feat(image): PostgreSQL 18 + PostGIS 3.6 + PGroonga image

.dockerignore

@@ -0,0 +1,6 @@
+# Only Dockerfile, initdb/ and scripts/ reach the image.
+.git
+.github
+test
+Makefile
+*.md

.github/workflows/build.yml

@@ -0,0 +1,46 @@
+name: Build
+
+# The only place the image is actually built before a release: build it and
+# run the smoke test, without pushing. Path-filtered to conserve Actions quota.
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - .dockerignore
+      - initdb/**
+      - scripts/**
+      - test/**
+      - .github/workflows/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v4
+        # Builder state is removed at job end; no remote cache is exported.
+        with:
+          cache-binary: false
+          keep-state: false
+          cleanup: true
+
+      - name: Build image
+        uses: docker/build-push-action@v7
+        env:
+          # Build records are persistent Actions artifacts.
+          DOCKER_BUILD_RECORD_UPLOAD: 'false'
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          tags: rawback-db:ci
+
+      - name: Smoke test
+        run: test/smoke.sh rawback-db:ci

.github/workflows/release.yml

@@ -0,0 +1,106 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+  packages: write
+
+jobs:
+  release-please:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - name: Release Please
+        id: release
+        uses: googleapis/release-please-action@v5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  docker:
+    permissions:
+      contents: read
+      packages: write
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      # The Dockerfile ARGs are the single source of truth for the
+      # <pg major>-<postgis minor> tag.
+      - name: Read image versions
+        id: versions
+        run: |
+          pg_major="$(sed -n 's/^ARG PG_MAJOR=//p' Dockerfile)"
+          postgis="$(sed -n 's/^ARG POSTGIS_VERSION=//p' Dockerfile)"
+          if [ -z "$pg_major" ] || [ -z "$postgis" ]; then
+            echo "::error::Could not read PG_MAJOR / POSTGIS_VERSION from the Dockerfile"
+            exit 1
+          fi
+          echo "pg_major=$pg_major" >> "$GITHUB_OUTPUT"
+          echo "postgis=$postgis" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v4
+        # Builder state is removed at job end; no remote cache is exported.
+        with:
+          cache-binary: false
+          keep-state: false
+          cleanup: true
+
+      - name: Build image
+        uses: docker/build-push-action@v7
+        env:
+          # Build records are persistent Actions artifacts.
+          DOCKER_BUILD_RECORD_UPLOAD: 'false'
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          tags: rawback-db:release
+
+      # Nothing is pushed unless the exact layers about to be published pass.
+      - name: Smoke test
+        run: test/smoke.sh rawback-db:release
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ghcr.io/rawback-app/db
+          tags: |
+            type=semver,pattern={{version}},value=${{ needs.release-please.outputs.tag_name }}
+            type=raw,value=${{ steps.versions.outputs.pg_major }}-${{ steps.versions.outputs.postgis }}
+            type=raw,value=${{ steps.versions.outputs.pg_major }}
+            type=raw,value=latest
+
+      # Same builder, same context: every layer comes from the cache of the
+      # build the smoke test ran against, so this pushes what was tested.
+      - name: Build and push Docker image to GHCR
+        uses: docker/build-push-action@v7
+        env:
+          DOCKER_BUILD_RECORD_UPLOAD: 'false'
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -1,149 +1,8 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
-
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-*.lcov
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directories
-node_modules/
-jspm_packages/
-
-# Snowpack dependency directory (https://snowpack.dev/)
-web_modules/
-
-# TypeScript cache
-*.tsbuildinfo
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-# Optional stylelint cache
-.stylelintcache
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variable files
+# Local data directories and environment files
+data/
 .env
 .env.*
 !.env.example
 
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
-# Next.js build output
-.next
-out
-
-# Nuxt.js build / generate output
-.nuxt
-dist
-.output
-
-# Gatsby files
-.cache/
-# Comment in the public line in if your project uses Gatsby and not Next.js
-# https://nextjs.org/blog/next-9-1#public-directory-support
-# public
-
-# vuepress build output
-.vuepress/dist
-
-# vuepress v2.x temp directory
-.temp
-
-# Sveltekit cache directory
-.svelte-kit/
-
-# vitepress build output
-**/.vitepress/dist
-
-# vitepress cache directory
-**/.vitepress/cache
-
-# Docusaurus cache and generated files
-.docusaurus
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
-
-# Firebase cache directory
-.firebase/
-
-# TernJS port file
-.tern-port
-
-# Stores Visual Studio Code versions used for testing Visual Studio Code extensions
-.vscode-test
-
-# pnpm
-.pnpm-store
-
-# yarn v3
-.pnp.*
-.yarn/*
-!.yarn/patches
-!.yarn/plugins
-!.yarn/releases
-!.yarn/sdks
-!.yarn/versions
-
-# Vite files
-vite.config.js.timestamp-*
-vite.config.ts.timestamp-*
-.vite/
-
-# Astro generated types
-.astro/
-
-# Turbo Repo
-.turbo
+*.log
+.DS_Store

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}