Add script to update the git-sync image

Makefile

@@ -89,6 +89,8 @@ HELM_STAGING_DIR := $(OUTPUT_DIR)/third_party/helm
 COSIGN_VERSION := v2.4.1
 COSIGN := $(BIN_DIR)/cosign
 
+# To automatically update, run this command:
+# UPDATE_TYPE=<latest-version|latest-build> make update-git-sync-image
 GIT_SYNC_VERSION := v4.4.2-gke.16__linux_amd64
 GIT_SYNC_IMAGE_NAME := gcr.io/config-management-release/git-sync:$(GIT_SYNC_VERSION)
 
@@ -541,6 +543,10 @@ print-%:
 update-debian-base-image:
 	@./scripts/update-debian-base-image.sh
 
+.PHONY: update-git-sync-image
+update-git-sync-image:
+	@./scripts/update-git-sync-image.sh
+
 ####################################################################################################
 # MANUAL TESTING COMMANDS
 

scripts/update-debian-base-image.sh

@@ -16,20 +16,6 @@
 
 set -euo pipefail
 
-####################################################################################################
-# FUNCTION DECLARATIONS
-#
-# It's crucial that error messages in these functions be sent to stderr with 1>&2.
-# Otherwise, they will not bubble up to the make target that calls this script.
-
-err() {
-  local msg="$1"
-  echo "${msg}" 1>&2
-  exit 1
-}
-
-####################################################################################################
-
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
 cd "${REPO_ROOT}"
 

scripts/update-git-sync-image.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# 
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+cd "${REPO_ROOT}"
+
+UPDATE_TYPE=${UPDATE_TYPE:-latest-build}
+
+set +e
+# Get the current tag from the Makefile
+CURRENT_TAG=$(grep "^GIT_SYNC_VERSION :=" Makefile | sed 's/.*:= //')
+if [ -z "${CURRENT_TAG}" ]; then
+  echo "Failed to find GIT_SYNC_VERSION" >&2
+  exit 1
+fi
+set -e
+
+if [[ "${UPDATE_TYPE}" == "latest-version" ]]; then
+  FILTER="NOT tags:no-new-use-public-image*"
+  GREP_PATTERN="__linux_amd64"
+elif [[ "${UPDATE_TYPE}" == "latest-build" ]]; then
+  # Strip the -gke.N__linux_amd64 suffix to get the base version
+  BASE_VERSION=${CURRENT_TAG%-gke.*__linux_amd64}
+  FILTER="tags:${BASE_VERSION}*"
+  GREP_PATTERN="^${BASE_VERSION}"
+else
+  echo "Usage: $0 [latest-version|latest-build]" >&2
+  exit 1
+fi
+
+echo "Fetching ${UPDATE_TYPE//-/ } tag for git-sync"
+LATEST_TAG=$(gcloud container images list-tags gcr.io/config-management-release/git-sync \
+  --filter="${FILTER}" \
+  --format="value(tags)" | tr ',' '\n' | grep "${GREP_PATTERN}" | sort -V | tail -n 1)
+
+if [ -z "${LATEST_TAG}" ]; then
+  echo "Failed to find latest tag for git-sync" >&2
+  exit 1
+fi
+
+if [ "$LATEST_TAG" == "$CURRENT_TAG" ]; then
+  echo "GIT_SYNC_VERSION is already up to date ($LATEST_TAG)."
+  exit 0
+fi
+
+echo "Updating GIT_SYNC_VERSION from $CURRENT_TAG to $LATEST_TAG"
+sed -i "s|^GIT_SYNC_VERSION := .*|GIT_SYNC_VERSION := ${LATEST_TAG}|" Makefile