Docker Hardened Images | PostgreSQL Extension Support

.github/workflows/build-postgres.yml

@@ -12,13 +12,13 @@ concurrency:
 jobs:
   build:
     name: Build
-    runs-on: firecracker
+    runs-on: ubuntu-latest # TODO: Change to firecracker
     permissions:
       packages: write
     strategy:
       fail-fast: false
       matrix:
-        tag: [18.3-alpine, 18.3-bookworm, 17.9-alpine, 17.9-bookworm, 17.5-alpine, 17.4-alpine, 17.2-alpine, 16.13-alpine, 16.13-bookworm, 16.10-alpine, 16.10-bookworm, 16.9-alpine, 16.8-alpine, 16.6-alpine, 16.4-alpine, 16.1-alpine, 15.17-alpine, 15.17-bookworm, 15.13-alpine, 15.12-alpine, 15.10-alpine, 15.8-alpine, 15.5-alpine, 14.22-alpine, 14.22-bookworm, 14.19-alpine, 14.19-bookworm, 14.18-alpine, 14.17-alpine, 14.15-alpine, 14.13-alpine, 14.10-alpine]
+        tag: [18.3-bookworm-dhi,18.3-bookworm-ext]
     steps:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
@@ -78,7 +78,7 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
     - name: Log in to the DHI registry
-      uses: docker/login-action@v2
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
       with:
         registry: dhi.io
         username: ${{ secrets.DOCKERHUB_USERNAME }}

cmd/build-image/main.go

@@ -154,6 +154,7 @@ func main() {
 	if b == nil {
 		panic(fmt.Sprintf("%s app.txt is missing tag %s", *name, *tag))
 	}
+	klog.Infoln(b.String())
 	var repoURL string
 	if strings.Contains(libRepoURL, "github.com/"+api.GH_IMG_REPO_OWNER) {
 		repoURL = libRepoURL
@@ -449,7 +450,23 @@ func GetFullName(s string) (string, error) {
 }
 
 func FindBlock(dir, name, tag string) (string, *api.Block, error) {
-	filename := filepath.Join(dir, "library", name, "app.json")
+	filename := ""
+	klog.Infoln(tag)
+	suf := strings.Split(tag, "-")[len(strings.Split(tag, "-"))-1]
+	switch suf {
+	case "dhi":
+		filename = filepath.Join(dir, "library", name, "dhi.json")
+	case "ext":
+		filename = filepath.Join(dir, "library", name, "ext.json")
+	default:
+		filename = filepath.Join(dir, "library", name, "app.json")
+	}
+	klog.Infoln(filename)
+	return FindBlockWithGivenFile(filename, tag)
+}
+
+func FindBlockWithGivenFile(filename, tag string) (string, *api.Block, error) {
+
 	data, err := os.ReadFile(filename)
 	if err != nil {
 		return "", nil, err
@@ -466,5 +483,6 @@ func FindBlock(dir, name, tag string) (string, *api.Block, error) {
 			return h.GitRepo, &b, nil
 		}
 	}
+
 	return h.GitRepo, nil, nil
 }