check-base-image-updates.yml

# This job template checks for stale images that need to be rebuilt due to base
# image updates. It copies base images to the staging registry, detects which
# images are stale, and queues builds for any images that need to be updated.

parameters:
# The name of the job (e.g., "CheckBaseImages").
- name: jobName
  type: string
# Path to the subscriptions JSON file that defines which base images to monitor.
# Relative to the repo root.
- name: subscriptionsPath
  type: string
# The name of the public Azure DevOps project (e.g., "public").
- name: publicProjectName
  type: string
# The name of the internal Azure DevOps project (e.g., "internal").
- name: internalProjectName
  type: string
# Publishing configuration containing registry and service connection settings.
# Schema is defined in src/ImageBuilder/Configuration/PublishConfiguration.cs.
- name: publishConfig
  type: object
# When true, build ImageBuilder from source instead of pulling from MCR. Used
# during development to validate ImageBuilder and pipeline template changes
# together before a new ImageBuilder image is published.
- name: bootstrapImageBuilder
  type: boolean
  default: false

jobs:
- job: ${{ parameters.jobName }}
  pool:
    name: $(default1ESInternalPoolName)
    image: $(default1ESInternalPoolImage)
    os: linux
  steps:

  - template: /eng/docker-tools/templates/steps/init-common.yml@self
    parameters:
      dockerClientOS: linux
      publishConfig: ${{ parameters.publishConfig }}
      ${{ if eq(parameters.bootstrapImageBuilder, true) }}:
        customInitSteps:
        - template: /eng/pipelines/templates/steps/bootstrap-imagebuilder.yml@self

  - template: /eng/docker-tools/templates/steps/reference-service-connections.yml@self
    parameters:
      publishConfig: ${{ parameters.publishConfig }}
      usesRegistries:
        - ${{ parameters.publishConfig.MirrorRegistry.server }}

  - template: /eng/docker-tools/templates/steps/copy-base-images.yml@self
    parameters:
      acr: ${{ parameters.publishConfig.MirrorRegistry }}
      additionalOptions: "--subscriptions-path '${{ parameters.subscriptionsPath }}'"

  - script: >
      $(runAuthedImageBuilderCmd)
      getStaleImages
      $(dotnetDockerBot.userName)
      $(dotnetDockerBot.email)
      --gh-token $(BotAccount-dotnet-docker-bot-PAT)
      staleImagePaths
      --subscriptions-path ${{ parameters.subscriptionsPath }}
      --os-type '*'
      --architecture '*'
      $(dockerHubRegistryCreds)
    displayName: Get Stale Images
    name: GetStaleImages
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
      SYSTEM_OIDCREQUESTURI: $(System.OidcRequestUri)

  - script: >
      $(runImageBuilderCmd)
      queueBuild
      $(System.AccessToken)
      dnceng
      internal
      --gh-token '$(BotAccount-dotnet-docker-bot-PAT)'
      --git-owner 'dotnet'
      --git-repo '$(internalGitHubRepo)'
      --subscriptions-path ${{ parameters.subscriptionsPath }}
      --image-paths "$(GetStaleImages.staleImagePaths)"
    displayName: Queue Build for Stale Images