feat: add PostgreSQL UBI development image

.dockerignore

@@ -0,0 +1,14 @@
+.git
+.github
+.pre-commit-cache
+.venv
+build
+dist
+docs
+security-results
+tests
+*.key
+*.pem
+*.sarif
+*.spdx.json
+grype*.json

.editorconfig

@@ -0,0 +1,17 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab
+
+[*.{json,md,yaml,yml}]
+indent_style = space
+indent_size = 2

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.bat text eol=crlf
+*.cmd text eol=crlf
+
+*.gif binary
+*.ico binary
+*.jpg binary
+*.jpeg binary
+*.png binary
+*.pdf binary

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+* @joey-huckabee
+
+/.github/ @joey-huckabee
+/Containerfile @joey-huckabee
+/container/ @joey-huckabee
+/tests/ @joey-huckabee

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: Report reproducible image, runtime, or documentation behavior
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Do not disclose vulnerabilities here. Use the private security link
+        shown before opening an issue.
+  - type: input
+    id: image
+    attributes:
+      label: Image tag and digest
+      description: Include both when available; do not report only a mutable tag.
+      placeholder: ghcr.io/datopsis/postgresql-ubi:v18.6-ubi9-r20260910.1@sha256:...
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime, host, and versions
+      placeholder: RHEL and Podman, Docker, or OpenShift versions
+    validations:
+      required: true
+  - type: dropdown
+    id: architecture
+    attributes:
+      label: Architecture
+      options:
+        - linux/amd64
+        - linux/arm64
+        - Other or unknown
+    validations:
+      required: true
+  - type: textarea
+    id: configuration
+    attributes:
+      label: Minimal PostgreSQL and deployment configuration
+      description: Remove credentials, keys, internal names, and other secrets.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Reproduction and observed behavior
+      description: List exact steps, the result, and the expected result.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Redact secrets and personal or internal information.
+      render: text
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and tested the current development revision or a supported release.
+          required: true
+        - label: I removed secrets and sensitive data from this report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a vulnerability privately
+    url: https://github.com/datopsis/postgresql-ubi/security/advisories/new
+    about: Never disclose a suspected vulnerability in a public issue.
+  - name: PostgreSQL upstream
+    url: https://www.postgresql.org/support/
+    about: Use upstream channels for behavior that reproduces outside this image.

.github/dependabot.yml

@@ -0,0 +1,34 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      pre-commit-hooks:
+        patterns:
+          - "*"
+
+  - package-ecosystem: pip
+    directory: /.github/requirements
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      ci-python-tools:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Summary
+
+Describe the user-facing or operational outcome and why the change is needed.
+
+## Validation
+
+- [ ] I ran the relevant local checks from `docs/CI.md`.
+- [ ] I reviewed logs, warnings, annotations, skipped steps, and retained
+      evidence rather than relying only on green status checks.
+- [ ] I added or updated tests for behavior changes.
+- [ ] I updated user and operator documentation where needed.
+- [ ] I recorded notable completed work in `CHANGELOG.md` and removed it from
+      the forward-looking roadmap where applicable.
+- [ ] I did not weaken a security or release control without documenting the
+      threat, rationale, compensating control, owner, and expiry.
+
+## Security and release impact
+
+State whether this changes image contents, runtime behavior, supported scope,
+or release evidence. If it changes a published artifact, identify the required
+version action under `docs/VERSION.md`. List accepted findings or write `None`.

.github/requirements/pre-commit.txt

@@ -0,0 +1,20 @@
+cfgv==3.5.0 \
+    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0
+distlib==0.4.3 \
+    --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b
+filelock==3.32.5 \
+    --hash=sha256:142cd9fa77a872c5e78c62329a0d15278fadc686eb89e760017968961a4fd6b2
+identify==2.6.19 \
+    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a
+nodeenv==1.10.0 \
+    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827
+platformdirs==4.11.7 \
+    --hash=sha256:8a02cb259042c79d1cd0450facc2fe6dc9d303ae7901afbe33bf8ea0b188cef6
+pre-commit==4.6.2 \
+    --hash=sha256:e2dde9a75d3bce11bd3831c26d134df00a2803c1d818be6a0383c3dcda25dc4e
+python-discovery==1.6.0 \
+    --hash=sha256:d4e244cf17b8b29819ed78003d55fbacf86eda23425b075454fff9271b79377a
+PyYAML==6.0.3 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6
+virtualenv==21.7.8 \
+    --hash=sha256:3040eb3cbf5d32b10ffd57d167e6a162237ad82ba7d8cf1400a1efed593d85ac