upstream merge

.github/PULL_REQUEST_TEMPLATE/new_extension.md

@@ -52,6 +52,9 @@ Closes #<!-- proposal issue id -->
 - [ ] An entry for the new extension folder was added to
       [`CODEOWNERS`](https://github.com/cloudnative-pg/postgres-extensions-containers/blob/main/CODEOWNERS)
       with the component owner's GitHub handle(s).
+- [ ] A `distribution-points` entry for the new image was added under
+      `repository.release` in
+      [`SECURITY-INSIGHTS.yml`](https://github.com/cnpg-extensions/postgres-extensions-containers/blob/main/SECURITY-INSIGHTS.yml).
 - [ ] I confirm my commitment to maintain this extension on behalf of the
       CloudNativePG community.
 
@@ -84,4 +87,6 @@ Closes #<!-- proposal issue id -->
       when `create_extension = true`) are valid.
 - [ ] `CODEOWNERS` entry is present and the component owner(s) accept the
       long-term maintenance commitment.
+- [ ] `SECURITY-INSIGHTS.yml` has a matching `distribution-points` entry for
+      the new image.
 - [ ] PR targets `main` and is ready to merge.

.github/workflows/bake.yml

@@ -24,7 +24,7 @@ jobs:
       matrix: ${{ steps.get-matrix.outputs.matrix}}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -33,7 +33,7 @@ jobs:
         uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.21.5
+          DAGGER_VERSION: 0.21.9
         with:
           version: ${{ env.DAGGER_VERSION }}
           verb: call
@@ -66,7 +66,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Check for changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/bake_targets.yml

@@ -27,35 +27,35 @@ jobs:
       images: ${{ steps.images.outputs.images }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Log in to the GitHub Container registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
         with:
           platforms: 'linux/arm64'
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
 
       - name: Build and push
-        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
         id: build
         env:
           BUILDX_METADATA_PROVENANCE: disabled
           environment: testing
           registry: ghcr.io/${{ github.repository_owner }}
           revision: ${{ github.sha }}
         with:
-          files: ./${{ inputs.extension_name }}/metadata.hcl,./docker-bake.hcl
+          files: ./docker-bake.hcl,./${{ inputs.extension_name }}/metadata.hcl
           push: true
 
       # From bake's metadata, extract each unique tag (e.g. the ones with the timestamp)
@@ -94,7 +94,7 @@ jobs:
         image: ${{fromJson(needs.testbuild.outputs.images)}}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -107,6 +107,25 @@ jobs:
           snyk_token: ${{ secrets.SNYK_TOKEN }}
           dockerfile: "${{ inputs.extension_name }}/Dockerfile"
 
+  generate-smoke-test-matrix:
+    name: Generate matrix for smoke tests
+    runs-on: ubuntu-24.04
+    permissions: {}
+    outputs:
+      versions: ${{ steps.versions.outputs.versions }}
+    steps:
+      # main plus the latest and previous supported minor release branches.
+      - name: Compute CNPG release matrix
+        id: versions
+        env:
+          # renovate: datasource=github-tags depName=cloudnative-pg/cloudnative-pg versioning=semver-coerced extractVersion=^v(?<version>\d+\.\d+)\.\d+$
+          LATEST_RELEASE: "1.30"
+        run: |
+          PREVIOUS_RELEASE=$(awk -F. '{print $1"."$2-1}' <<< "$LATEST_RELEASE")
+          versions=$(jq -cn --arg latest "$LATEST_RELEASE" --arg previous "$PREVIOUS_RELEASE" \
+            '["main", $previous, $latest]')
+          echo "versions=$versions" >> "$GITHUB_OUTPUT"
+
   smoke-test:
     name: Smoke test
     runs-on: ubuntu-24.04
@@ -115,24 +134,25 @@ jobs:
       packages: read
     needs:
       - testbuild
+      - generate-smoke-test-matrix
     strategy:
       fail-fast: false
       matrix:
         image: ${{fromJson(needs.testbuild.outputs.images)}}
-        cnpg: ["main", "1.28", "1.29"]
+        cnpg: ${{fromJson(needs.generate-smoke-test-matrix.outputs.versions)}}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
 
       - name: Install Dagger
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.21.5
+          DAGGER_VERSION: 0.21.9
         run: |
           curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
 

.github/workflows/test.yml

@@ -0,0 +1,54 @@
+name: Dagger Module Unit tests
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'dagger/maintenance/**'
+  pull_request:
+    paths:
+      - 'dagger/maintenance/**'
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: 'bash -Eeuo pipefail -x {0}'
+
+permissions: {}
+
+jobs:
+  unit-test:
+    name: Go unit tests
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: dagger/maintenance/go.mod
+          cache-dependency-path: dagger/maintenance/go.sum
+
+      - name: Generate the Dagger client
+        uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1
+        env:
+          # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
+          DAGGER_VERSION: 0.21.9
+        with:
+          version: ${{ env.DAGGER_VERSION }}
+          verb: develop
+          module: ./dagger/maintenance/
+
+      - name: Run unit tests
+        working-directory: dagger/maintenance
+        env:
+          # The generated Dagger client reads these at package init time. The
+          # unit tests never open a session, so dummy values are enough to get
+          # past the init check without contacting an engine.
+          DAGGER_SESSION_PORT: "1"
+          DAGGER_SESSION_TOKEN: "test"
+        run: go test ./...

.github/workflows/update-catalogs.yml

@@ -22,12 +22,12 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Checkout artifacts
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: artifacts
           repository: cloudnative-pg/artifacts
@@ -39,7 +39,7 @@ jobs:
         uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.21.5
+          DAGGER_VERSION: 0.21.9
         with:
           version: ${{ env.DAGGER_VERSION }}
           verb: call
@@ -63,7 +63,7 @@ jobs:
           git status
           git diff --staged
 
-      - uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # v10
+      - uses: EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8 # v11
         if: github.ref == 'refs/heads/main'
         with:
           cwd: 'artifacts'

.github/workflows/update_os_libraries.yml

@@ -19,7 +19,7 @@ jobs:
       extensions: ${{ steps.get-extensions.outputs.extensions }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -28,7 +28,7 @@ jobs:
         uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.21.5
+          DAGGER_VERSION: 0.21.9
         with:
           version: ${{ env.DAGGER_VERSION }}
           verb: call
@@ -53,10 +53,10 @@ jobs:
         extension: ${{ fromJson(needs.fetch-extensions.outputs.extensions) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Log in to the GitHub Container registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -66,7 +66,7 @@ jobs:
         uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.21.5
+          DAGGER_VERSION: 0.21.9
         with:
           version: ${{ env.DAGGER_VERSION }}
           verb: call

BUILD.md

@@ -60,16 +60,17 @@ For more complex setups, you can use the `dagger` command directly to customize
 distributions or package names:
 
 ```bash
-dagger call -sm ./dagger/maintenance/ create --name="<name>" [ARGUMENTS]
+dagger call -sm ./dagger/maintenance/ create --name="<name>" [ARGUMENTS] \
+  export --path ./<name>
 ```
 
 **Common Arguments:**
 
 | Argument | Description | Default |
 | --- | --- | --- |
-| `--distros` | Debian distributions the extension supports. | `[trixie, bookworm]` |
+| `--distros` | Debian distributions the extension supports (comma separated list). | `[trixie, bookworm]` |
 | `--package-name` | The Debian package name (uses `%version%` placeholder). | `postgresql-%version%-<name>` |
-| `--versions` | Supported Postgres major versions. | `[18]` |
+| `--versions` | Supported Postgres major versions (comma separated list). | `[18]` |
 | `--templates-dir` | Source directory containing custom template files. | Internal template dir |
 
 ---

CONTRIBUTING_NEW_EXTENSION.md

@@ -301,6 +301,10 @@ Submission Requirements:
 - **CODEOWNERS**: The PR must add an entry to the [`CODEOWNERS`](./CODEOWNERS)
   file listing the GitHub handles of the component owner(s) for the new
   extension folder.
+- **SECURITY-INSIGHTS.yml**: The PR must add a `distribution-points` entry for
+  the new image under `repository.release` in
+  [`SECURITY-INSIGHTS.yml`](./SECURITY-INSIGHTS.yml), pointing to its GitHub
+  Packages page (using the `image_name` from `metadata.hcl`).
 
 > [!IMPORTANT]
 > When opening the Pull Request, use the **new extension** template, which