Workflow to update UBI Image

.github/workflows/ubi-version-update.yaml

@@ -0,0 +1,96 @@
+# Copyright (c) 2025 Dell Inc., or its subsidiaries. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+
+# Reusable workflow to update UBI9 micro image to latest
+name: UBI Image update
+
+on:
+  workflow_call:
+
+jobs:
+  update-sha:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Install dependencies
+      id: check-skopeo
+      run: |
+        if ! command -v skopeo &> /dev/null; then
+          echo "Skopeo not found, installing..."
+          sudo apt-get update
+          sudo apt-get install -y skopeo
+        else
+          echo "Skopeo is already installed"
+        fi
+
+        if ! command -v jq&> /dev/null; then
+          echo "jq not found, installing..."
+          sudo apt-get update
+          sudo apt-get install -y jq
+        else
+          echo "jq is already installed"
+        fi
+
+
+    - name: Fetch latest UBI9 micro image SHA
+      id: fetch-sha
+      run: |
+        latest_sha=$(skopeo inspect docker://registry.access.redhat.com/ubi9/ubi-micro:latest | jq -r '.Digest')
+        echo "latest_sha=$latest_sha" >> $GITHUB_ENV
+
+        # Get the tag and store it in the GitHub environment
+        tag=$(skopeo inspect docker://registry.access.redhat.com/ubi9/ubi:latest | jq -r '.Labels.version')
+        echo "tag=$tag" >> $GITHUB_ENV
+
+        # Get the release and store it in the GitHub environment
+        release=$(skopeo inspect docker://registry.access.redhat.com/ubi9/ubi:latest | jq -r '.Labels.release')
+        echo "release=$release" >> $GITHUB_ENV
+
+    - name: Compare and update SHA in csm-common.mk
+      id: update-sha
+      run: |
+        current_sha=$(grep 'UBI_BASEIMAGE=' csm/config/csm-common.mk | cut -d'@' -f2)
+        latest_sha=${{ env.latest_sha }}
+
+        if [ "$current_sha" != "$latest_sha" ]; then
+          echo "SHA mismatch, updating..."
+          sed -i "s|UBI_BASEIMAGE=.*|UBI_BASEIMAGE=registry.access.redhat.com/ubi9/ubi-micro@$latest_sha|" csm/config/csm-common.mk
+          echo "sha_mismatch=true" >> $GITHUB_ENV
+        else
+          echo "SHA is up-to-date"
+          echo "sha_mismatch=false" >> $GITHUB_ENV
+
+        fi
+
+ # Needed for signing commits using Github App tokens
+    # See: https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#commit-signing
+    - uses: actions/create-github-app-token@v2.0.2
+      if: env.sha_mismatch == 'true'
+      id: generate-token
+      with:
+        app-id: ${{ vars.CSM_RELEASE_APP_ID }}
+        private-key: ${{ secrets.CSM_RELEASE_APP_PRIVATE_KEY }}
+
+    - name: Create Pull Request
+      if: env.sha_mismatch == 'true'
+      uses: peter-evans/create-pull-request@v7
+      with:
+        token: ${{ steps.generate-token.outputs.token }}
+        branch: "update-ubi-image-to-latest"
+        commit-message: "Update UBI Image to latest "
+        title: "Update UBI Image to latest"
+        body: |
+          This PR updates the UBI Image to ${{ env.tag }}-${{ env.release }}.
+          Auto-generated by [common-github-actions](https://github.com/dell/common-github-actions)
+        sign-commits: true
+        delete-branch: true
+
+

README.md

@@ -40,6 +40,7 @@ This repository contains a set of reusable actions and workflows, designed to be
   - [Update Dell Libraries to Latest Commits](#update-libraries-to-commits)
   - [Update Dell Libraries](#update-libraries)
   - [Dockerfile Modifications](#image-version-workflow)
+  - [UBI Image Update](#ubi-image-update)
   - [Dell Libraries Specific Workflows](#dell-libraries-specific-workflows)
     - [Release Dell Libraries](#csm-release-libs)
   - [CSM Operator Specific Workflows](#csm-operator-specific-workflows)
@@ -288,6 +289,25 @@ jobs:
     secrets: inherit
 
 ```
+### ubi-image-update
+
+This workflow updates UBI9 micro image SHAID to the latest. The workflow is triggered by a cron job that runs on every Monday at mid-day. It also can be triggered manually from https://github.com/dell/csm/actions/workflows/ubi-image-update.yaml.
+
+The workflow does not accept any parameters and can be used from any repository by creating a workflow that resembles the following
+
+```yaml
+name: UBI Image Update
+
+on:
+  workflow_dispatch:
+
+jobs:
+  ubi-version-update:
+    uses: dell/common-github-actions/.github/workflows/ubi-version-update.yaml@main
+    name: UBI Version Update
+    secrets: inherit
+```
+
 ## Dell Libraries Specific Workflows
 ### csm-release-libs