Add workflow to auto-bump aws-for-fluent-bit chart

.github/workflows/update-aws-for-fluent-bit.yaml

@@ -0,0 +1,47 @@
+name: Update aws-for-fluent-bit chart
+
+on:
+  workflow_dispatch: {}
+  schedule:
+    - cron: "0 17 * * 1" # Every Monday at 09:00 PST
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-chart:
+    if: github.repository == 'aws/eks-charts'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # refs/tags/v4.1.7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run ./hack/update-aws-for-fluent-bit.sh
+        id: update
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+              YQ_VERSION=v4.52.4
+              YQ_PLATFORM=linux_amd64
+              wget https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_${YQ_PLATFORM} -O /usr/local/bin/yq &&\
+                chmod +x /usr/local/bin/yq
+
+              ./hack/update-aws-for-fluent-bit.sh
+
+      - name: Create Pull Request
+        if: steps.update.outputs.version != ''
+        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # refs/tags/v7.0.9
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "aws-for-fluent-bit: bump to AWS for Fluent Bit ${{ steps.update.outputs.version }}"
+          title: "aws-for-fluent-bit: bump to AWS for Fluent Bit ${{ steps.update.outputs.version }}"
+          body: |
+            This PR updates the aws-for-fluent-bit chart to the latest release of [aws/aws-for-fluent-bit](https://github.com/aws/aws-for-fluent-bit/releases/tag/v${{ steps.update.outputs.version }}) by running `./hack/update-aws-for-fluent-bit.sh`.
+
+            ## Testing
+            Please verify that the chart version is correctly bumped and the image tag exists in `public.ecr.aws/aws-observability/aws-for-fluent-bit`.
+          branch: automated/update-aws-for-fluent-bit
+          base: master
+          delete-branch: true

hack/update-aws-for-fluent-bit.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# This script requires yq >= v4 and the GitHub CLI (gh).
+# Bumps stable/aws-for-fluent-bit to the latest release of aws/aws-for-fluent-bit.
+# A major image bump increments the chart minor version (as in #1294); anything else increments the chart patch.
+
+PROJECT_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+CHART_DIRECTORY="${PROJECT_ROOT}/stable/aws-for-fluent-bit"
+CHART_FILE="${CHART_DIRECTORY}/Chart.yaml"
+VALUES_FILE="${CHART_DIRECTORY}/values.yaml"
+
+# Releases are listed by date; sort -V picks the highest version even when an older line gets a backport.
+LATEST=$(gh release list --repo aws/aws-for-fluent-bit --exclude-drafts --exclude-pre-releases --limit 50 --json tagName \
+  --jq '.[].tagName | ltrimstr("v")' | sort -V | tail -n 1)
+CURRENT=$(yq eval '.appVersion' "$CHART_FILE")
+
+if [[ -z "$LATEST" ]]; then
+  echo "Could not determine latest release" >&2
+  exit 1
+fi
+
+if [[ "$LATEST" == "$(printf '%s\n%s\n' "$CURRENT" "$LATEST" | sort -V | head -n 1)" ]]; then
+  echo "aws-for-fluent-bit already at ${CURRENT} (latest ${LATEST})"
+  exit 0
+fi
+
+echo "Updating aws-for-fluent-bit ${CURRENT} -> ${LATEST}"
+yq eval -i ".appVersion = \"${LATEST}\"" "$CHART_FILE"
+# sed instead of yq: yq -i rewrites block scalars and comment indentation in values.yaml
+sed "s/^  tag: ${CURRENT}\$/  tag: ${LATEST}/" "$VALUES_FILE" > "${VALUES_FILE}.tmp" && mv "${VALUES_FILE}.tmp" "$VALUES_FILE"
+
+VERSION=$(yq eval '.version' "$CHART_FILE")
+IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
+if [[ "${CURRENT%%.*}" != "${LATEST%%.*}" ]]; then
+  NEW_VERSION="${MAJOR}.$((MINOR + 1)).0"
+else
+  NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
+fi
+yq eval -i ".version = \"${NEW_VERSION}\"" "$CHART_FILE"
+
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  echo "version=${LATEST}" >> "$GITHUB_OUTPUT"
+fi