ci(shared): bump vendored ci files

.github/dependabot.yml

@@ -12,7 +12,3 @@ updates:
   directory: "/" # Location of package manifests
   schedule:
     interval: "daily"
-- package-ecosystem: "cargo"
-  directory: "/"
-  schedule:
-    interval: "daily"

.github/workflows/audit.yml

@@ -0,0 +1,22 @@
+#! Auto synced from Shared CI Resources repository
+#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
+
+name: Audit
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  audit:
+    name: Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+          cache: "yarn"
+      - run: yarn install --frozen-lockfile
+      - name: Run audit
+        run: make audit

.github/workflows/check-code.yml

@@ -0,0 +1,22 @@
+#! Auto synced from Shared CI Resources repository
+#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
+
+name: Check Code
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  check-code:
+    name: Check Code
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+          cache: "yarn"
+      - run: yarn install --frozen-lockfile
+      - name: Run check code
+        run: make check-code

ci/vendir.lock.yml

@@ -2,14 +2,14 @@ apiVersion: vendir.k14s.io/v1alpha1
 directories:
 - contents:
   - git:
-      commitTitle: 'feat: allow public or private repo selection (#34)'
-      sha: 53fc9dd805d3574d200e8e6e99f856c0912b52a8
+      commitTitle: 'fix: allow versioned img uploading to private repo (#41)'
+      sha: 0f5b967c838dbb9496da86453c0eece933a556a9
     path: .
   path: ../.github/workflows/vendor
 - contents:
   - git:
-      commitTitle: 'feat: allow public or private repo selection (#34)'
-      sha: 53fc9dd805d3574d200e8e6e99f856c0912b52a8
+      commitTitle: 'fix: allow versioned img uploading to private repo (#41)'
+      sha: 0f5b967c838dbb9496da86453c0eece933a556a9
     path: .
   path: ./vendor
 kind: LockConfig

ci/vendir.yml

@@ -8,7 +8,7 @@ directories:
   - path: . # Copy this folder out to ..
     git:
       url: https://github.com/GaloyMoney/concourse-shared.git
-      ref: 53fc9dd805d3574d200e8e6e99f856c0912b52a8
+      ref: 0f5b967c838dbb9496da86453c0eece933a556a9
     includePaths:
     - shared/actions/*
     excludePaths:
@@ -20,7 +20,7 @@ directories:
   - path: .
     git:
       url: https://github.com/GaloyMoney/concourse-shared.git
-      ref: 53fc9dd805d3574d200e8e6e99f856c0912b52a8
+      ref: 0f5b967c838dbb9496da86453c0eece933a556a9
     includePaths:
     - shared/ci/**/*
     excludePaths:

ci/vendor/pipeline-fragments.lib.yml

@@ -370,6 +370,7 @@ plan:
       platform: linux
       image_resource: #@ nodejs_task_image_config()
       inputs:
+        - name: repo
         - name: pipeline-tasks
         - name: edge-image
         - name: charts-repo
@@ -400,7 +401,7 @@ webhook_token: ((webhook.secret))
 name: pipeline-tasks
 type: git
 source:
-  paths: [ci/vendor/*, ci/tasks/*, ci/config/*, ci/apps/tasks/*, Makefile]
+  paths: [ci/vendor/*, ci/tasks/*, ci/config/*, Makefile]
   uri: #@ data.values.git_uri
   branch: #@ data.values.git_branch
   private_key: #@ data.values.github_private_key
@@ -413,14 +414,14 @@ source:
   tag: edge
   username: #@ data.values.docker_registry_user
   password: #@ data.values.docker_registry_password
-  repository: #@ public_docker_registry() if publicRepo else private_docker_registry() + "/" + data.values.gh_repository
+  repository: #@ public_docker_registry() + "/" + data.values.gh_repository if publicRepo else private_docker_registry() + "/" + data.values.gh_repository
 #@ end
 
 #@ def nodejs_deps_resource(webhook = False):
 name: deps
 type: git
 source:
-  paths: [core/api/yarn.lock]
+  paths: [yarn.lock]
   uri: #@ data.values.git_uri
   branch: #@ data.values.git_branch
   private_key: #@ data.values.github_private_key
@@ -477,13 +478,13 @@ source:
   private_key: #@ data.values.github_private_key
 #@ end
 
-#@ def versioned_image_resource():
+#@ def versioned_image_resource(publicRepo = True):
 name: versioned-image
 type: registry-image
 source:
   username: #@ data.values.docker_registry_user
   password: #@ data.values.docker_registry_password
-  repository: #@ public_docker_registry() + "/" + data.values.gh_repository
+  repository: #@ public_docker_registry() + "/" + data.values.gh_repository if publicRepo else private_docker_registry() + "/" + data.values.gh_repository
 #@ end
 
 #@ def gh_release_resource():

ci/vendor/tasks/chart-open-charts-pr.sh

@@ -6,12 +6,15 @@
 set -eu
 
 export digest=$(cat ./edge-image/digest)
+export ref=$(cat ./repo/.git/short_ref)
 
 pushd charts-repo
 
-ref=$(yq e '.image.git_ref' charts/${CHARTS_SUBDIR}/values.yaml)
 git checkout ${BRANCH}
-old_ref=$(yq e '.image.git_ref' charts/${CHARTS_SUBDIR}/values.yaml)
+
+old_digest=$(yq e '.image.digest' "./charts/${CHARTS_SUBDIR}/values.yaml")
+old_ref=$(grep "digest: \"${old_digest}\"" "./charts/${CHARTS_SUBDIR}/values.yaml" \
+  | sed -n 's/.*commit_ref=\([^;]*\);.*/\1/p' | tr -d ' \n')
 
 cat <<EOF >> ../body.md
 # Bump ${CHARTS_SUBDIR} image

ci/vendor/tasks/docker-bump-image-digest.sh

@@ -12,7 +12,9 @@ export app_version=$(cat version/version)
 pushd charts-repo
 
 yq -i e '.image.digest = strenv(digest)' ./charts/${CHARTS_SUBDIR}/values.yaml
-yq -i e '.image.git_ref = strenv(ref)' ./charts/${CHARTS_SUBDIR}/values.yaml
+
+sed -i "s|\(digest: \"${digest}\"\).*$|\1 # METADATA:: repository=https://github.com/GaloyMoney/${CHARTS_SUBDIR};commit_ref=${ref};app=${CHARTS_SUBDIR};|g" "./charts/${CHARTS_SUBDIR}/values.yaml"
+
 yq -i e '.appVersion = strenv(app_version)' ./charts/${CHARTS_SUBDIR}/Chart.yaml
 
 if [[ -z $(git config --global user.email) ]]; then