[AnnatarHe]

Summary

This sets up the repo as the image builder for one shared Postgres image, ghcr.io/rawback-app/db: PostgreSQL 18, PostGIS 3.6 and PGroonga 4.0 on Debian trixie, built for linux/amd64.

• Drop-in for postgis/postgis:18-3.6. It uses the same base image (postgres:18-trixie), the same PGDATA and the same template_postgis. The current server database can switch images on its existing volume, with no dump and restore.
• Why 18 and not 19? PostgreSQL 19 is still in beta/RC, PGroonga 4.0.9 has no 19 support, and the production data directory is version 18. PG_MAJOR is a build arg, so moving to 19 later is a one-line change plus a data migration.
• Dockerfile. PostGIS comes from apt.postgresql.org (already configured by the base image), and PGroonga (postgresql-18-pgdg-pgroonga) from Groonga's own apt repo. The PostGIS and PGroonga minor versions are checked after install. A new minor version fails the build instead of shipping by itself; patch releases are picked up automatically.
• First start (initdb/10-rawback-extensions.sh) creates template_postgis and the postgis, pg_trgm and pgroonga extensions in it and in POSTGRES_DB.
• update-extensions.sh (in the image's $PATH) updates the extensions' SQL in every database after an image upgrade.
• Health check: pg_isready -h 127.0.0.1. It uses TCP, so it stays unhealthy while the init-only server is running.
• Smoke test (test/smoke.sh, make test). It checks:
  • that each extension and template_postgis exist;
  • a ST_DWithin query on geography points;
  • the pg_trgm <% operator;
  • PGroonga search in Japanese, Chinese, Korean and English through its index;
  • the health check command and update-extensions.sh.
• CI:
  • build.yml builds the image and runs the smoke test on PRs that touch it. It doesn't push.
  • release.yml runs release-please. When a release is created, it builds the image, smoke-tests that exact build, then pushes <version>, 18-3.6, 18 and latest to GHCR.
  • Both follow the server's release workflow conventions: Blacksmith runners and the same action versions.
• Docs: README covers tags, a quick start with docker run and a podman quadlet, PGroonga usage, migrating from postgis/postgis, upgrades and GHCR access. AGENTS.md (with CLAUDE.md as a symlink) covers the rules that must hold. The Node .gitignore template is replaced.

Testing

• This sandbox can't reach apt.postgresql.org, deb.debian.org or packages.groonga.org (403). The image itself can't build here, so this PR's Build workflow is the real build check. Its job summary lists the versions it resolved.
• Locally, docker build --check reports no warnings, and shellcheck and bash -n pass on every script.
• I also ran the init script, update-extensions.sh, the health check and test/smoke.sh against a stand-in image built from postgis/postgis:18-3.6, with the PGroonga parts removed:
  • The smoke test passed on PostgreSQL 18.6 and PostGIS 3.6.4.
  • A deliberately broken assertion made it exit non-zero and print the container logs.
  • The container reported healthy after about 8 seconds.

Follow-ups

• rawback-app/server gets a companion PR that points its docs and testing workflow at ghcr.io/rawback-app/db:18-3.6. Merge it only after this repo's first release has been published.
• If the package ends up private, give the server repo read access in the package settings (Manage Actions access).

🤖 Generated with Claude Code

https://claude.ai/code/session_018F1vLVP6KU7yzZ23Eaf8H2

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[AnnatarHe]

@claude review