PostgreSQL Container Image Build Pipeline#

The cloudnative-pg/postgres-containers repository contains the automated build pipeline for CloudNativePG's PostgreSQL operand images. It produces multi-arch (linux/amd64, linux/arm64) Docker images across multiple PostgreSQL major versions and Debian distributions, publishing them to ghcr.io/cloudnative-pg/postgresql.

Image Matrix#

Builds are defined in docker-bake.hcl, which drives Docker Bake. The matrix cross-products:

• PostgreSQL versions — currently 14–18 stable plus any preview (e.g., 19~beta1) not yet promoted to stable 1
• Debian bases — trixie-slim, bookworm-slim, bullseye-slim, each pinned by SHA256 digest 2
• Image types — minimal, standard (adds pgaudit, pgvector, pg-failover-slots, Barman), system 3

Every image receives OCI provenance and SBOM attestations, and is tagged with both a rolling <major>-<type>-<distro> tag and a timestamped <version>-<YYYYMMDDhhmm>-<type>-<distro> tag 4.

Workflow Architecture#

Four GitHub Actions workflows orchestrate the pipeline:

The weekly cadence is intentionally staggered: version update runs at midnight, build bake runs eight hours later 5 6.

Renovate-Based Base Image Updates#

renovate.json configures Renovate Bot to track and auto-merge base image digest updates. Key behaviors:

• Digest pinning — all Debian base images in docker-bake.hcl are pinned by SHA256 digest via inline // renovate: comments 2; Renovate detects upstream digest changes using a custom regex manager 7
• Grouping — all Debian base image updates are grouped into a single PR 8
• Auto-merge — minor and digest updates are automatically merged without review 9
• Barman — the Barman Python package version is also tracked via a datasource=pypi Renovate comment 10

⚠️ Known lag risk: Security packages in a new Debian release (e.g., trixie 13.5) are only picked up after Renovate detects and merges the new digest. The weekly build uses whatever digest is pinned at run time. If Renovate's polling misses the upstream release window before the Monday build, images ship with stale packages until the next cycle. This has caused critical CVEs to persist in published images. 11

Build & Promotion (bake_targets.yml)#

For each PostgreSQL major version, bake_targets.yml runs:

1. Build — Docker Bake with environment=testing pushes to the testing registry
2. Security scan — .github/actions/security-scans runs Dockle and Snyk; Snyk uses continue-on-error: true so vulnerabilities are reported to GitHub Code Scanning without blocking promotion 12
3. Sign — Cosign signs images with keyless signing
4. Promote — .github/actions/copy-images copies from testing to production via Skopeo, then re-signs, when triggered on main in production/schedule mode

The bake.yml matrix uses fail-fast: false 13, so a failure in one PostgreSQL version does not cancel other versions.

Catalog Generation#

After a successful production bake, bake.yml fires a repository_dispatch event 14. catalogs.yml then:

1. Checks out both postgres-containers and cloudnative-pg/artifacts
2. Runs .github/actions/generate-catalogs, a Python action (catalogs_generator.py) that queries ghcr.io/cloudnative-pg/postgresql, applies a regex (\d+)(?:\.\d+|beta\d+|rc\d+|alpha\d+)-(\d{12}) to find timestamped tags, picks the latest per major version, and emits one ClusterImageCatalog YAML per (distribution × image-type) 15
3. Signs each catalog YAML with Cosign 16
4. Commits the results to cloudnative-pg/artifacts/image-catalogs/ 17

Monitoring & Failure Alerting#

There is no dedicated alerting workflow. The pipeline relies entirely on:

• GitHub's native notifications for workflow failures
• GitHub Code Scanning for Snyk vulnerability reports
• Community bug reports for catching gaps (e.g., builds silently succeeding with stale base image digests — see issue #10751)

Notably, even partial bake failures (one version failing) block catalog updates because the Catalogs job depends on the full Bake job completing 18. This means a single version's build failure suppresses catalog refreshes for all successfully built versions.