Publish updated containers regularly (#33169)

* Update republish_released_docker_containers.yml

* Add to post-release instructions

* Add to core infra

Author: damccorm

.github/workflows/republish_released_docker_containers.yml

@@ -25,12 +25,17 @@ on:
       RELEASE:
         description: Beam version of current release (e.g. 2.XX.0)
         required: true
-        default: '2.XX.0'
+        default: ''
       RC:
         description: Integer RC version for the release (e.g. 3 for RC3)
         required: true
+        default: ''
+  schedule:
+  - cron: "0 6 * * 1"
 env:
   docker_registry: gcr.io
+  release: ${{ github.event.inputs.RELEASE || "2.60.0" }}
+  rc: ${{ github.event.inputs.RC || "2" }}
 
 jobs:
 
@@ -40,7 +45,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
+          ref: "v${{ env.release }}-RC${{ env.rc }}"
           repository: apache/beam
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/[email protected]
@@ -64,5 +69,5 @@ jobs:
         run: |
           gcloud auth configure-docker ${{ env.docker_registry }}
       - name: Push docker images
-        run: ./gradlew :pushAllDockerImages -PisRelease -Pdocker-pull-licenses -Pprune-images -Pdocker-repository-root=gcr.io/apache-beam-testing/updated_released_container_images -Pdocker-tag=${{ github.event.inputs.RELEASE }}rc${{ github.event.inputs.RC }} --no-daemon --no-parallel
+        run: ./gradlew :pushAllDockerImages -PisRelease -Pdocker-pull-licenses -Pprune-images -Pdocker-repository-root=gcr.io/apache-beam-testing/updated_released_container_images -Pdocker-tag=${{ env.release }}rc${{ env.rc }} --no-daemon --no-parallel
 

.test-infra/metrics/sync/github/github_runs_prefetcher/code/config.yaml

@@ -43,6 +43,7 @@ categories:
     - "Cancel Stale Dataflow Jobs" 
     - "pr-bot-pr-updates" 
     - "pr-bot-new-prs" 
+    - "Republish Released Docker Images"
   # Tests we want monitored more closely. Only add suites if you are willing to help keep them green :)
   # Usually will be postcommits since PreCommits are more likely to be noticed.
   - name: important_signals

contributor-docs/release-guide.md

@@ -1309,6 +1309,12 @@ You can also update the versions in https://github.com/apache/beam-starter-pytho
 https://github.com/apache/beam-starter-go if you would like. This is optional because dependabot will automatically
 open a PR to do this if you don't.
 
+### Update the container republishing workflow
+
+After the Beam release is published, update the default versions in https://github.com/apache/beam/blob/master/.github/workflows/republish_released_docker_containers.yml#L37
+to point to the most recent release and its accepted RC version. This script will then regularly
+republish containers using the same underlying source (but updated base images) to allow users to stay ahead of vulnerabilities.
+
 ### Update Beam Playground
 
 After new Beam Release is published, Beam Playground can be updated following the steps below. If any steps fail, make