feat: build Debian 13 DocumentDB packages - #455
Conversation
Build Debian 13 PostgreSQL 18 extension packages from pinned DocumentDB source, publish signed package bundles to GHCR as OCI artifacts, and consume them when building database images. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Guanzhou Song <guanzhousong@microsoft.com>
Pin the latest ORAS CLI version recognized by setup-oras v2.0.1 so package publication jobs can install the client. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Guanzhou Song <guanzhousong@microsoft.com>
There was a problem hiding this comment.
🟡 Changes recommended
The new workflow logic has a verified correctness issue in its “exactly one .deb” validation that can incorrectly pass on empty results, reducing reliability of the packaging pipeline.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates the database-image build and release pipeline to handle Debian 13 / PostgreSQL 18 DocumentDB extension packages that are no longer published as upstream release assets, by building packages from pinned upstream source and distributing them as signed GHCR OCI artifacts.
Changes:
- Build Debian 13 / PG18
postgresql-18-documentdbpackages from a pinneddocumentdb/documentdbsource commit (amd64 + arm64) and publish them as signed OCI artifacts in GHCR. - Consume package artifacts by digest (with signature verification) when building the extension image, and promote package artifacts alongside image promotion.
- Refresh release + image-management + fork-testing documentation to reflect the new package artifact flow.
File summaries
| File | Description |
|---|---|
RELEASE.md |
Documents the new GHCR OCI package artifact format and promotion expectations for database releases. |
docs/developer-guides/testing-with-fork-images.md |
Updates fork-testing steps to build from DocumentDB source (tag/branch) instead of relying on upstream release assets. |
docs/designs/image-management.md |
Updates design doc to describe source-pinned package builds and signed package/image publishing. |
.github/workflows/release_documentdb_images.yml |
Adds promotion for signed Debian package OCI artifacts (retag by digest) alongside image promotion. |
.github/workflows/build_documentdb_images.yml |
Implements source ref → commit pinning, native per-arch package builds, OCI artifact publish/sign/verify, and image builds consuming those artifacts. |
.github/dockerfiles/Dockerfile_extension |
Preserves upstream LICENSE/NOTICE in the scratch extension image when present in the package bundle. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| sha256sum -c SHA256SUMS | ||
| DEB_FILE=$(find . -maxdepth 1 -type f -name '*.deb' -printf '%f\n') | ||
| [[ $(echo "$DEB_FILE" | wc -l) -eq 1 ]] || { | ||
| echo "Expected exactly one Debian package" >&2 | ||
| exit 1 | ||
| } | ||
| [[ $(dpkg-deb -f "$DEB_FILE" Architecture) == "${{ matrix.arch }}" ]] |
documentdb-triage-tool
Bot
added
CI/CD
documentation
|
🤖 Auto-triaged by documentdb-triage-tool. Applied: Reasoningcomponent from path globs (docs, ci); effort from diff stats (484+104 LOC, 6 files); LLM: Adds Debian 13 / PostgreSQL 18 build-on-demand package support to CI/CD workflows, touching multiple workflow files, OCI artifact publishing, and release/promotion pipelines. If a label is wrong, remove it manually and ping |
Validate source versions before packaging, verify complete signed candidates before promotion, prevent stable tag replacement, and keep default version updates as separate reviewed changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Guanzhou Song <guanzhousong@microsoft.com>
Build DocumentDB 0.116.0 and later Debian 13 PostgreSQL 18 packages from a pinned source commit on native architecture runners. Preserve the legacy package download path for older releases and leave image promotion behavior unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: faca2436-03f6-47f3-be13-f266ab71a7e9 Signed-off-by: Guanzhou Song <guanzhousong@microsoft.com>
Derive the upstream release tag directly from the requested version and remove the unused source-ref override. Align the workflow input example and documentation with the preserved defaults and observed build time. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: faca2436-03f6-47f3-be13-f266ab71a7e9 Signed-off-by: Guanzhou Song <guanzhousong@microsoft.com>
Summary
Build the Debian 13 / PostgreSQL 18 DocumentDB extension package from
pinned upstream source as part of the existing database-image workflow.
Starting with DocumentDB v0.116, upstream no longer publishes the Debian
13 package as a release asset. The workflow now builds the package on the
native amd64 and arm64 image runners and consumes it directly when
building the extension image.
Releases before v0.116 continue using their existing published packages.
Changes
and automatic version-bump PR behavior
Validation
https://github.com/guanzhousongmicrosoft/documentdb-kubernetes-operator/actions/runs/33905225103