Skip to content

Commit 758772c

Browse files
NiccoloFeiNiccoloFei
committed
feat: add pgvector
Signed-off-by: Niccolò Fei <[email protected]>
1 parent a631dc6 commit 758772c

15 files changed

+626
-0
lines changed

‎.github/workflows/bake.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Build and publish extensions
2+
3+
on:
4+
push:
5+
6+
defaults:
7+
run:
8+
shell: 'bash -Eeuo pipefail -x {0}'
9+
10+
permissions: {}
11+
12+
jobs:
13+
# Gather extensions that have been modified
14+
change-triage:
15+
name: Check changed files
16+
runs-on: ubuntu-24.04
17+
outputs:
18+
matrix: ${{ steps.get-matrix.outputs.matrix}}
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
22+
23+
- name: Check for changes
24+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
25+
id: filter
26+
# Remember to add new folders in the operator-changed filter if needed
27+
with:
28+
base: ${{ (github.event_name == 'schedule') && 'main' || '' }}
29+
filters: |
30+
pgvector:
31+
- 'pgvector/*'
32+
33+
# Compute a matrix containing the list of all extensions that have been modified
34+
- name: Compute matrix
35+
id: get-matrix
36+
run: |
37+
raw='${{ steps.filter.outputs.changes }}'
38+
echo "{\"name\": $raw}" > matrix.json
39+
cat matrix.json
40+
echo "matrix=$(cat matrix.json)" >> "$GITHUB_OUTPUT"
41+
42+
Bake:
43+
name: Bake
44+
needs: change-triage
45+
permissions:
46+
packages: write
47+
contents: read
48+
id-token: write
49+
security-events: write
50+
strategy:
51+
fail-fast: false
52+
matrix: ${{ fromJSON(needs.change-triage.outputs.matrix) }}
53+
uses: ./.github/workflows/bake_targets.yml
54+
with:
55+
environment: ${{ (github.ref == 'refs/heads/main') && 'production' || 'testing'}}
56+
extension_name: ${{ matrix.name }}

‎.github/workflows/bake_targets.yml‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
name: Build target extension
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
environment:
7+
description: "Target environment for the image build (e.g. testing, production)."
8+
required: true
9+
type: string
10+
default: "testing"
11+
extension_name:
12+
description: "The PostgreSQL extension to build (directory name)"
13+
required: true
14+
type: string
15+
secrets:
16+
SNYK_TOKEN:
17+
required: false
18+
19+
permissions: {}
20+
21+
jobs:
22+
testbuild:
23+
name: Build ${{ inputs.extension_name }}
24+
runs-on: ubuntu-24.04
25+
permissions:
26+
contents: read
27+
packages: write
28+
# Required by the cosign step
29+
id-token: write
30+
outputs:
31+
metadata: ${{ steps.build.outputs.metadata }}
32+
images: ${{ steps.images.outputs.images }}
33+
steps:
34+
- name: Checkout Code
35+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
36+
37+
- name: Log in to the GitHub Container registry
38+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
39+
with:
40+
registry: ghcr.io
41+
username: ${{ github.actor }}
42+
password: ${{ secrets.GITHUB_TOKEN }}
43+
44+
- name: Set up QEMU
45+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
46+
with:
47+
platforms: 'linux/arm64'
48+
49+
- name: Set up Docker Buildx
50+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
51+
52+
- name: Build and push
53+
uses: docker/bake-action@3acf805d94d93a86cce4ca44798a76464a75b88c # v6
54+
id: build
55+
env:
56+
environment: testing
57+
registry: ghcr.io/${{ github.repository_owner }}
58+
revision: ${{ github.sha }}
59+
with:
60+
files: ./${{ inputs.extension_name }}/metadata.json,./docker-bake.hcl
61+
push: true
62+
63+
# From bake's metadata, extract each unique tag (e.g. the ones with the timestamp)
64+
- name: Generated images
65+
id: images
66+
run: |
67+
echo "images=$(echo '${{ steps.build.outputs.metadata }}' | jq -c '[ .[]."image.name" | split(",")[] | select(test("[0-9]{12}")) ]')" >> "$GITHUB_OUTPUT"
68+
69+
# Even if we're testing we sign the images, so we can push them to production later if that's required
70+
- name: Install cosign
71+
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
72+
# See https://github.blog/security/supply-chain-security/safeguard-container-signing-capability-actions/
73+
# and https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml for more details on
74+
# how to use cosign.
75+
- name: Sign images
76+
run: |
77+
echo '${{ steps.build.outputs.metadata }}' | \
78+
jq '.[] | (."image.name" | sub(",.*";"" )) + "@" + ."containerimage.digest"' | \
79+
xargs cosign sign --yes
80+
81+
security:
82+
name: Security checks
83+
runs-on: ubuntu-24.04
84+
permissions:
85+
contents: read
86+
packages: read
87+
security-events: write
88+
needs:
89+
- testbuild
90+
strategy:
91+
matrix:
92+
image: ${{fromJson(needs.testbuild.outputs.images)}}
93+
steps:
94+
- name: Checkout Code
95+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
96+
97+
- name: Security checks
98+
uses: cloudnative-pg/postgres-containers/.github/actions/security-scans@main
99+
with:
100+
image: "${{ matrix.image }}"
101+
registry_user: ${{ github.actor }}
102+
registry_token: ${{ secrets.GITHUB_TOKEN }}
103+
snyk_token: ${{ secrets.SNYK_TOKEN }}
104+
dockerfile: "${{ inputs.extension_name }}/Dockerfile"
105+
106+
smoke-test:
107+
name: Smoke test
108+
runs-on: ubuntu-24.04
109+
permissions:
110+
contents: read
111+
packages: read
112+
needs:
113+
- testbuild
114+
strategy:
115+
matrix:
116+
image: ${{fromJson(needs.testbuild.outputs.images)}}
117+
cnpg: ["main", "1.27"]
118+
env:
119+
# renovate: datasource=github-tags depName=kubernetes-sigs/kind versioning=semver
120+
KIND_VERSION: "v0.30.0"
121+
# renovate: datasource=docker depName=kindest/node
122+
KIND_NODE_VERSION: "v1.34.0"
123+
steps:
124+
- name: Checkout Code
125+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
126+
127+
- name: Create kind cluster
128+
uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
129+
with:
130+
version: ${{ env.KIND_VERSION }}
131+
kubectl_version: ${{ env.KIND_NODE_VERSION }}
132+
node_image: kindest/node:${{ env.KIND_NODE_VERSION }}
133+
config: kind-config.yaml
134+
135+
- name: Install CNPG (${{ matrix.cnpg }})
136+
run: |
137+
operator_manifest="https://raw.githubusercontent.com/cloudnative-pg/artifacts/release-${{ matrix.cnpg }}/manifests/operator-manifest.yaml"
138+
if [[ ${{ matrix.cnpg }} == 'main' ]]; then
139+
operator_manifest="https://raw.githubusercontent.com/cloudnative-pg/artifacts/main/manifests/operator-manifest.yaml"
140+
fi
141+
curl -sSfL "$operator_manifest" | kubectl apply --server-side -f -
142+
kubectl wait --for=condition=Available --timeout=2m -n cnpg-system deployments cnpg-controller-manager
143+
144+
- name: Setup environment variables
145+
id: get-env
146+
run: |
147+
SQL_NAME=$(jq -r '.metadata.sql_name' ${{ inputs.extension_name }}/metadata.json)
148+
PG_IMAGE=$(skopeo inspect docker://${{ matrix.image }} -f '{{ json .Labels }}' | jq -r '."org.opencontainers.image.base.name"')
149+
150+
echo "sql_name=$SQL_NAME" >> $GITHUB_OUTPUT
151+
echo "pg_image=$PG_IMAGE" >> $GITHUB_OUTPUT
152+
153+
- name: Install Chainsaw
154+
uses: kyverno/action-install-chainsaw@6354895e0f99ab23d3e38d85cf5c71b5dc21d727 # v0.2.13
155+
156+
- name: Run Kyverno/Chainsaw
157+
env:
158+
EXT_NAME: ${{ inputs.extension_name }}
159+
EXT_IMAGE: ${{ matrix.image }}
160+
EXT_SQL_NAME: ${{ steps.get-env.outputs.sql_name }}
161+
PG_IMAGE: ${{ steps.get-env.outputs.pg_image }}
162+
run: |
163+
yq -n \
164+
'
165+
.extension_name = env(EXT_NAME) |
166+
.extension_image = env(EXT_IMAGE) |
167+
.extension_sql_name = env(EXT_SQL_NAME) |
168+
.pg_image = env(PG_IMAGE)
169+
' \
170+
> values.yaml
171+
cat values.yaml
172+
173+
chainsaw test ./test --values values.yaml
174+
175+
copytoproduction:
176+
name: Copy images to production
177+
if: |
178+
github.ref == 'refs/heads/main' &&
179+
( github.event.inputs.environment == 'production' || github.event_name == 'schedule' )
180+
runs-on: ubuntu-24.04
181+
needs:
182+
- testbuild
183+
- security
184+
- smoke-test
185+
permissions:
186+
contents: read
187+
packages: write
188+
# Required by the cosign step
189+
id-token: write
190+
steps:
191+
- name: Copy to production
192+
uses: cloudnative-pg/postgres-containers/.github/actions/copy-images@main
193+
with:
194+
bake_build_metadata: "${{ needs.testbuild.outputs.metadata }}"
195+
registry_user: ${{ github.actor }}
196+
registry_token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/update.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# This workflow updates the versions of each extension.
2+
# When it runs on the main branch, for each extension it will open a PR containing the changes.
3+
# When it runs on a dev branch, it will push a new commit containing the changes in the dev branch.
4+
name: Update Extension versions
5+
6+
on:
7+
push:
8+
schedule:
9+
- cron: 0 0 * * 1
10+
workflow_dispatch:
11+
12+
defaults:
13+
run:
14+
shell: 'bash -Eeuo pipefail -x {0}'
15+
16+
permissions: read-all
17+
18+
jobs:
19+
fetch-extensions:
20+
name: Fetch available extensions
21+
runs-on: ubuntu-24.04
22+
outputs:
23+
extensions: ${{ steps.get-extensions.outputs.extensions }}
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
27+
28+
- name: Fetch extensions
29+
id: get-extensions
30+
run: |
31+
extensions=$(find . -type f -name Dockerfile -exec dirname {} \; | \
32+
sed 's|^\./||' | xargs -n1 basename | sort -u | \
33+
jq -R -s -c 'split("\n")[:-1]')
34+
echo "extensions=$extensions" >> $GITHUB_OUTPUT
35+
36+
update-extension:
37+
name: Update ${{ matrix.extension }}
38+
runs-on: ubuntu-24.04
39+
needs:
40+
- fetch-extensions
41+
strategy:
42+
matrix:
43+
extension: ${{fromJson(needs.fetch-extensions.outputs.extensions)}}
44+
permissions:
45+
contents: write
46+
pull-requests: write
47+
steps:
48+
- name: Checkout repository
49+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
50+
51+
- name: Fetch latest extension versions
52+
id: fetch_versions
53+
run: |
54+
# Get the distributions
55+
readarray -t DISTROS < <(sed -n '/variable "distributions"/,/}/ { s/^[[:space:]]*"\([^"]*\)".*/\1/p }' docker-bake.hcl)
56+
# Get the PG versions
57+
readarray -t POSTGRES_MAJORS < <(sed -n '/variable "pgVersions"/,/]/ { s/^[[:space:]]*"\([^"]*\)".*/\1/p }' docker-bake.hcl)
58+
# Get the extension name
59+
EXT_NAME=$(jq -r '.metadata.name' "${{ matrix.extension }}/metadata.json")
60+
61+
for DISTRO in "${DISTROS[@]}"; do
62+
for MAJOR in "${POSTGRES_MAJORS[@]}"; do
63+
VERSION=$(curl -s "https://apt.postgresql.org/pub/repos/apt/dists/$DISTRO-pgdg/main/binary-amd64/Packages" \
64+
| awk -v pkg="postgresql-${MAJOR}-${EXT_NAME}" '
65+
$1 == "Package:" && $2 == pkg {show=1; next}
66+
show && $1 == "Version:" {print $2; show=0}
67+
' \
68+
| sort -V \
69+
| tail -n1)
70+
if [[ -z "$VERSION" ]]; then
71+
echo "No version found for ${EXT_NAME} on PG ${MAJOR} - $DISTRO"
72+
exit 1
73+
fi
74+
75+
jq --arg distro "$DISTRO" \
76+
--arg major "$MAJOR" \
77+
--arg version "$VERSION" \
78+
'.metadata.versions[$distro][$major] = $version' \
79+
"${{ matrix.extension }}/metadata.json" > "${{ matrix.extension }}/metadata.tmp" \
80+
&& mv "${{ matrix.extension }}/metadata.tmp" "${{ matrix.extension }}/metadata.json"
81+
done
82+
done
83+
84+
- name: Diff
85+
run: |
86+
git status
87+
git diff
88+
89+
- name: Commit the changes if we are running on a dev branch
90+
uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
91+
if: github.ref != 'refs/heads/main'
92+
with:
93+
author_name: CloudNativePG Automated Updates
94+
author_email: [email protected]
95+
message: 'chore: update ${{ matrix.extension }} versions'
96+
add: '${{ matrix.extension }}/'
97+
98+
- name: Create a PR if versions have been updated on main
99+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
100+
if: github.ref == 'refs/heads/main'
101+
with:
102+
title: "chore: update ${{ matrix.extension }} versions"
103+
body: "Updating the versions of ${{ matrix.extension }}"
104+
branch: "${{ matrix.extension }}-update"
105+
author: "extension-versions-updater <[email protected]>"
106+
add-paths: |
107+
${{ matrix.extension }}/**
108+
commit-message: "chore: update ${{ matrix.extension }} versions"
109+
signoff: true

0 commit comments

Comments
 (0)