signed-off-by: Tuomas Katila <tuomas.katila@intel.com>

Author: tkatila

.github/workflows/demo-img-update.yaml

@@ -0,0 +1,39 @@
+name: Update demo bases
+on:
+  schedule:
+    - cron: '0 0 1 * *' # once a month
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  demo_base_update:
+    name: Create a PR for demo image updates
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
+      - name: Install frizbee
+        run: |
+          mkdir bin && wget -q https://github.com/stacklok/frizbee/releases/download/v0.0.15/frizbee_0.0.15_linux_amd64.tar.gz -O - | tar xz -C bin
+          chmod +x bin/frizbee
+      - name: Run update script
+        run: |
+          export PATH=$PATH:$(pwd)/bin
+
+          git config user.name "Tuomas Katila"
+          git config user.email "tuomas.katila@intel.com"
+
+          export DATE=$(date +'%m-%Y')
+          export TITLE="Demo base update $DATE"
+          export BRANCH="demo-base-update-$DATE"
+
+          export MAINHEAD=$(git rev-parse --short HEAD)
+          git checkout -b $BRANCH
+
+          cd demo
+          bash update-shas.sh
+          git diff --exit-code || git add -u && git commit -s -m "demo: base image update $DATE" && git diff main...$BRANCH && gh pr create --fill --base=main --head=$BRANCH
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PR_TOKEN }}

demo/update-shas.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+type frizbee > /dev/null 2>&1 || {
+    echo "no 'frizbee' installed, please install it from https://github.com/stacklok/frizbee"
+    exit 1
+}
+
+echo "frizbee available, continue"
+
+files=$(grep -sr "^FROM" * | cut -d":" -f1 | sort | uniq)
+
+for file in $files; do
+    echo "checking $file"
+
+    base=$(grep "^FROM" $file | head -1 | cut -d' ' -f2)
+    baseimg=$(echo $base | cut -d'@' -f1)
+    prevhash=$(echo $base | cut -d'@' -f2 | cut -d' ' -f1)
+
+    hash=$(frizbee containerimage one $baseimg | cut -d'@' -f2)
+    [ $? -ne 0 ] && exit 1
+
+    [ "x$verbose" != "x" ] && echo $prevhash ?= $hash
+
+    if [ $prevhash != $hash ]; then
+        echo "> updating hash in $file: $hash"
+
+        sed -i s/$prevhash/$hash/ $file
+    fi
+done