Merge pull request #21717 from medyagh/deb_automation

ci: fix kic base bump automation

Author: medyagh

.github/workflows/update-debian-version.yml

@@ -21,9 +21,9 @@ jobs:
       - name: Bump Ubuntu version
         id: bumpBaseOsImage
         run: |
-          echo "OLD_VERSION=$(DEP=ubuntu make get-dependency-version)" >> "$GITHUB_OUTPUT"
+          echo "OLD_VERSION=$(DEP=debian make get-dependency-version)" >> "$GITHUB_OUTPUT"
           make update-debian-version
-          echo "NEW_VERSION=$(DEP=ubuntu make get-dependency-version)" >> "$GITHUB_OUTPUT"
+          echo "NEW_VERSION=$(DEP=debian make get-dependency-version)" >> "$GITHUB_OUTPUT"
           # The following is to support multiline with GITHUB_OUTPUT, see https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
           echo "changes<<EOF" >> "$GITHUB_OUTPUT"
           echo "$(git status --porcelain)" >> "$GITHUB_OUTPUT"

hack/update/debian_version/debian_version.go

@@ -18,6 +18,7 @@ package main
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 
 	"k8s.io/klog/v2"
@@ -40,13 +41,35 @@ type Data struct {
 	LatestVersion string
 }
 
+// bookwormDateTag matches Debian bookworm slim tags that include an 8-digit
+// date stamp (for example, bookworm-20250929-slim).
+var bookwormDateTag = regexp.MustCompile(`^bookworm-\d{8}-slim$`)
+
+// latestBookwormSlimTag returns the newest bookworm slim tag that includes a
+// date suffix. The updater now requires a dated tag to be present so that the
+// resulting image digest remains stable and predictable between runs.
 func latestBookwormSlimTag(tags []string) (string, error) {
+	var newestDateTag string
 	for _, tag := range tags {
-		if strings.Contains(tag, "bookworm-slim") {
-			return tag, nil
+		// Skip anything that isn't a bookworm slim tag to avoid matching other
+		// Debian variants.
+		if !strings.HasPrefix(tag, "bookworm-") || !strings.HasSuffix(tag, "-slim") {
+			continue
+		}
+
+		// Track the lexicographically greatest dated tag, which corresponds to
+		// the most recent date stamp provided by Debian.
+		if bookwormDateTag.MatchString(tag) {
+			if newestDateTag == "" || tag > newestDateTag {
+				newestDateTag = tag
+			}
 		}
 	}
-	return "", fmt.Errorf("no tag found that matches: bookworm-slim")
+
+	if newestDateTag != "" {
+		return newestDateTag, nil
+	}
+	return "", fmt.Errorf("no dated tag found that matches: %s", bookwormDateTag.String())
 }
 
 func main() {

hack/update/get_version/get_version.go

@@ -75,7 +75,7 @@ var dependencies = map[string]dependency{
 	"nvidia-device-plugin":    {addonsFile, `nvidia/k8s-device-plugin:(.*)@`},
 	"registry":                {addonsFile, `registry:(.*)@`},
 	"runc":                    {"deploy/iso/minikube-iso/package/runc-master/runc-master.mk", `RUNC_MASTER_VERSION = (.*)`},
-	"ubuntu":                  {dockerfile, `ubuntu:jammy-(.*)"`},
+	"debian":                  {dockerfile, `debian:bookworm-(.*)-slim`},
 	"volcano":                 {addonsFile, `volcanosh/vc-webhook-manager:(.*)@`},
 	"yakd":                    {addonsFile, `marcnuri/yakd:(.*)@`},
 }