Backfill old tags

Author: joecorall

.github/workflows/build.yml

@@ -15,6 +15,11 @@ on:
       contexts:
         required: false
         type: string
+      strip-apk-pinning:
+        description: "Remove apk OS package pins from dockerfiles"
+        required: false
+        type: boolean
+        default: false
     outputs:
       digest:
         description: "Digest argument for Gradle"
@@ -39,6 +44,11 @@ jobs:
       - name: Checkout
         uses: "actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8" # v6
 
+      # allow running this job on old tags
+      - name: Strip APK pinning
+        if: ${{ inputs.strip-apk-pinning || false }}
+        run: ./ci/strip-apk-pinning.sh "$(echo "${{ inputs.tags }}" | awk '{print $1}')"
+
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

.github/workflows/push.yml

@@ -9,6 +9,11 @@ on:
       tag:
         type: string
         required: true
+      strip-apk-pinning:
+        description: "Remove apk OS package pins from dockerfiles"
+        required: false
+        type: boolean
+        default: false
 concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: true
@@ -37,6 +42,7 @@ jobs:
       image: base
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -49,6 +55,7 @@ jobs:
       image: activemq
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -61,6 +68,7 @@ jobs:
       image: alpaca
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -73,6 +81,7 @@ jobs:
       image: blazegraph
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -85,6 +94,7 @@ jobs:
       image: cantaloupe
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -97,6 +107,7 @@ jobs:
       image: crayfish
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -109,6 +120,7 @@ jobs:
       image: crayfits
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -121,6 +133,7 @@ jobs:
       image: drupal
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -133,6 +146,7 @@ jobs:
       image: fcrepo6
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -145,6 +159,7 @@ jobs:
       image: fits
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -157,6 +172,7 @@ jobs:
       image: handle
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -169,6 +185,7 @@ jobs:
       image: homarus
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -181,6 +198,7 @@ jobs:
       image: houdini
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -193,6 +211,7 @@ jobs:
       image: hypercube
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -205,6 +224,7 @@ jobs:
       image: imagemagick
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -217,6 +237,7 @@ jobs:
       image: java
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -229,6 +250,7 @@ jobs:
       image: leptonica
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -241,6 +263,7 @@ jobs:
       image: mariadb
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -253,6 +276,7 @@ jobs:
       image: mergepdf
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -265,6 +289,7 @@ jobs:
       image: milliner
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -277,6 +302,7 @@ jobs:
       image: nginx
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -289,6 +315,7 @@ jobs:
       image: postgresql
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -301,6 +328,7 @@ jobs:
       image: riprap
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -313,6 +341,7 @@ jobs:
       image: scyllaridae
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -325,6 +354,7 @@ jobs:
       image: solr
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -337,6 +367,7 @@ jobs:
       image: test
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -349,6 +380,7 @@ jobs:
       image: tomcat
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -361,6 +393,7 @@ jobs:
       image: transkribus
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read
@@ -373,6 +406,7 @@ jobs:
       image: transcriber
       repository: ${{ vars.repository }}
       tags: ${{ needs.tags.outputs.tags }}
+      strip-apk-pinning: ${{ inputs.strip-apk-pinning || false }}
     secrets: inherit
     permissions:
       contents: read

ci/strip-apk-pinning.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Remove apk OS package pinning from all dockerfiles
+# This allows rebuilding old tags with the latest
+# OS packages available in the base image's package manager.
+#
+# Usage: ./ci/build-with-os-versions.sh <tag>
+#   tag    - The git tag to build from (must exist)
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly SCRIPT_DIR
+ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+readonly ROOT_DIR
+
+usage() {
+    echo "Usage: $0 <tag>"
+    echo ""
+    echo "Arguments:"
+    echo "  tag     - The git tag to build from (must exist)"
+    echo ""
+    echo "Examples:"
+    echo "  $0 1.0.0        # Build all images locally with tag 1.0.0"
+    exit 1
+}
+if [[ $# -lt 1 ]]; then
+    usage
+fi
+
+TAG="${1}"
+
+# Verify the git tag exists before proceeding
+git fetch origin tag "${TAG}"
+git checkout "${TAG}"
+
+# Determine images directory (old tags use root, newer tags use ./images)
+if [[ -d "${ROOT_DIR}/images" ]]; then
+    IMAGES_DIR="${ROOT_DIR}/images"
+else
+    IMAGES_DIR="${ROOT_DIR}"
+fi
+
+# Remove OS package version pinning from Dockerfiles
+echo "==> Removing OS package version pinning from Dockerfiles..."
+for dockerfile in "${IMAGES_DIR}"/*/Dockerfile; do
+    if [[ ! -f "${dockerfile}" ]]; then
+        continue
+    fi
+    sed -i.bak 's/==[^ ]*//g' "${dockerfile}"
+    rm "${dockerfile}.bak"
+done