feat(ci): auto-build DocumentDB images on new upstream release

.github/dockerfiles/Dockerfile_extension

@@ -6,35 +6,50 @@
 # Follows the pattern from:
 #   https://github.com/cloudnative-pg/postgres-extensions-containers
 #
+# The DocumentDB extension is installed from the official DocumentDB APT
+# repository (https://documentdb.io/deb). The `postgresql-${PG_MAJOR}-documentdb`
+# meta-package pulls in its own runtime dependencies (Citus, RUM, libbson,
+# PCRE2, pgvector, PostGIS, ...), so no extra extension packages are installed
+# explicitly here.
+#
 # Usage:
 #   docker build \
 #     --build-arg PG_MAJOR=18 \
-#     --build-arg DEB_PACKAGE_REL_PATH=packages/documentdb_0.110-0_arm64.deb \
+#     --build-arg DOCUMENTDB_APT_VERSION=0.110.0 \
 #     -t documentdb-extension:latest \
 #     -f Dockerfile_extension .
 
 ARG BASE=ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie
 FROM ${BASE} AS builder
 
 ARG PG_MAJOR=18
-ARG DEB_PACKAGE_REL_PATH
+# Full Debian package version of postgresql-${PG_MAJOR}-documentdb to install
+# from the official DocumentDB APT repository. Pin this per build for
+# reproducibility. If empty, the latest version in the 'stable' channel is used.
+ARG DOCUMENTDB_APT_VERSION
 
 USER 0
 
 RUN set -eux && \
     # Snapshot base image system libraries for later diffing
     ldconfig -p | awk '{print $NF}' | grep '^/' | sort | uniq > /tmp/base-image-libs.out && \
-    # Install pgdg extension packages
+    # Tools needed to add the official DocumentDB APT repository
     apt-get update && \
-    apt-get install -y --no-install-recommends \
-        postgresql-${PG_MAJOR}-cron \
-        postgresql-${PG_MAJOR}-pgvector \
-        postgresql-${PG_MAJOR}-postgis-3
-
-# Install the DocumentDB extension from a pre-built .deb
-COPY ${DEB_PACKAGE_REL_PATH} /tmp/documentdb.deb
-RUN dpkg -i /tmp/documentdb.deb && \
-    rm -f /tmp/documentdb.deb
+    apt-get install -y --no-install-recommends ca-certificates curl gnupg && \
+    # Install the official DocumentDB signing key and APT source
+    curl -fsSL https://documentdb.io/documentdb-archive-keyring.gpg \
+        -o /usr/share/keyrings/documentdb-archive-keyring.gpg && \
+    echo "deb [signed-by=/usr/share/keyrings/documentdb-archive-keyring.gpg] https://documentdb.io/deb stable main" \
+        > /etc/apt/sources.list.d/documentdb.list && \
+    apt-get update && \
+    # Install the DocumentDB extension meta-package from the official repo.
+    if [ -n "${DOCUMENTDB_APT_VERSION}" ]; then \
+        apt-get install -y --no-install-recommends \
+            "postgresql-${PG_MAJOR}-documentdb=${DOCUMENTDB_APT_VERSION}"; \
+    else \
+        apt-get install -y --no-install-recommends \
+            "postgresql-${PG_MAJOR}-documentdb"; \
+    fi
 
 # Gather system library dependencies not present in the CNPG base image
 RUN set -eux && \

.github/workflows/build_documentdb_images.yml

@@ -1,7 +1,8 @@
 name: RELEASE - Build DocumentDB Candidate Images
 
 # Builds documentdb extension and gateway images from public DocumentDB release artifacts.
-# - documentdb image: public deb13 PostgreSQL 18 extension package
+# - documentdb image: official DocumentDB extension package from the APT repo
+#   (https://documentdb.io/deb), installed as postgresql-18-documentdb
 # - gateway image: public documentdb-local image payload
 # These images follow the DATABASE version track (documentDbVersion in values.yaml).
 # For operator/sidecar images, see build_operator_images.yml.
@@ -13,17 +14,34 @@ on:
         description: 'Released DocumentDB version to package (for example 0.110.0)'
         required: false
         default: '0.110.0'
-      documentdb_extension_github_repo:
-        description: 'GitHub owner/repo for DocumentDB extension releases'
+      documentdb_apt_version:
+        description: 'Debian package version of postgresql-18-documentdb to pin (e.g. 0.110.0). Leave empty to derive from version.'
         required: false
-        default: 'documentdb/documentdb'
+        default: ''
       documentdb_gateway_image_repo:
         description: 'Container image repo for gateway source (without tag)'
         required: false
         default: 'ghcr.io/documentdb/documentdb/documentdb-local'
 
-  repository_dispatch:
-    types: [documentdb-release]
+  workflow_call:
+    inputs:
+      version:
+        description: 'Released DocumentDB version to package (for example 0.110.0)'
+        required: false
+        type: string
+        default: '0.110.0'
+      documentdb_apt_version:
+        description: 'Debian package version of postgresql-18-documentdb to pin. Leave empty to derive from version.'
+        required: false
+        type: string
+        default: ''
+    outputs:
+      documentdb_version:
+        description: 'Resolved DocumentDB version (dotted semver, e.g. 0.110.0)'
+        value: ${{ jobs.resolve-public-artifacts.outputs.documentdb_version }}
+      image_tag:
+        description: 'Candidate image tag produced by this build'
+        value: ${{ jobs.resolve-public-artifacts.outputs.image_tag }}
 
 permissions:
   packages: write
@@ -33,10 +51,10 @@ permissions:
 env:
 
   DEFAULT_DOCUMENTDB_VERSION: '0.110.0'
-  DOCUMENTDB_EXTENSION_GITHUB_REPO: ${{ github.event.inputs.documentdb_extension_github_repo || 'documentdb/documentdb' }}
+  DOCUMENTDB_APT_REPO_URL: https://documentdb.io/deb
+  DOCUMENTDB_APT_KEYRING_URL: https://documentdb.io/documentdb-archive-keyring.gpg
   DOCUMENTDB_GATEWAY_IMAGE_REPO: ${{ github.event.inputs.documentdb_gateway_image_repo || 'ghcr.io/documentdb/documentdb/documentdb-local' }}
 
-
 jobs:
   # ---------------------------------------------------------------------------
   # Resolve public release artifacts
@@ -47,14 +65,15 @@ jobs:
     outputs:
       documentdb_version: ${{ steps.version.outputs.documentdb_version }}
       documentdb_version_dash: ${{ steps.version.outputs.documentdb_version_dash }}
+      documentdb_apt_version: ${{ steps.version.outputs.documentdb_apt_version }}
       image_tag: ${{ steps.version.outputs.image_tag }}
       gateway_source_image: ${{ steps.version.outputs.gateway_source_image }}
     steps:
     - name: Resolve released DocumentDB version
       id: version
       run: |
         set -euo pipefail
-        RAW_VERSION="${{ github.event.inputs.version || github.event.client_payload.version || env.DEFAULT_DOCUMENTDB_VERSION }}"
+        RAW_VERSION="${{ inputs.version || env.DEFAULT_DOCUMENTDB_VERSION }}"
         if [[ "$RAW_VERSION" =~ ^[0-9]+\.[0-9]+-[0-9]+$ ]]; then
           VERSION="${RAW_VERSION/-/.}"
         else
@@ -65,28 +84,31 @@ jobs:
           exit 1
         fi
         VERSION_DASH=$(echo "$VERSION" | sed -E 's/^([0-9]+\.[0-9]+)\.([0-9]+)$/\1-\2/')
+        # APT package version to pin. Defaults to the dotted semver version.
+        APT_VERSION="${{ inputs.documentdb_apt_version || '' }}"
+        if [[ -z "$APT_VERSION" ]]; then
+          APT_VERSION="$VERSION"
+        fi
         SHORT_SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
         IMAGE_TAG="${VERSION}-build-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${SHORT_SHA}"
         GATEWAY_SOURCE_IMAGE="${{ env.DOCUMENTDB_GATEWAY_IMAGE_REPO }}:pg17-${VERSION}"
         echo "documentdb_version=$VERSION" >> $GITHUB_OUTPUT
         echo "documentdb_version_dash=$VERSION_DASH" >> $GITHUB_OUTPUT
+        echo "documentdb_apt_version=$APT_VERSION" >> $GITHUB_OUTPUT
         echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
         echo "gateway_source_image=$GATEWAY_SOURCE_IMAGE" >> $GITHUB_OUTPUT
         echo "DocumentDB version: $VERSION"
-        echo "Release tag: v$VERSION_DASH"
+        echo "APT package version: $APT_VERSION"
         echo "Candidate image tag: $IMAGE_TAG"
         echo "Gateway source image: $GATEWAY_SOURCE_IMAGE"
 
-    - name: Verify public extension release assets
-      env:
-        VERSION_DASH: ${{ steps.version.outputs.documentdb_version_dash }}
+    - name: Verify official DocumentDB APT repository is reachable
       run: |
         set -euo pipefail
-        for ARCH in amd64 arm64; do
-          ASSET_URL="https://github.com/${{ env.DOCUMENTDB_EXTENSION_GITHUB_REPO }}/releases/download/v${VERSION_DASH}/deb13-postgresql-18-documentdb_${VERSION_DASH}_${ARCH}.deb"
-          echo "Checking $ASSET_URL"
-          curl -fsI -L "$ASSET_URL" >/dev/null
-        done
+        echo "Checking keyring: ${{ env.DOCUMENTDB_APT_KEYRING_URL }}"
+        curl -fsI -L "${{ env.DOCUMENTDB_APT_KEYRING_URL }}" >/dev/null
+        echo "Checking APT repo: ${{ env.DOCUMENTDB_APT_REPO_URL }}"
+        curl -fsI -L "${{ env.DOCUMENTDB_APT_REPO_URL }}/dists/stable/Release" >/dev/null
 
     - name: Verify public gateway source image
       env:
@@ -123,16 +145,6 @@ jobs:
       with:
         persist-credentials: false
 
-    - name: Download public extension package
-      if: matrix.image.name == 'documentdb'
-      run: |
-        set -euo pipefail
-        mkdir -p packages
-        DEB_FILE="deb13-postgresql-18-documentdb_${{ needs.resolve-public-artifacts.outputs.documentdb_version_dash }}_${{ matrix.arch }}.deb"
-        ASSET_URL="https://github.com/${{ env.DOCUMENTDB_EXTENSION_GITHUB_REPO }}/releases/download/v${{ needs.resolve-public-artifacts.outputs.documentdb_version_dash }}/${DEB_FILE}"
-        curl -fsSL -o "packages/${DEB_FILE}" -L "$ASSET_URL"
-        ls -lh packages/
-
     - name: Login to GHCR
       run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
@@ -146,9 +158,9 @@ jobs:
 
         case "${{ matrix.image.name }}" in
           documentdb)
-            DEB_FILE="deb13-postgresql-18-documentdb_${{ needs.resolve-public-artifacts.outputs.documentdb_version_dash }}_${{ matrix.arch }}.deb"
-            echo "Using deb: $DEB_FILE"
-            BUILD_ARGS="--build-arg PG_MAJOR=18 --build-arg DEB_PACKAGE_REL_PATH=packages/$DEB_FILE"
+            APT_VERSION="${{ needs.resolve-public-artifacts.outputs.documentdb_apt_version }}"
+            echo "Installing postgresql-18-documentdb=$APT_VERSION from official APT repo"
+            BUILD_ARGS="--build-arg PG_MAJOR=18 --build-arg DOCUMENTDB_APT_VERSION=$APT_VERSION"
             ;;
           gateway)
             echo "Using public gateway source image: ${{ needs.resolve-public-artifacts.outputs.gateway_source_image }}"
@@ -199,7 +211,7 @@ jobs:
         DIGEST=$(docker buildx imagetools inspect ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ env.IMAGE_TAG }} \
           | awk '/^Digest:/ { print $2 }')
         cosign verify \
-          --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/build_documentdb_images.yml@${{ github.ref }}" \
+          --certificate-identity-regexp "^https://github\.com/${{ github.repository }}/\.github/workflows/build_documentdb_images\.yml@" \
           --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
           ghcr.io/${{ github.repository }}/${{ matrix.image }}@${DIGEST}
 
@@ -218,7 +230,7 @@ jobs:
         echo "" >> $GITHUB_STEP_SUMMARY
         echo "- **DocumentDB Version**: \`${{ needs.resolve-public-artifacts.outputs.documentdb_version }}\`" >> $GITHUB_STEP_SUMMARY
         echo "- **Candidate Image Tag**: \`${{ needs.resolve-public-artifacts.outputs.image_tag }}\`" >> $GITHUB_STEP_SUMMARY
-        echo "- **Extension Package Source**: \`https://github.com/${{ env.DOCUMENTDB_EXTENSION_GITHUB_REPO }}/releases/download/v${{ needs.resolve-public-artifacts.outputs.documentdb_version_dash }}/deb13-postgresql-18-documentdb_${{ needs.resolve-public-artifacts.outputs.documentdb_version_dash }}_{amd64,arm64}.deb\`" >> $GITHUB_STEP_SUMMARY
+        echo "- **Extension Package Source**: \`${{ env.DOCUMENTDB_APT_REPO_URL }}\` (postgresql-18-documentdb=${{ needs.resolve-public-artifacts.outputs.documentdb_apt_version }})" >> $GITHUB_STEP_SUMMARY
         echo "- **Gateway Source Image**: \`${{ needs.resolve-public-artifacts.outputs.gateway_source_image }}\`" >> $GITHUB_STEP_SUMMARY
         echo "- **Images**: documentdb, gateway" >> $GITHUB_STEP_SUMMARY
         echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/release_documentdb_images.yml

@@ -21,6 +21,22 @@ on:
         default: true
         type: boolean
 
+  workflow_call:
+    inputs:
+      candidate_version:
+        description: 'Database candidate tag to promote (e.g., 0.111.0-build-123456789-1-deadbee)'
+        required: true
+        type: string
+      version:
+        description: 'Database image release version (e.g., 0.111.0)'
+        required: true
+        type: string
+      update_defaults:
+        description: 'Create PR to update default image versions in code'
+        required: false
+        default: true
+        type: boolean
+
 permissions:
   contents: write
   packages: write