feat(internal/libarian): add update command to update sources in config (#3143)

Introduce `update` command that updates commit and SHA256 for `sources`
to the latest.

User runs `librarian update [--all | source]`, we iterate through all of
the sources in librarian.yaml to get the latest commit and sha and write
back to librarian.yaml.

For #3068

Author: zhumin8

internal/fetch/fetch.go

@@ -30,6 +30,8 @@ import (
 	"time"
 )
 
+const branch = "master"
+
 var (
 	errChecksumMismatch = errors.New("checksum mismatch")
 	defaultBackoff      = 10 * time.Second
@@ -114,6 +116,23 @@ func LatestSha(query string) (string, error) {
 	return string(contents), nil
 }
 
+// LatestCommitAndChecksum fetches the latest commit SHA and the SHA256 of the tarball for that
+// commit from the GitHub API for the given repository.
+func LatestCommitAndChecksum(endpoints *Endpoints, repo *Repo) (commit, sha256 string, err error) {
+	apiURL := fmt.Sprintf("%s/repos/%s/%s/commits/%s", endpoints.API, repo.Org, repo.Repo, branch)
+	commit, err = LatestSha(apiURL)
+	if err != nil {
+		return "", "", err
+	}
+
+	tarballURL := TarballLink(endpoints.Download, repo, commit)
+	sha256, err = Sha256(tarballURL)
+	if err != nil {
+		return "", "", err
+	}
+	return commit, sha256, nil
+}
+
 // TarballLink constructs a GitHub tarball download URL for the given
 // repository and commit SHA.
 func TarballLink(githubDownload string, repo *Repo, sha string) string {

internal/fetch/fetch_test.go

@@ -529,6 +529,58 @@ func TestDownloadTarballErrors(t *testing.T) {
 	}
 }
 
+func TestLatestCommitAndChecksum(t *testing.T) {
+	const (
+		expectedCommit          = "testcommit123"
+		expectedTarballContents = "mock tarball content for checksum"
+		testOrg                 = "testorg"
+		testRepo                = "testrepo"
+	)
+	// Calculate the expected SHA256 for the tarball contents.
+	hasher := sha256.New()
+	hasher.Write([]byte(expectedTarballContents))
+	expectedTarballSHA256 := fmt.Sprintf("%x", hasher.Sum(nil))
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case fmt.Sprintf("/repos/%s/%s/commits/%s", testOrg, testRepo, branch):
+			// Mock response for LatestSha call
+			w.Header().Set("Accept", "application/vnd.github.VERSION.sha")
+			w.WriteHeader(http.StatusOK)
+			w.Write([]byte(expectedCommit))
+		case fmt.Sprintf("/%s/%s/archive/%s.tar.gz", testOrg, testRepo, expectedCommit):
+			// Mock response for Sha256 call (tarball download)
+			w.WriteHeader(http.StatusOK)
+			w.Write([]byte(expectedTarballContents))
+		default:
+			t.Errorf("unexpected request path: %s", r.URL.Path)
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	endpoints := &Endpoints{
+		API:      server.URL,
+		Download: server.URL,
+	}
+	repo := &Repo{
+		Org:  testOrg,
+		Repo: testRepo,
+	}
+
+	gotCommit, gotSha256, err := LatestCommitAndChecksum(endpoints, repo)
+	if err != nil {
+		t.Fatalf("LatestCommitAndChecksum() error = %v, wantErr %v", err, nil)
+	}
+
+	if gotCommit != expectedCommit {
+		t.Errorf("LatestCommitAndChecksum() gotCommit = %q, want %q", gotCommit, expectedCommit)
+	}
+	if gotSha256 != expectedTarballSHA256 {
+		t.Errorf("LatestCommitAndChecksum() gotSha256 = %q, want %q", gotSha256, expectedTarballSHA256)
+	}
+}
+
 func TestDownloadTarballRetry(t *testing.T) {
 	t.Run("succeeds after a few retries", func(t *testing.T) {
 		// Set a short backoff for this test to speed up retries.

internal/librarian/librarian.go

@@ -36,6 +36,7 @@ func Run(ctx context.Context, args ...string) error {
 			generateCommand(),
 			releaseCommand(),
 			tidyCommand(),
+			updateCommand(),
 			versionCommand(),
 		},
 	}

internal/librarian/update.go

@@ -0,0 +1,131 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package librarian
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/googleapis/librarian/internal/config"
+	"github.com/googleapis/librarian/internal/fetch"
+	"github.com/googleapis/librarian/internal/yaml"
+	"github.com/urfave/cli/v3"
+)
+
+var (
+	githubAPI      = "https://api.github.com"
+	githubDownload = "https://github.com"
+	sourceRepos    = map[string]*fetch.Repo{
+		"googleapis": {Org: "googleapis", Repo: "googleapis"},
+		"discovery":  {Org: "googleapis", Repo: "discovery-artifact-manager"},
+	}
+)
+
+// updateCommand returns the `update` subcommand.
+func updateCommand() *cli.Command {
+	return &cli.Command{
+		Name:      "update",
+		Usage:     "update sources to the latest version",
+		UsageText: "librarian update [--all | source]",
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:  "all",
+				Usage: "update all sources",
+			},
+		},
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			all := cmd.Bool("all")
+			source := cmd.Args().First()
+
+			if all && source != "" {
+				return fmt.Errorf("cannot specify a source when --all is set")
+			}
+			if !all && source == "" {
+				return fmt.Errorf("a source must be specified, or use the --all flag")
+			}
+			return runUpdate(all, source)
+		},
+	}
+}
+
+func runUpdate(all bool, sourceName string) error {
+	cfg, err := yaml.Read[config.Config](librarianConfigPath)
+	if err != nil {
+		return err
+	}
+	if cfg.Sources == nil {
+		return errEmptySources
+	}
+
+	endpoints := &fetch.Endpoints{
+		API:      githubAPI,
+		Download: githubDownload,
+	}
+
+	sourcesMap := map[string]*config.Source{
+		"googleapis": cfg.Sources.Googleapis,
+		"discovery":  cfg.Sources.Discovery,
+	}
+
+	var sourceNamesToProcess []string
+	if all {
+		for name := range sourceRepos {
+			sourceNamesToProcess = append(sourceNamesToProcess, name)
+		}
+	} else {
+		lowerSourceName := strings.ToLower(sourceName)
+		if _, ok := sourceRepos[lowerSourceName]; !ok {
+			return fmt.Errorf("unknown source: %s", sourceName)
+		}
+		sourceNamesToProcess = []string{lowerSourceName}
+	}
+
+	for _, name := range sourceNamesToProcess {
+		source := sourcesMap[name]
+		if err := updateSource(endpoints, name, source, cfg); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func updateSource(endpoints *fetch.Endpoints, name string, source *config.Source, cfg *config.Config) error {
+	if source == nil {
+		return nil
+	}
+
+	repo, ok := sourceRepos[name]
+	if !ok {
+		return fmt.Errorf("unknown source: %s", name)
+	}
+
+	oldCommit := source.Commit
+	oldSHA256 := source.SHA256
+
+	commit, sha256, err := fetch.LatestCommitAndChecksum(endpoints, repo)
+	if err != nil {
+		return err
+	}
+
+	if oldCommit != commit || oldSHA256 != sha256 {
+		source.Commit = commit
+		source.SHA256 = sha256
+		if err := yaml.Write(librarianConfigPath, cfg); err != nil {
+			return err
+		}
+	}
+	return nil
+}