Finding out the latest published version of a package?

[kastl-ars]

Dear all,

I am using WolfiOS to build some container images, which is really nice using apko.

One thing I did not solve properly: How do I find out the latest published version of a package during building the image with e.g. the apko GitHub action?

Can I just look at the main branch and check the version inside the package's definition, e.g.

package:
  name: apko
  version: "0.25.3"

for apko ?

Or is there some delay between merging things to main and the build being finished and the package published?

There is a Github Action to find the latest release of a repository, which is what I am currently using as a workaround. But just because apko releases a new version does not mean the WolfiOS package of apko is available in that version...

Maybe someone has ideas on how to solve this.

Thanks in advance!

Kind Regards,
Johannes

[cflee]

Or is there some delay between merging things to main and the build being finished and the package published?

I guess there must be some delay, the builds can't complete instantly. But I don't think we can check this as the package builds don't seem to be done in GitHub Actions.

Perhaps parsing the APKINDEX is a 'safe' or reliable way to know what's actually reached the repository and is latest?

[xnox]

@kastl-ars @cflee there is a webservice and also command line tools for this.

See https://apk.dag.dev/ for access to apk.cgr.dev/chainguard and also packages.wolfi.dev/os and other repos.

Or you can use json or text output from wolfictl tool (apk add wolfictl, or build it from github)

$ wolfictl apk ls --help
Usage:
  wolfictl apk ls [flags]

Examples:
wolfictl apk ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz

Flags:
      --full                  print the full url or path
  -h, --help                  help for ls
      --json                  print each package as json
      --latest                print only the latest version of each package
      --newer-than duration   print only packages newer than this duration ago
  -P, --package string        print only packages with the given name

Global Flags:
      --log-level string   log level (e.g. debug, info, warn, error) (default "WARN")

Note the --latest and --json flags.

[kastl-ars]

Oh nice. I'll try that.

Do you know whether this is already available as a GitHub action?

[xnox]

@kastl-ars

can you please explain what would you want from a github action?

To simply install wolfictl, it is available as this action https://github.com/wolfi-dev/actions/blob/main/install-wolfictl/action.yaml

[kastl-ars]

See my initial question:

One thing I did not solve properly: How do I find out the latest published version of a package during building the image with e.g. the apko GitHub action?

When building an image using a package from WolfiOS, it would be nice to tag it with the actual package version.

So an action that just checks for a package's version in WolfiOS would come in handy.

I'll see if I can create it manually with the installation action you linked to.

[xnox]

@kastl-ars internally i have access the full images catalogue, so simplest answer is buy images.chainguard.dev ;-) which has all builds of all images, of all version streams, tagged by full and partial version numbers (i.e. 20, 20.0, 20.0.15, 20.0.15-r3) such that all tags are available to track major/minor/point/epoch releases.