fix: owlbot-cli image sha to be locked (hermetic) (#2252)

* fix: owlbot-cli image sha to be locked (hermetic) * add date to owlbot-cli image file
googleapis · Nov 28, 2023 · 6c4c236 · 6c4c236
1 parent 964a649
commit 6c4c236
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/library_generation/configuration/owlbot-cli-sha b/library_generation/configuration/owlbot-cli-sha
@@ -0,0 +1,2 @@
+# owlbot-cli image from 20231010
+sha256:623647ee79ac605858d09e60c1382a716c125fb776f69301b72de1cd35d49409
diff --git a/library_generation/postprocess_library.sh b/library_generation/postprocess_library.sh
@@ -75,13 +75,15 @@ git init
 git commit --allow-empty -m 'empty commit'
 popd # pre_processed_libs_folder
 
+owlbot_cli_image_sha=$(cat "${scripts_root}/configuration/owlbot-cli-sha" | grep "sha256")
+
 docker run --rm \
   --user $(id -u):$(id -g) \
   -v "${workspace}:/repo" \
   -v "${pre_processed_libs_folder}:/pre-processed-libraries" \
   -w /repo \
   --env HOME=/tmp \
-  gcr.io/cloud-devrel-public-resources/owlbot-cli:latest \
+  gcr.io/cloud-devrel-public-resources/owlbot-cli@"${owlbot_cli_image_sha}" \
   copy-code \
   --source-repo-commit-hash=none \
   --source-repo=/pre-processed-libraries \