build(librarian): add GCB configs for update-image (#2802)

Towards #2800

Author: chingor13

infra/prod/generate-worker.yaml

@@ -23,6 +23,5 @@ steps:
       - '--push=$_PUSH'
       - '--build=$_BUILD'
 tags: ['generate-dispatcher']
-availableSecrets:
 options:
   logging: CLOUD_LOGGING_ONLY

infra/prod/stage-release-worker.yaml

@@ -23,6 +23,5 @@ steps:
       - '--push=$_PUSH'
       - '--force-run=$_FORCE_RUN'
 tags: ['stage-release-dispatcher']
-availableSecrets:
 options:
   logging: CLOUD_LOGGING_ONLY

infra/prod/update-image-worker.yaml

@@ -0,0 +1,27 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# This triggers the `update-image` workflow for all repositories registered
+# to automate the `librarian update-image` command 
+steps:
+  - name: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/librarian-dispatcher
+    id: update-image-dispatcher
+    args:
+      - '--project=$PROJECT_ID'
+      - '--command=update-image'
+      - '--push=$_PUSH'
+      - '--build=$_BUILD'
+tags: ['update-image-dispatcher']
+options:
+  logging: CLOUD_LOGGING_ONLY

infra/prod/update-image.yaml

@@ -0,0 +1,72 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# This runs the `librarian update-image` command with a provided repository,
+# secret name, and optional library ID
+steps:
+  - name: gcr.io/cloud-builders/git
+    id: clone-language-repo
+    waitFor: ['-']
+    args:
+      - 'clone'
+      - '--depth=1'
+      - '--branch=$_BRANCH'
+      - $_FULL_REPOSITORY
+  - name: gcr.io/cloud-builders/git
+    id: configure-language-repo-name
+    waitFor: ['clone-language-repo']
+    dir: /workspace/$_REPOSITORY
+    args:
+      - 'config'
+      - 'user.name'
+      - 'Cloud SDK Librarian'
+  - name: gcr.io/cloud-builders/git
+    id: configure-language-repo-email
+    waitFor: ['configure-language-repo-name']
+    dir: /workspace/$_REPOSITORY
+    args:
+      - 'config'
+      - 'user.email'
+      - '[email protected]'
+  - name: gcr.io/cloud-builders/git
+    id: clone-googleapis
+    waitFor: ['-']
+    args:
+      - 'clone'
+      - '--single-branch'
+      - '--branch=master'
+      - https://github.com/googleapis/googleapis
+  - name: 'us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/librarian@sha256:5a001095dcee6b6fdaf3f826a4a339853786b55b21f571daefdfffa995e01272'
+    id: update-image
+    waitFor: ['configure-language-repo-email', 'clone-googleapis']
+    dir: tmp
+    args:
+      - 'update-image'
+      - '-repo'
+      - '/workspace/$_REPOSITORY'
+      - '-api-source'
+      - '/workspace/googleapis'
+      - '-branch=$_BRANCH'
+      - '-commit=true'
+      - '-push=$_PUSH'
+      - '-build=$_BUILD'
+    secretEnv: ['LIBRARIAN_GITHUB_TOKEN']
+tags: ['update-image-$_REPOSITORY']
+availableSecrets:
+  secretManager:
+    - versionName: projects/$PROJECT_ID/secrets/$_GITHUB_TOKEN_SECRET_NAME/versions/latest
+      env: 'LIBRARIAN_GITHUB_TOKEN'
+options:
+  logging: CLOUD_LOGGING_ONLY
+timeout: 10h

internal/automation/repositories.go

@@ -30,6 +30,7 @@ var availableCommands = map[string]bool{
 	"generate":        true,
 	"stage-release":   true,
 	"publish-release": true,
+	"update-image":    true,
 }
 
 // RepositoryConfig represents a single registered librarian GitHub repository.

internal/automation/trigger.go

@@ -35,6 +35,7 @@ var triggerNameByCommandName = map[string]string{
 	"generate":        "generate",
 	"stage-release":   "stage-release",
 	"publish-release": "publish-release",
+	"update-image":    "update-image",
 }
 
 const region = "global"
@@ -134,8 +135,7 @@ func runCommandWithConfig(ctx context.Context, client CloudBuildClient, ghClient
 			} else {
 				substitutions["_PR"] = fmt.Sprintf("%v", prs[0].GetHTMLURL())
 			}
-		} else if command == "generate" {
-			// only pass _BUILD to generate trigger
+		} else if command == "generate" || command == "update-image" {
 			substitutions["_BUILD"] = fmt.Sprintf("%v", build)
 		}
 		err = runCloudBuildTriggerByName(ctx, client, projectId, region, triggerName, substitutions)