bump Go, add updatecli to do it automatically

.github/workflows/updatecli.yml

@@ -0,0 +1,57 @@
+name: "Updatecli: Dependency Management"
+
+on:
+  schedule:
+    # Runs at 06 PM UTC
+    - cron: '0 18 * * *'
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  updatecli:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - name: Install Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version: 'stable'
+
+      - name: Install Updatecli
+        uses: updatecli/updatecli-action@e71be7554f3f940bc439cf720b3e4e379823c562 # v3.2.0
+
+      - name: Delete leftover UpdateCLI branches
+        run: |
+          gh pr list \
+            --search "is:closed is:pr head:updatecli_" \
+            --json headRefName \
+            --jq ".[].headRefName" | sort -u > closed_prs_branches.txt
+          gh pr list \
+            --search "is:open is:pr head:updatecli_" \
+            --json headRefName \
+            --jq ".[].headRefName" | sort -u > open_prs_branches.txt
+          for branch in $(comm -23 closed_prs_branches.txt open_prs_branches.txt); do
+            if (git ls-remote --exit-code --heads origin "$branch"); then
+              echo "Deleting leftover UpdateCLI branch - $branch";
+              git push origin --delete "$branch";
+            fi
+          done
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Apply Updatecli
+        # Never use '--debug' option, because it might leak the access tokens.
+        run: "updatecli apply --clean --config ./updatecli/updatecli.d/ --values ./updatecli/values.yaml"
+        env:
+          UPDATECLI_GITHUB_ACTOR: ${{ github.actor }}
+          UPDATECLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package/Dockerfile

@@ -1,4 +1,4 @@
-FROM rancher/hardened-build-base:v1.25.11b1 AS builder
+FROM rancher/hardened-build-base:v1.25.5b1 AS builder
 
 ARG TAG=''
 ARG REPO=''

updatecli/updatecli.d/updatebuildbase.yaml

@@ -0,0 +1,83 @@
+---
+name: "Update build base version"
+
+sources:
+  # Read the current version from the Dockerfile
+  current_minor:
+    name: Get current build base minor version from Dockerfile
+    kind: dockerfile
+    spec:
+      file: Dockerfile
+      instruction:
+        keyword: ARG
+        matcher: GO_IMAGE
+    transformers:
+      # Value is "rancher/hardened-build-base:v1.24.9b1"
+      # Trim prefix to get "v1.24.9b1"
+      - trimprefix: "rancher/hardened-build-base:"
+      # Trim 'v' prefix to get "1.24.9b1"
+      - trimprefix: "v"
+      # This regex captures the major.minor to get "1.24"
+      # but it will be a list that will be handled in the next step
+      - findsubmatch:
+          pattern: '^([0-9]+\.[0-9]+)'
+      # Select the last element from the list
+      - kind: lastelement
+
+  # Find the latest release matching that minor version
+  latest_patch:
+    name: Get latest build base patch for that minor
+    kind: githubrelease
+    dependson:
+      - "current_minor"
+    spec:
+      owner: rancher
+      repository: image-build-base
+      token: '{{ requiredEnv .github.token }}'
+      typefilter:
+        release: true
+        draft: false
+        prerelease: false
+      versionfilter:
+        kind: regex
+        # This searches for tags "v1.24.*"
+        # using the "1.24" value from the 'current_minor' source
+        pattern: 'v{{ source "current_minor" }}\.\S+'
+
+targets:
+  dockerfile:
+    name: "Bump to latest build base version in Dockerfile"
+    kind: dockerfile
+    scmid: default
+    sourceid: latest_patch
+    spec:
+      file: Dockerfile
+      instruction:
+        keyword: ARG
+        matcher: "GO_IMAGE"
+    transformers:
+      - addprefix: "rancher/hardened-build-base:"
+
+scms:
+  default:
+    kind: github
+    spec:
+      token: '{{ requiredEnv .github.token }}'
+      username: '{{ requiredEnv .github.username }}'
+      user: '{{ .github.user }}'
+      email: '{{ .github.email }}'
+      owner: '{{ .github.owner }}'
+      repository: '{{ .github.repository }}'
+      branch: '{{ .github.branch }}'
+
+actions:
+    default:
+        title: 'Bump build base version to {{ source "latest_patch" }}'
+        kind: github/pullrequest
+        spec:
+            automerge: false
+            labels:
+                - chore
+                - skip-changelog
+                - status/auto-created
+        scmid: default

updatecli/values.yaml

@@ -0,0 +1,8 @@
+github:
+  user: "github-actions[bot]"
+  email: "41898282+github-actions[bot]@users.noreply.github.com"
+  username: "UPDATECLI_GITHUB_ACTOR"
+  token: "UPDATECLI_GITHUB_TOKEN"
+  repository: "scc-operator"
+  branch: "main"
+  owner: "rancher"