Repository navigation
focal tdigest: bump to 1.4.6 and fix pinned sha256 #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build tdigest (focal) | |
| # Builds tdigest .deb packages for Ubuntu 20.04 (focal) from upstream source | |
| # (PGDG removed focal entirely -- focal-pgdg 404s and the frozen archive mirror | |
| # stops at tdigest 1.4.3), then signs them with debsigs (--sign=maint) using the | |
| # existing packaging key. | |
| # | |
| # Like build-postgis-focal.yml there is no per-major matrix: the tdigest Debian | |
| # packaging is multi-version by design (debian/pgversions + pg_buildext), so one | |
| # source build emits postgresql-<major>-tdigest for every requested major in a | |
| # single pass. That also means no assemble/de-duplicate job is needed -- each | |
| # runtime package is self-contained and produced exactly once. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tdigest_version: | |
| description: "tdigest upstream version to build (e.g. 1.4.6)" | |
| required: true | |
| default: "1.4.6" | |
| pg_versions: | |
| description: "Space-separated PostgreSQL majors (tdigest supports 10+)" | |
| required: false | |
| default: "11 12 13 14 15 16" | |
| tdigest_sha256: | |
| description: "sha256 of tdigest-<version>.tar.gz. Blank = use the pinned default in scripts/build_tdigest_focal (only valid for that version)." | |
| required: false | |
| default: "" | |
| run_tests: | |
| description: "Run upstream regression suite (1=yes, much slower)" | |
| required: false | |
| default: "0" | |
| push: | |
| branches: | |
| - tdigest-focal | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-sign: | |
| name: Build & sign tdigest ${{ github.event.inputs.tdigest_version || '1.4.6' }} (focal) | |
| runs-on: ubuntu-latest | |
| env: | |
| PACKAGING_SECRET_KEY: ${{ secrets.PACKAGING_SECRET_KEY }} | |
| PACKAGING_PASSPHRASE: ${{ secrets.PACKAGING_PASSPHRASE }} | |
| TDIGEST_VERSION: ${{ github.event.inputs.tdigest_version || '1.4.6' }} | |
| PG_VERSIONS: ${{ github.event.inputs.pg_versions || '11 12 13 14 15 16' }} | |
| TDIGEST_SHA256: ${{ github.event.inputs.tdigest_sha256 || '' }} | |
| RUN_TESTS: ${{ github.event.inputs.run_tests || '0' }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v4 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER_NAME }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| - name: Build focal tdigest builder image | |
| run: | | |
| docker build -t focal-tdigest-builder \ | |
| -f dockerfiles/focal-tdigest-builder/Dockerfile . | |
| - name: Build tdigest packages | |
| run: | | |
| mkdir -p packages | |
| docker run --rm \ | |
| -e TDIGEST_VERSION="${TDIGEST_VERSION}" \ | |
| -e PG_VERSIONS="${PG_VERSIONS}" \ | |
| -e TDIGEST_SHA256="${TDIGEST_SHA256}" \ | |
| -e RUN_TESTS="${RUN_TESTS}" \ | |
| -v "${PWD}/packages:/packages" \ | |
| focal-tdigest-builder | |
| echo "Built packages:" | |
| ls -1 packages/focal/tdigest/*.deb | |
| - name: Sign packages (debsigs --sign=maint) | |
| # Use the prebuilt, deployed debsigner image (the one all Citus signing | |
| # uses). Its entrypoint signs exactly "/packages/*/*.deb" (one dir level | |
| # deep), so mount the parent of the output dir: with | |
| # "${PWD}/packages/focal:/packages" the debs land at | |
| # /packages/tdigest/*.deb, which is what that glob expects. | |
| run: | | |
| if [ -z "${PACKAGING_SECRET_KEY}" ] || [ -z "${PACKAGING_PASSPHRASE}" ]; then | |
| echo "::error::PACKAGING_SECRET_KEY / PACKAGING_PASSPHRASE secrets are not set" >&2 | |
| exit 1 | |
| fi | |
| printf '%s' "${PACKAGING_PASSPHRASE}" | docker run --rm -i \ | |
| -e PACKAGING_SECRET_KEY \ | |
| -e PACKAGING_PASSPHRASE \ | |
| -v "${PWD}/packages/focal:/packages" \ | |
| citusdata/packaging:debsigner | |
| - name: Verify signatures are embedded | |
| run: | | |
| rc=0 | |
| for deb in packages/focal/tdigest/*.deb; do | |
| if ar t "$deb" | grep -q '^_gpgmaint$'; then | |
| echo "signed: $deb" | |
| else | |
| echo "::error::missing _gpgmaint signature in $deb" >&2 | |
| rc=1 | |
| fi | |
| done | |
| exit $rc | |
| - name: Verify the set is self-contained | |
| # Every runtime must ship its own extension control file and SQL, so a | |
| # package can never be paired with another version's SQL and there is no | |
| # separate -scripts package to depend on. | |
| run: | | |
| rc=0 | |
| for v in ${PG_VERSIONS}; do | |
| deb="$(ls packages/focal/tdigest/postgresql-${v}-tdigest_*.deb)" | |
| if ! dpkg-deb -c "$deb" | grep -q 'extension/tdigest\.control'; then | |
| echo "::error::PG${v} runtime ships no extension control file" >&2; rc=1 | |
| fi | |
| if ! dpkg-deb -c "$deb" | grep -q "extension/tdigest--${TDIGEST_VERSION}\.sql"; then | |
| echo "::error::PG${v} runtime ships no tdigest--${TDIGEST_VERSION}.sql" >&2; rc=1 | |
| fi | |
| done | |
| exit $rc | |
| - name: Upload signed packages | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: tdigest-focal-deb | |
| path: | | |
| packages/focal/tdigest/*.deb | |
| packages/focal/tdigest/*.changes | |
| packages/focal/tdigest/*.buildinfo | |
| if-no-files-found: error | |
| install-smoke-test: | |
| needs: build-and-sign | |
| name: Install smoke test (focal) | |
| runs-on: ubuntu-latest | |
| env: | |
| PG_VERSIONS: ${{ github.event.inputs.pg_versions || '11 12 13 14 15 16' }} | |
| TDIGEST_VERSION: ${{ github.event.inputs.tdigest_version || '1.4.6' }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Download built packages | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: tdigest-focal-deb | |
| path: debs | |
| - name: Install and verify in a clean focal container | |
| # The jobs above only prove the packages exist, are signed and are | |
| # self-contained -- not that the extension can actually be created. This | |
| # installs the set into a stock ubuntu:20.04 twice: clean, and over | |
| # PGDG's tdigest 1.4.3 (the in-place upgrade path), then runs | |
| # CREATE EXTENSION / ALTER EXTENSION UPDATE on every major. | |
| run: | | |
| docker run --rm \ | |
| -v "${PWD}/debs:/debs:ro" \ | |
| -v "${PWD}/scripts/smoke_test_focal_tdigest_debs:/usr/local/bin/smoke_test_focal_tdigest_debs:ro" \ | |
| -e DEBS_DIR=/debs \ | |
| -e PG_VERSIONS="${PG_VERSIONS}" \ | |
| -e EXPECTED_TDIGEST="${TDIGEST_VERSION}" \ | |
| ubuntu:20.04 \ | |
| /usr/local/bin/smoke_test_focal_tdigest_debs |