Make Heroku-18 builds fail with a skippable EOL warning

[edmorley]

The Heroku-18 stack reached end-of-life on April 30th 2023, and as of May 1st 2023, builds are no longer possible on the (default) non-CNB Heroku build system, and the underlying stack images will no longer receive security updates (beyond whatever updates Canonical choose to release in May).

However, anyone using the heroku/buildpacks:18 CNB builder image may not realise that it's now EOL and soon to be insecure. They may also not realise that the builder image has moved from the heroku/buildpacks Docker repo to heroku/builder.

In order to raise awareness of both of these, an EOL buildpack has been added, which fails the build with an EOL warning, unless the env var ALLOW_INSECURE_HEROKU_18_BUILDER is set to 1 during the build.

This should affect very few users, since Heroku is not yet using CNBs by default, and Salesforce Functions use the newer heroku/builder:22 builder image instead.

This buildpack was written in bash (rather than in Rust, using libcnb.rs), since:

• the buildpack functionality we need is extremely simple (checking an env var, printing a message and exiting 1 or 0)
• the buildpack (and other Heroku-18 related files) are going to be deleted in a few weeks anyway, so its not worth spending time getting a Rust build workflow working with the existing complex GitHub Actions workflow here

GUS-W-13143190.

[edmorley]

Example EOL error when building with heroku/buildpacks:18 and the opt-out env var is not set:

===> BUILDING

Error: This builder image (heroku/buildpacks:18) is based upon the Heroku-18
stack, which has been end-of-life since April 30th, 2023:
https://devcenter.heroku.com/changelog-items/2583

The underlying Ubuntu 18.04 OS is no longer receiving security updates,
and so apps still using it could contain security vulnerabilities.

Please switch to one of our newer 'heroku/builder:*' builder images:
https://github.com/heroku/builder#heroku-builder-images

If you are using the Pack CLI, you will need to adjust the '--builder' CLI
argument, or else change the default builder configuration:
https://buildpacks.io/docs/tools/pack/cli/pack_config_default-builder/


To ignore this error, set the env var ALLOW_INSECURE_HEROKU_18_BUILDER to 1.

ERROR: failed to build: exit status 1

(From: https://github.com/heroku/builder/actions/runs/4927514536/jobs/8804652403?pr=336#step:9:22)

Example successful build with the EOL warning, when ALLOW_INSECURE_HEROKU_18_BUILDER=1:

Warning: This builder image (heroku/buildpacks:18) is based upon the Heroku-18
stack, which has been end-of-life since April 30th, 2023:
https://devcenter.heroku.com/changelog-items/2583

The underlying Ubuntu 18.04 OS is no longer receiving security updates,
and so apps still using it could contain security vulnerabilities.

Please switch to one of our newer 'heroku/builder:*' builder images:
https://github.com/heroku/builder#heroku-builder-images

If you are using the Pack CLI, you will need to adjust the '--builder' CLI
argument, or else change the default builder configuration:
https://buildpacks.io/docs/tools/pack/cli/pack_config_default-builder/

(From: https://github.com/heroku/builder/actions/runs/4927899473/jobs/8805596776#step:9:22)