Documentation
¶
Overview ¶
Command imagebump proposes pin bumps for internal/compose/images.yaml.
Purpose: ADR 0030 §4 / cap:cli.image-pin-bump. Pins move only through a reviewed weekly PR. For every non-plugin entry of the authored image list, imagebump picks the newest registry tag the policy allows (.github/image-bump-policy.yaml: regex + track patch|minor|manual), rewrites that entry's `version`, then runs `go run ./tools/imagelock -resolve` so the generated lock follows. Plugin entries are skipped: their pins move with plugin releases.
imagebump [--dry-run] [--policy <file>] [--lock <images.yaml>]
Inputs: the policy, the authored list (--lock, images.yaml format), tags from `scripts/images/mirror-images.sh --list-tags <repository>` (a digest-pinned crane container; no Go registry client). A --lock file with a top-level `fixture_tags: {<repository>: [tags]}` map takes tags from there instead; that is only allowed with --dry-run. Outputs: stdout, one line per proposed bump sorted by name:
BUMP <name> <old> -> <new>
Diagnostics go to stderr. Without --dry-run the changed `version` values are rewritten in place (every other byte kept) and imagelock -resolve always runs, even with zero bumps, so floating tags refresh their digests. Exit: 0 ok; 1 failed (policy gap, version outside its regex, registry read, rewrite, resolve); 2 usage or refused input. Constraints: run from the cli repository root.
Source Files