Repository navigation
Add PostgreSQL 19 support (topn 2.7.1) - #1212
Merged
ibrahim halatci (ihalatci) merged 3 commits intoAug 21, 2026
Merged
Conversation
Bump pkglatest to 2.7.1.citus-1 and append a 2.7.1 entry to postgres-matrix.yml so PostgreSQL 19 is built and published for the deb platforms. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1ed7b58a-0ba9-4f47-a1de-3ee665bae7f2
The build container's fetch_and_build_deb/_rpm scripts write GITHUB_TOKEN into ~/.curlrc as an Authorization header before resolving the upstream release tag. secrets.GH_TOKEN no longer exists, so that header was empty/invalid and api.github.com returned 401 -- breaking a request that succeeds anonymously. The tag lookup then yielded null and the build aborted with "could not determine commit for git tag". Switch to the actions/create-github-app-token@v3 flow already used on all-citus, exporting the installation token as both GH_TOKEN and GITHUB_TOKEN. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1ed7b58a-0ba9-4f47-a1de-3ee665bae7f2
tools v0.8.35 mutates input_output_parameters.output_dir inside
build_packages() and never restores it, so sign_packages() looks under
"{base}/{sub_folder}/{sub_folder}", matches zero packages, and skips
signing silently while the job still reports success. Fixed upstream in
4c862ce, first released in v0.8.36, which all-citus already uses.
Effect here: the produced .deb files regain the per-package dpkg-sig
signature that citus packages already carry. RPM verification was not
affected (packagecloud re-signs RPMs on upload with be79ad6a) and apt
verification was not affected (InRelease is signed by packagecloud), so
this restores defense-in-depth rather than repairing a broken trust path.
The only other runtime change between v0.8.35 and v0.8.36 is an optional
postgres_version argument to build_packages(); it defaults to None and is
not passed by this workflow.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1ed7b58a-0ba9-4f47-a1de-3ee665bae7f2
ibrahim halatci (ihalatci)
enabled auto-merge (squash)
August 20, 2026 17:14
Onur Tirtir (onurctirtir)
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds PostgreSQL 19 to the
postgresql-topnDebian/Ubuntu packaging, bumping to upstreamv2.7.1.Changes
pkgvars—pkglatest2.7.0.citus-1->2.7.1.citus-1postgres-matrix.yml— new entry2.7.1: postgres_versions: [ 11, 12, 13, 14, 15, 16, 17, 18, 19 ](appended last; nightly readsversion_matrix[-1])debian/changelog— new2.7.1.citus-1entry.github/workflows/build-package.yml— migrated off the retiredsecrets.GH_TOKENPAT toactions/create-github-app-token@v3, matchingall-citusNote on 11/12/13 in the matrix
Left as-is deliberately. On deb there is a single
*-allbuild image whoseDEB_PG_SUPPORTED_VERSIONSis"14 15 16 17 18 19", which intersects the matrix down — so 11/12/13 are inert here and cause no build. The RPM path is different (one container per PG version, so every entry is really compiled), which is why the redhat-topn PR does narrow the range.Why the workflow change is in here
scripts/fetch_and_build_debwritesAuthorization: token ${GITHUB_TOKEN}into~/.curlrcand resolves the upstream tag through the GitHub API.secrets.GH_TOKENno longer exists, so that call returned 401 on a request that succeeds anonymously, and the build died withcould not determine commit for git tag v2.7.1.MAIN_BRANCHstill references the dead secret, so this fix has to land here for the branch to build at all.Upstream tag note
v2.7.1was originally signed with a key that GitHub reported asunknown_key, which trips the signature gate infetch_and_build_deb. The tag has been re-signed with the established release key (4FB72F64B64E3FFC) and force-pushed upstream — same commit, same message, GitHub now reportsverification=true, reason=valid. Local clones may needgit fetch --tags --force.Verification
Dry run on the feature branch: all 5 deb platforms green (bullseye, bookworm, trixie, jammy, noble).
Package publishing skipped since current branch is not equal to debian-topnconfirmed in the logs — nothing was uploaded.on: push: branches: ["**"]with--build_type release, andupload_to_package_cloud.pyonly skips whencurrent_branch != MAIN_BRANCH. Merging this PR shipstopn 2.7.1.citus-1tocitusdata/community.