Add sempahore auto go-build workflow

.semaphore/update-go-build-pins.yml

@@ -0,0 +1,25 @@
+version: v1.0
+name: Trigger calico/go-build update
+agent:
+  machine:
+    type: f1-standard-2
+    os_image: ubuntu2204
+
+execution_time_limit:
+  minutes: 30
+
+global_job_config:
+  prologue:
+    commands:
+      - checkout
+
+blocks:
+  - name: Auto calico/go-build update
+    task:
+      secrets:
+        - name: marvin-github-token
+      jobs:
+        - name: Auto calico/go-build update
+          commands:
+            - CONFIRM=true make git-config
+            - CONFIRM=true GITHUB_TOKEN=${MARVIN_GITHUB_TOKEN} make trigger-auto-pin-update-process

Makefile

@@ -190,6 +190,8 @@ endif
 		python:3 \
 		bash -c '/usr/local/bin/python release/get-contributors.py >> /code/AUTHORS.md'
 
+update-pins: update-go-build-pin
+
 ###############################################################################
 # Post-release validation
 ###############################################################################

lib.Makefile

@@ -338,6 +338,31 @@ define update_replace_pin
 		fi'
 endef
 
+# Get the latest release tag from projectcalico/go-build.
+GO_BUILD_REPO=https://github.com/projectcalico/go-build.git
+define get_go_build_version
+	$(shell git ls-remote --tags $(GO_BUILD_REPO) | sort -r | head -n 1 | awk -F '/' '{print $$NF}')
+endef
+
+# update_go_build updates the GO_BUILD_VER in metadata.mk or Makefile.
+# for annotated git tags, we need to remove the trailing `^{}`.
+# for the obsoleted vx.y go-build version, we need to remove the leading `v` for bash string comparison to work properly.
+define update_go_build_pin
+	$(eval new_ver := $(subst ^{},,$(call get_go_build_version)))
+	$(eval old_ver := $(subst v,,$(shell grep -E "^GO_BUILD_VER" $(1) | cut -d'=' -f2 | xargs)))
+
+	@echo "current GO_BUILD_VER=$(old_ver)"
+	@echo "latest GO_BUILD_VER=$(new_ver)"
+
+	bash -c '\
+		if [[ "$(new_ver)" > "$(old_ver)" ]]; then \
+			sed -i "s/^GO_BUILD_VER[[:space:]]*=.*/GO_BUILD_VER=$(new_ver)/" $(1); \
+			echo "GO_BUILD_VER is updated to $(new_ver)"; \
+		else \
+			echo "no need to update GO_BUILD_VER"; \
+		fi'
+endef
+
 GIT_REMOTE?=origin
 API_BRANCH?=$(PIN_BRANCH)
 API_REPO?=github.com/projectcalico/calico/api
@@ -394,6 +419,9 @@ update-cni-plugin-pin:
 replace-cni-pin:
 	$(call update_replace_pin,github.com/projectcalico/calico/cni-plugin,$(CNI_REPO),$(CNI_BRANCH))
 
+update-go-build-pin:
+	$(call update_go_build_pin,$(GIT_GO_BUILD_UPDATE_COMMIT_FILE))
+
 git-status:
 	git status --porcelain
 
@@ -455,6 +483,7 @@ PIN_UPDATE_BRANCH?=semaphore-auto-pin-updates-$(GIT_PR_BRANCH_BASE)
 GIT_PR_BRANCH_HEAD?=$(PIN_UPDATE_BRANCH)
 GIT_REPO_SLUG?=$(SEMAPHORE_GIT_REPO_SLUG)
 GIT_PIN_UPDATE_COMMIT_FILES?=go.mod go.sum
+GIT_GO_BUILD_UPDATE_COMMIT_FILE?=metadata.mk
 GIT_PIN_UPDATE_COMMIT_EXTRA_FILES?=$(GIT_COMMIT_EXTRA_FILES)
 GIT_COMMIT_FILES?=$(GIT_PIN_UPDATE_COMMIT_FILES) $(GIT_PIN_UPDATE_COMMIT_EXTRA_FILES)