Add .deb packaging workflow with GitHub Releases#57
Add .deb packaging workflow with GitHub Releases#57iskakaushik wants to merge 2 commits intomainfrom
Conversation
Build .deb packages for PG 16-18 on Ubuntu 22.04 (amd64 + arm64) and upload them to GitHub Releases for public unauthenticated downloads. - main pushes → rolling `dev` pre-release - customer-* pushes → rolling `customer-<name>` pre-release - v* tags → attached to the version release
There was a problem hiding this comment.
Pull request overview
Adds automated Debian packaging to the project CI/CD so .deb artifacts for PG 16–18 (amd64/arm64) can be built and published to GitHub Releases for easy installation.
Changes:
- Introduces an
nfpmconfiguration (nfpm.yml) describing the Debian package metadata and installed file layout. - Adds a GitHub Actions workflow (
.github/workflows/deb.yml) to build.debpackages across a PG/arch matrix and upload them to rolling prereleases (dev,customer-*) and versioned releases (v*tags).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
nfpm.yml |
Defines package metadata, dependencies, and which staged install files go into the .deb. |
.github/workflows/deb.yml |
Builds, packages, and uploads .deb artifacts; manages release tags for dev/customer/tag flows. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -0,0 +1,25 @@ | |||
| name: pg-stat-ch | |||
There was a problem hiding this comment.
All three builds (PG16/17/18) produce a .deb with the same Debian package name (name: pg-stat-ch). Debian packages are not co-installable when Package is identical, so installing the PG17 build would replace/remove the PG16 files (and vice versa). Consider including ${PG_MAJOR} in the package name (e.g., postgresql-${PG_MAJOR}-pg-stat-ch or pg-stat-ch-pg${PG_MAJOR}), or otherwise making packages explicitly co-installable.
| name: pg-stat-ch | |
| name: postgresql-${PG_MAJOR}-pg-stat-ch |
| sudo apt-get update | ||
| sudo apt-get install -y curl ca-certificates gnupg | ||
| curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/apt.postgresql.org.gpg >/dev/null | ||
| echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list |
There was a problem hiding this comment.
The APT source is configured using plain HTTP (deb http://apt.postgresql.org/...). This allows repository metadata/package downloads to be intercepted/modified in transit. Switch the repository URL to HTTPS (matching the key download) to avoid MITM risk.
| echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list | |
| echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list |
| # Create the release if it doesn't exist yet. | ||
| gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \ | ||
| gh release create "$TAG" -R "$GITHUB_REPOSITORY" \ | ||
| --prerelease \ | ||
| --title "$TAG" \ | ||
| --notes "Rolling pre-release for \`$TAG\`. Updated on every push." | ||
|
|
||
| # Upload .deb files, replacing any existing ones. | ||
| gh release upload "$TAG" debs/*.deb -R "$GITHUB_REPOSITORY" --clobber | ||
| else | ||
| # For version tags, the release is created by release.yml. | ||
| # Wait briefly for it to exist, then attach .debs. | ||
| for i in 1 2 3 4 5; do | ||
| gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 && break | ||
| echo "Waiting for release $TAG to be created..." | ||
| sleep 10 | ||
| done | ||
| gh release upload "$TAG" debs/*.deb -R "$GITHUB_REPOSITORY" --clobber | ||
| fi |
There was a problem hiding this comment.
For tag builds, this job assumes the release already exists (created by release.yml) and only waits up to ~50 seconds before attempting gh release upload. release.yml creates the release only after its own build matrix completes, which can take many minutes, so this workflow can fail spuriously on tags. Consider creating the release here if it doesn’t exist (even for version tags), or waiting/polling until it exists with a longer timeout and failing explicitly if it never appears.
| # Create the release if it doesn't exist yet. | |
| gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \ | |
| gh release create "$TAG" -R "$GITHUB_REPOSITORY" \ | |
| --prerelease \ | |
| --title "$TAG" \ | |
| --notes "Rolling pre-release for \`$TAG\`. Updated on every push." | |
| # Upload .deb files, replacing any existing ones. | |
| gh release upload "$TAG" debs/*.deb -R "$GITHUB_REPOSITORY" --clobber | |
| else | |
| # For version tags, the release is created by release.yml. | |
| # Wait briefly for it to exist, then attach .debs. | |
| for i in 1 2 3 4 5; do | |
| gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 && break | |
| echo "Waiting for release $TAG to be created..." | |
| sleep 10 | |
| done | |
| gh release upload "$TAG" debs/*.deb -R "$GITHUB_REPOSITORY" --clobber | |
| fi | |
| # Create the pre-release if it doesn't exist yet. | |
| gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \ | |
| gh release create "$TAG" -R "$GITHUB_REPOSITORY" \ | |
| --prerelease \ | |
| --title "$TAG" \ | |
| --notes "Rolling pre-release for \`$TAG\`. Updated on every push." | |
| else | |
| # For version tags, ensure the release exists before uploading assets. | |
| gh release view "$TAG" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \ | |
| gh release create "$TAG" -R "$GITHUB_REPOSITORY" \ | |
| --title "$TAG" \ | |
| --notes "Release $TAG" | |
| fi | |
| # Upload .deb files, replacing any existing ones. | |
| gh release upload "$TAG" debs/*.deb -R "$GITHUB_REPOSITORY" --clobber |
- Use HTTPS for PostgreSQL APT repo to prevent MITM risk - Include PG major version in package name for co-installability - Create release if missing instead of fragile wait loop
Summary
.github/workflows/deb.yml— builds .deb packages for PG 16-18 on Ubuntu 22.04 (amd64 + arm64)nfpm.yml— declarative package config for nfpmmain→ rollingdevpre-releasecustomer-*→ rollingcustomer-<name>pre-releasev*tags → attached to the version releaseDownload URLs
Test plan
devpre-release is created with .deb assets on merge to main