Pin all docker image versions (#2881) Remaining unpinned images were in the trusted org and the RBE presubmit config.
diff --git a/buildkite/update_docker_image_hashes.py b/buildkite/update_docker_image_hashes.py index d8f0503..ab9be6d 100755 --- a/buildkite/update_docker_image_hashes.py +++ b/buildkite/update_docker_image_hashes.py
@@ -14,7 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. """ -Updates hard-coded Docker image hashes in bazelci.py and Terraform configs. +Updates hard-coded Docker image hashes in bazelci.py, Terraform configs, and RBE presets. """ import concurrent.futures @@ -163,12 +163,11 @@ f.writelines(output_lines) -def update_terraform_configs(terraform_dir, image_hashes): - tf_files = list(terraform_dir.glob("**/*.tf")) + list(terraform_dir.glob("**/*.tpl")) - pattern = re.compile(r"gcr\.io/bazel-public/([a-zA-Z0-9_\-]+)(?:@sha256:[a-f0-9]+)?") +def update_pinned_hashes(files, image_hashes): + pattern = re.compile(r"gcr\.io/bazel-public/([a-zA-Z0-9_\-]+)@sha256:[a-f0-9]+") updated_files = [] - for fpath in sorted(tf_files): + for fpath in sorted(files): with open(fpath, "r", encoding="utf-8") as f: content = f.read() @@ -188,15 +187,33 @@ return updated_files +def update_terraform_configs(terraform_dir, image_hashes): + tf_files = list(terraform_dir.glob("**/*.tf")) + list(terraform_dir.glob("**/*.tpl")) + return update_pinned_hashes(tf_files, image_hashes) + + +def update_rbe_presets(rbe_file, image_hashes): + return update_pinned_hashes([rbe_file], image_hashes) + + def main(): repo_root = Path(__file__).resolve().parent.parent bazelci_path = repo_root / "buildkite" / "bazelci.py" - terraform_dir = repo_root / "buildkite" / "terraform" / "bazel" + terraform_dir = repo_root / "buildkite" / "terraform" + rbe_presets_file = repo_root / "rules" / "rbe_presets.json" if not bazelci_path.exists(): print(f"Error: {bazelci_path} not found.", file=sys.stderr) sys.exit(1) + if not terraform_dir.exists(): + print(f"Error: {terraform_dir} not found.", file=sys.stderr) + sys.exit(1) + + if not rbe_presets_file.exists(): + print(f"Error: {rbe_presets_file} not found.", file=sys.stderr) + sys.exit(1) + print("Fetching latest image manifests...") digests = fetch_all_image_digests(IMAGE_KEYS) @@ -205,11 +222,14 @@ update_bazelci_file(bazelci_path, new_dict_str) print(f"Successfully updated IMAGE_HASHES in {bazelci_path}!") - if terraform_dir.exists(): - updated_tf = update_terraform_configs(terraform_dir, digests) - print(f"Successfully updated {len(updated_tf)} terraform configuration files:") - for tf_path in updated_tf: - print(f" - {tf_path}") + updated_tf = update_terraform_configs(terraform_dir, digests) + print(f"Successfully updated {len(updated_tf)} terraform configuration files:") + for tf_path in updated_tf: + print(f" - {tf_path}") + + updated_rbe = update_rbe_presets(rbe_presets_file, digests) + if updated_rbe: + print(f"Successfully updated RBE presets in {rbe_presets_file}!") if __name__ == "__main__":
diff --git a/pipelines/bazel-custom-release.yml b/pipelines/bazel-custom-release.yml index c9a5a9d..e499033 100644 --- a/pipelines/bazel-custom-release.yml +++ b/pipelines/bazel-custom-release.yml
@@ -10,7 +10,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/bazel-release.yml b/pipelines/bazel-release.yml index a2c7908..cb1859c 100644 --- a/pipelines/bazel-release.yml +++ b/pipelines/bazel-release.yml
@@ -9,7 +9,7 @@ always-pull: true environment: - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true @@ -439,7 +439,7 @@ always-pull: true environment: - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/bazelisk-binaries.yml b/pipelines/bazelisk-binaries.yml index e965007..402d0c8 100644 --- a/pipelines/bazelisk-binaries.yml +++ b/pipelines/bazelisk-binaries.yml
@@ -16,7 +16,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/bcr-integrity.yml b/pipelines/bcr-integrity.yml index cb8afcc..cc0e6ab 100644 --- a/pipelines/bcr-integrity.yml +++ b/pipelines/bcr-integrity.yml
@@ -19,7 +19,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/build-embedded-minimized-jdk.yml b/pipelines/build-embedded-minimized-jdk.yml index 4fca03b..3bbd1f6 100644 --- a/pipelines/build-embedded-minimized-jdk.yml +++ b/pipelines/build-embedded-minimized-jdk.yml
@@ -15,7 +15,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/continuous-integration.yml b/pipelines/continuous-integration.yml index 5522d5a..fad17db 100644 --- a/pipelines/continuous-integration.yml +++ b/pipelines/continuous-integration.yml
@@ -10,7 +10,7 @@ - "ANDROID_HOME" - "ANDROID_NDK_HOME" - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION" - image: "gcr.io/bazel-public/ubuntu2404" + image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c" network: "host" privileged: true propagate-environment: true
diff --git a/pipelines/java_tools-rc.yml b/pipelines/java_tools-rc.yml index 79f7d1f..7f9efb9 100644 --- a/pipelines/java_tools-rc.yml +++ b/pipelines/java_tools-rc.yml
@@ -35,7 +35,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/java_tools-release.yml b/pipelines/java_tools-release.yml index 7302b49..0e1a41f 100644 --- a/pipelines/java_tools-release.yml +++ b/pipelines/java_tools-release.yml
@@ -23,7 +23,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/publish-bazel-binaries.yml b/pipelines/publish-bazel-binaries.yml index 6513f2c..bef43b6 100644 --- a/pipelines/publish-bazel-binaries.yml +++ b/pipelines/publish-bazel-binaries.yml
@@ -12,7 +12,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/publish-vm-image.yml b/pipelines/publish-vm-image.yml index 1971b98..622e0e7 100644 --- a/pipelines/publish-vm-image.yml +++ b/pipelines/publish-vm-image.yml
@@ -14,7 +14,7 @@ - "ANDROID_HOME" - "ANDROID_NDK_HOME" - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION" - image: "gcr.io/bazel-public/ubuntu2204" + image: "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538" network: "host" privileged: true propagate-environment: true @@ -45,7 +45,7 @@ - "ANDROID_HOME" - "ANDROID_NDK_HOME" - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION" - image: "gcr.io/bazel-public/ubuntu2204" + image: "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538" network: "host" privileged: true propagate-environment: true @@ -80,7 +80,7 @@ - "ANDROID_HOME" - "ANDROID_NDK_HOME" - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION" - image: "gcr.io/bazel-public/ubuntu2204" + image: "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538" network: "host" privileged: true propagate-environment: true @@ -111,7 +111,7 @@ - "ANDROID_HOME" - "ANDROID_NDK_HOME" - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION" - image: "gcr.io/bazel-public/ubuntu2204" + image: "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538" network: "host" privileged: true propagate-environment: true
diff --git a/pipelines/rules_java-release.yml b/pipelines/rules_java-release.yml index f4b2011..76d2145 100644 --- a/pipelines/rules_java-release.yml +++ b/pipelines/rules_java-release.yml
@@ -10,7 +10,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/pipelines/rules_platform-release.yml b/pipelines/rules_platform-release.yml index 3005e00..158be55 100644 --- a/pipelines/rules_platform-release.yml +++ b/pipelines/rules_platform-release.yml
@@ -10,7 +10,7 @@ - ANDROID_HOME - ANDROID_NDK_HOME - BUILDKITE_ARTIFACT_UPLOAD_DESTINATION - image: gcr.io/bazel-public/ubuntu2404 + image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c network: host privileged: true propagate-environment: true
diff --git a/rules/rbe_presets.json b/rules/rbe_presets.json index bf7198e..0f30372 100644 --- a/rules/rbe_presets.json +++ b/rules/rbe_presets.json
@@ -1,6 +1,6 @@ { "ubuntu2204": { - "container": "gcr.io/bazel-public/ubuntu2204:latest", + "container": "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538", "cpp_env": { "ABI_LIBC_VERSION": "glibc_2.19", "ABI_VERSION": "gcc", @@ -14,7 +14,7 @@ } }, "ubuntu2404": { - "container": "gcr.io/bazel-public/ubuntu2404:latest", + "container": "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c", "cpp_env": { "ABI_LIBC_VERSION": "glibc_2.39", "ABI_VERSION": "gcc", @@ -28,7 +28,7 @@ } }, "ubuntu": { - "container": "gcr.io/bazel-public/ubuntu2404:latest", + "container": "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c", "cpp_env": { "ABI_LIBC_VERSION": "glibc_2.39", "ABI_VERSION": "gcc",