Automatically update base image hash digests in a Dockerfile

update-base-images.sh

#!/usr/bin/env bash

dockerfile=${1:-Dockerfile}

if [[ ! -f ${dockerfile} ]]; then
    echo "${dockerfile} was not found" >&2
    exit 1
fi

while IFS="@" read image existing_hash; do
    echo -n "Pulling..."
    docker pull --quiet ${image}
    current_hash=$(docker inspect ${image} --format "{{ index (.RepoDigests) 0 }}" | awk -F@ '{ print $NF; }')

    if [[ ${existing_hash} == ${current_hash} ]]; then
        printf "Base image \033[32m%s\033[0m is current\n" ${image}
    else
        sed -i -e "s/${existing_hash}/${current_hash}/g" ${dockerfile}
        printf "Base image \033[31m%s\033[0m has been updated to hash \033[33m%s\033[0m\n" ${image} ${current_hash}
    fi
done < <(grep -Pio "(?<=^FROM ).+@.+?(?=(?: AS|$))" ${dockerfile})