| name | prow-image-bump-keep-variant |
| description | Bump container image tags in Prow job YAMLs under prow-jobs/ while keeping the tag variant suffix (e.g. -dind, -alpine). Use when asked to update or refresh Prow job images, or to bump container/initContainer tags to a newer version without changing variants. |
Prow Image Bump (Keep Variant)
Quick workflow
- Identify the target image repo and the new base version (without variant).
- Update
spec.containers[].image and spec.initContainers[].image in prow-jobs/**.
- Keep the existing tag variant suffix (text after the first
-) while bumping the version.
- Validate with a quick
rg search and review the changed YAML.
Preferred automation (shell only)
Use the bundled script to update only container and initContainer images under prow-jobs/.
It auto-discovers newer tags using crane or oras and preserves the tag variant suffix.
skills/prow-image-bump-keep-variant/scripts/bump_prow_job_images.sh \
--image docker \
--tool crane \
--dry-run --verbose
skills/prow-image-bump-keep-variant/scripts/bump_prow_job_images.sh \
--image docker \
--tool crane
Behavior:
- Keeps tag variants by preserving everything after the
-g<commit-sha> segment when present.
- Example:
ghcr.io/pingcap-qe/ci/base:v2026.1.18-8-gbb5ada9-go1.25 -> ...:v2026.2.1-<new>-go1.25
- For tags without
-g<commit-sha>, preserves everything after the first - (legacy behavior).
- Example:
docker:28.1-dind -> docker:28.2-dind
- If the old tag has no
- variant, only the version changes.
- Only updates
image: lines that are under containers: or initContainers: blocks.
- Skips digest-pinned images (e.g.
image@sha256:...).
- Resolves "newer" by sorting tags with
sort -V (semver-ish).
Manual fallback
If you need to update only a subset or the script is too broad:
- Find candidates:
rg --glob 'prow-jobs/**/*.yaml' -n "image:" prow-jobs
- Edit only the
image: lines under containers: or initContainers:.
- Keep the existing tag variant suffix.
Notes and edge cases
- Variant definition: everything after the
-g<commit-sha> segment when present; otherwise everything after the first -.
- If the image includes a registry with a port (e.g.
registry:5000/repo:tag), the script still matches the repo name before the tag.
- For multi-image updates, run the script once per image repo/version.
- Requirements:
yq plus either crane or oras.
