Skip to content

Commit 4a4adb4

Browse files
NiccoloFeiNiccoloFei
committed
feat: add pgvector
Signed-off-by: Niccolò Fei <[email protected]>
1 parent aca2a38 commit 4a4adb4

15 files changed

+623
-0
lines changed

‎.github/workflows/bake.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Build and publish extensions
2+
3+
on:
4+
push:
5+
6+
defaults:
7+
run:
8+
shell: 'bash -Eeuo pipefail -x {0}'
9+
10+
permissions: {}
11+
12+
jobs:
13+
# Gather extensions that have been modified
14+
change-triage:
15+
name: Check changed files
16+
runs-on: ubuntu-24.04
17+
outputs:
18+
matrix: ${{ steps.get-matrix.outputs.matrix}}
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
22+
23+
- name: Check for changes
24+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
25+
id: filter
26+
# Remember to add new folders in the operator-changed filter if needed
27+
with:
28+
base: ${{ (github.event_name == 'schedule') && 'main' || '' }}
29+
filters: |
30+
pgvector:
31+
- 'pgvector/*'
32+
33+
# Compute a matrix containing the list of all extensions that have been modified
34+
- name: Compute matrix
35+
id: get-matrix
36+
run: |
37+
raw='${{ steps.filter.outputs.changes }}'
38+
echo "{\"name\": $raw}" > matrix.json
39+
cat matrix.json
40+
echo "matrix=$(cat matrix.json)" >> "$GITHUB_OUTPUT"
41+
42+
Bake:
43+
name: Bake
44+
needs: change-triage
45+
permissions:
46+
packages: write
47+
contents: read
48+
id-token: write
49+
security-events: write
50+
strategy:
51+
fail-fast: false
52+
matrix: ${{ fromJSON(needs.change-triage.outputs.matrix) }}
53+
uses: ./.github/workflows/bake_targets.yml
54+
with:
55+
environment: ${{ (github.ref == 'refs/heads/main') && 'production' || 'testing'}}
56+
extension_name: ${{ matrix.name }}

‎.github/workflows/bake_targets.yml‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
name: Build target extension
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
environment:
7+
description: "Target environment for the image build (e.g. testing, production)."
8+
required: true
9+
type: string
10+
default: "testing"
11+
extension_name:
12+
description: "The PostgreSQL extension to build (directory name)"
13+
required: true
14+
type: string
15+
secrets:
16+
SNYK_TOKEN:
17+
required: false
18+
19+
permissions: {}
20+
21+
jobs:
22+
testbuild:
23+
name: Build ${{ inputs.extension_name }}
24+
runs-on: ubuntu-24.04
25+
permissions:
26+
contents: read
27+
packages: write
28+
# Required by the cosign step
29+
id-token: write
30+
outputs:
31+
metadata: ${{ steps.build.outputs.metadata }}
32+
images: ${{ steps.images.outputs.images }}
33+
steps:
34+
- name: Checkout Code
35+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
36+
37+
- name: Log in to the GitHub Container registry
38+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
39+
with:
40+
registry: ghcr.io
41+
username: ${{ github.actor }}
42+
password: ${{ secrets.GITHUB_TOKEN }}
43+
44+
- name: Set up QEMU
45+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
46+
with:
47+
platforms: 'linux/arm64'
48+
49+
- name: Set up Docker Buildx
50+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
51+
52+
- name: Build and push
53+
uses: docker/bake-action@3acf805d94d93a86cce4ca44798a76464a75b88c # v6
54+
id: build
55+
env:
56+
environment: testing
57+
registry: ghcr.io/${{ github.repository_owner }}
58+
revision: ${{ github.sha }}
59+
with:
60+
files: ./${{ inputs.extension_name }}/metadata.json,./docker-bake.hcl
61+
push: true
62+
63+
# From bake's metadata, extract each unique tag (e.g. the ones with the timestamp)
64+
- name: Generated images
65+
id: images
66+
run: |
67+
echo "images=$(echo '${{ steps.build.outputs.metadata }}' | jq -c '[ .[]."image.name" | split(",")[] | select(test("[0-9]{12}")) ]')" >> "$GITHUB_OUTPUT"
68+
69+
# Even if we're testing we sign the images, so we can push them to production later if that's required
70+
- name: Install cosign
71+
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
72+
# See https://github.blog/security/supply-chain-security/safeguard-container-signing-capability-actions/
73+
# and https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml for more details on
74+
# how to use cosign.
75+
- name: Sign images
76+
run: |
77+
echo '${{ steps.build.outputs.metadata }}' | \
78+
jq '.[] | (."image.name" | sub(",.*";"" )) + "@" + ."containerimage.digest"' | \
79+
xargs cosign sign --yes
80+
81+
security:
82+
name: Security checks
83+
runs-on: ubuntu-24.04
84+
permissions:
85+
contents: read
86+
packages: read
87+
security-events: write
88+
needs:
89+
- testbuild
90+
strategy:
91+
matrix:
92+
image: ${{fromJson(needs.testbuild.outputs.images)}}
93+
steps:
94+
- name: Checkout Code
95+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
96+
97+
- name: Security checks
98+
uses: cloudnative-pg/postgres-containers/.github/actions/security-scans@main
99+
with:
100+
image: "${{ matrix.image }}"
101+
registry_user: ${{ github.actor }}
102+
registry_token: ${{ secrets.GITHUB_TOKEN }}
103+
snyk_token: ${{ secrets.SNYK_TOKEN }}
104+
dockerfile: "${{ inputs.extension_name }}/Dockerfile"
105+
106+
smoke-test:
107+
name: Smoke test
108+
runs-on: ubuntu-24.04
109+
permissions:
110+
contents: read
111+
packages: read
112+
needs:
113+
- testbuild
114+
strategy:
115+
matrix:
116+
image: ${{fromJson(needs.testbuild.outputs.images)}}
117+
cnpg: ["main", "1.27"]
118+
env:
119+
# renovate: datasource=github-tags depName=kubernetes-sigs/kind versioning=semver
120+
KIND_VERSION: "v0.30.0"
121+
# renovate: datasource=docker depName=kindest/node
122+
KIND_NODE_VERSION: "v1.34.0"
123+
steps:
124+
- name: Checkout Code
125+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
126+
127+
- name: Create kind cluster
128+
uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
129+
with:
130+
version: ${{ env.KIND_VERSION }}
131+
kubectl_version: ${{ env.KIND_NODE_VERSION }}
132+
node_image: kindest/node:${{ env.KIND_NODE_VERSION }}
133+
config: kind-config.yaml
134+
135+
- name: Install CNPG (${{ matrix.cnpg }})
136+
run: |
137+
operator_manifest="https://raw.githubusercontent.com/cloudnative-pg/artifacts/release-${{ matrix.cnpg }}/manifests/operator-manifest.yaml"
138+
if [[ ${{ matrix.cnpg }} == 'main' ]]; then
139+
operator_manifest="https://raw.githubusercontent.com/cloudnative-pg/artifacts/main/manifests/operator-manifest.yaml"
140+
fi
141+
curl -sSfL "$operator_manifest" | kubectl apply --server-side -f -
142+
kubectl wait --for=condition=Available --timeout=2m -n cnpg-system deployments cnpg-controller-manager
143+
144+
- name: Setup environment variables
145+
id: get-env
146+
run: |
147+
SQL_NAME=$(jq -r '.metadata.sql_name' ${{ inputs.extension_name }}/metadata.json)
148+
PG_IMAGE=$(skopeo inspect docker://${{ matrix.image }} -f '{{ json .Labels }}' | jq -r '."org.opencontainers.image.base.name"')
149+
150+
echo "sql_name=$SQL_NAME" >> $GITHUB_OUTPUT
151+
echo "pg_image=$PG_IMAGE" >> $GITHUB_OUTPUT
152+
153+
- name: Install Chainsaw
154+
uses: kyverno/action-install-chainsaw@6354895e0f99ab23d3e38d85cf5c71b5dc21d727 # v0.2.13
155+
156+
- name: Run Kyverno/Chainsaw
157+
env:
158+
EXT_NAME: ${{ inputs.extension_name }}
159+
EXT_IMAGE: ${{ matrix.image }}
160+
EXT_SQL_NAME: ${{ steps.get-env.outputs.sql_name }}
161+
PG_IMAGE: ${{ steps.get-env.outputs.pg_image }}
162+
run: |
163+
yq -n \
164+
'
165+
.extension_name = env(EXT_NAME) |
166+
.extension_image = env(EXT_IMAGE) |
167+
.extension_sql_name = env(EXT_SQL_NAME) |
168+
.pg_image = env(PG_IMAGE)
169+
' \
170+
> values.yaml
171+
cat values.yaml
172+
173+
chainsaw test ./test --values values.yaml
174+
175+
copytoproduction:
176+
name: Copy images to production
177+
if: |
178+
github.ref == 'refs/heads/main' &&
179+
( github.event.inputs.environment == 'production' || github.event_name == 'schedule' )
180+
runs-on: ubuntu-24.04
181+
needs:
182+
- testbuild
183+
- security
184+
- smoke-test
185+
permissions:
186+
contents: read
187+
packages: write
188+
# Required by the cosign step
189+
id-token: write
190+
steps:
191+
- name: Copy to production
192+
uses: cloudnative-pg/postgres-containers/.github/actions/copy-images@main
193+
with:
194+
bake_build_metadata: "${{ needs.testbuild.outputs.metadata }}"
195+
registry_user: ${{ github.actor }}
196+
registry_token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/update.yml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
name: Update Extension versions
2+
3+
on:
4+
push:
5+
schedule:
6+
- cron: 0 0 * * 1
7+
workflow_dispatch:
8+
9+
defaults:
10+
run:
11+
shell: 'bash -Eeuo pipefail -x {0}'
12+
13+
permissions: read-all
14+
15+
jobs:
16+
fetch-extensions:
17+
name: Fetch available extensions
18+
runs-on: ubuntu-24.04
19+
outputs:
20+
extensions: ${{ steps.get-extensions.outputs.extensions }}
21+
steps:
22+
- name: Checkout repository
23+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
24+
25+
- name: Fetch extensions
26+
id: get-extensions
27+
run: |
28+
extensions=$(find . -type f -name Dockerfile -exec dirname {} \; | \
29+
sed 's|^\./||' | xargs -n1 basename | sort -u | \
30+
jq -R -s -c 'split("\n")[:-1]')
31+
echo "extensions=$extensions" >> $GITHUB_OUTPUT
32+
33+
update-extension:
34+
name: Update ${{ matrix.extension }}
35+
runs-on: ubuntu-24.04
36+
needs:
37+
- fetch-extensions
38+
strategy:
39+
matrix:
40+
extension: ${{fromJson(needs.fetch-extensions.outputs.extensions)}}
41+
permissions:
42+
contents: write
43+
steps:
44+
- name: Checkout repository
45+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
46+
47+
- name: Fetch latest extension versions
48+
id: fetch_versions
49+
run: |
50+
# Get the distributions
51+
readarray -t DISTROS < <(sed -n '/variable "distributions"/,/}/ { s/^[[:space:]]*"\([^"]*\)".*/\1/p }' docker-bake.hcl)
52+
# Get the PG versions
53+
readarray -t POSTGRES_MAJORS < <(sed -n '/variable "pgVersions"/,/]/ { s/^[[:space:]]*"\([^"]*\)".*/\1/p }' docker-bake.hcl)
54+
# Get the extension name
55+
EXT_NAME=$(jq -r '.metadata.name' "${{ matrix.extension }}/metadata.json")
56+
57+
for DISTRO in "${DISTROS[@]}"; do
58+
for MAJOR in "${POSTGRES_MAJORS[@]}"; do
59+
VERSION=$(curl -s "https://apt.postgresql.org/pub/repos/apt/dists/$DISTRO-pgdg/main/binary-amd64/Packages" \
60+
| awk -v pkg="postgresql-${MAJOR}-${EXT_NAME}" '
61+
$1 == "Package:" && $2 == pkg {show=1; next}
62+
show && $1 == "Version:" {print $2; show=0}
63+
' \
64+
| sort -V \
65+
| tail -n1)
66+
if [[ -z "$VERSION" ]]; then
67+
echo "No version found for ${EXT_NAME} on PG ${MAJOR} - $DISTRO"
68+
exit 1
69+
fi
70+
71+
jq --arg distro "$DISTRO" \
72+
--arg major "$MAJOR" \
73+
--arg version "$VERSION" \
74+
'.metadata.versions[$distro][$major] = $version' \
75+
"${{ matrix.extension }}/metadata.json" > "${{ matrix.extension }}/metadata.tmp" \
76+
&& mv "${{ matrix.extension }}/metadata.tmp" "${{ matrix.extension }}/metadata.json"
77+
done
78+
done
79+
80+
- name: Diff
81+
run: |
82+
git status
83+
git diff
84+
85+
- name: Temporarily disable "include administrators" branch protection
86+
if: ${{ always() && github.ref == 'refs/heads/main' }}
87+
id: disable_include_admins
88+
uses: benjefferies/branch-protection-bot@af281f37de86139d1c7a27b91176b5dc1c2c827c # v1.1.2
89+
with:
90+
access_token: ${{ secrets.REPO_GHA_PAT }}
91+
branch: main
92+
enforce_admins: false
93+
94+
- uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
95+
with:
96+
author_name: CloudNativePG Automated Updates
97+
author_email: [email protected]
98+
message: 'chore: update ${{ matrix.extension }} versions'
99+
100+
- name: Enable "include administrators" branch protection
101+
uses: benjefferies/branch-protection-bot@af281f37de86139d1c7a27b91176b5dc1c2c827c # v1.1.2
102+
if: ${{ always() && github.ref == 'refs/heads/main' }}
103+
with:
104+
access_token: ${{ secrets.REPO_GHA_PAT }}
105+
branch: main
106+
enforce_admins: ${{ steps.disable_include_admins.outputs.initial_status }}

0 commit comments

Comments
 (0)