Skip to content

Commit 79b9d75

Browse files
staaldraadstaaldraad
authored
Merge branch 'develop' into etienne/sec-197-use-nonewpriviliges-for-postgres
2 parents 510474a + 645db72 commit 79b9d75

File tree

82 files changed

+9388
-1610
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

82 files changed

+9388
-1610
lines changed

‎.github/workflows/ami-release-nix.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ on:
1111
- 'ansible/vars.yml'
1212
workflow_dispatch:
1313

14+
permissions:
15+
contents: write
16+
id-token: write
17+
1418
jobs:
1519
prepare:
1620
runs-on: ubuntu-latest
@@ -41,10 +45,6 @@ jobs:
4145
mcpu: neoverse-n1
4246
runs-on: ${{ matrix.runner }}
4347
timeout-minutes: 150
44-
permissions:
45-
contents: write
46-
packages: write
47-
id-token: write
4848

4949
steps:
5050
- name: Checkout Repo
@@ -56,7 +56,7 @@ jobs:
5656
if: ${{ github.event_name == 'workflow_dispatch' }}
5757
run: |
5858
SUFFIX=$(sudo nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
59-
if [[ -z $SUFFIX ]] ; then
59+
if [[ -z "$SUFFIX" ]] ; then
6060
echo "Version must include non-numeric characters if built manually."
6161
exit 1
6262
fi
@@ -67,7 +67,7 @@ jobs:
6767
- name: Generate common-nix.vars.pkr.hcl
6868
run: |
6969
PG_VERSION=$(sudo nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
70-
PG_VERSION=$(echo $PG_VERSION | tr -d '"') # Remove any surrounding quotes
70+
PG_VERSION=$(echo "$PG_VERSION" | tr -d '"') # Remove any surrounding quotes
7171
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
7272
# Ensure there's a newline at the end of the file
7373
echo "" >> common-nix.vars.pkr.hcl

‎.github/workflows/check-shellscripts.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
pull_request:
88
workflow_dispatch:
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
build:
1215
runs-on: ubuntu-latest

‎.github/workflows/ci.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ name: Check merge requirements
33
on:
44
pull_request:
55

6+
permissions:
7+
contents: read
8+
69
jobs:
710
check-release-version:
811
timeout-minutes: 5

‎.github/workflows/dockerhub-release-matrix.yml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,11 @@ on:
99
- ".github/workflows/dockerhub-release-matrix.yml"
1010
- "ansible/vars.yml"
1111
workflow_dispatch:
12-
12+
13+
permissions:
14+
contents: read
15+
id-token: write
16+
1317
jobs:
1418
prepare:
1519
runs-on: ubuntu-latest
@@ -233,6 +237,10 @@ jobs:
233237
matrix: ${{ steps.combine.outputs.matrix }}
234238
publish:
235239
needs: combine_results
240+
permissions:
241+
contents: read
242+
packages: write
243+
id-token: write
236244
strategy:
237245
matrix: ${{ fromJson(needs.combine_results.outputs.matrix) }}
238246
uses: ./.github/workflows/mirror.yml

‎.github/workflows/manual-docker-release.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ on:
77
description: 'Optional. Postgres version to publish against, i.e. 15.1.1.78'
88
required: false
99

10+
permissions:
11+
id-token: write
12+
contents: read
13+
1014
jobs:
1115
prepare:
1216
runs-on: ubuntu-latest
@@ -241,6 +245,10 @@ jobs:
241245
outputs:
242246
matrix: ${{ steps.combine.outputs.matrix }}
243247
publish:
248+
permissions:
249+
contents: read
250+
packages: write
251+
id-token: write
244252
needs: combine_results
245253
strategy:
246254
matrix: ${{ fromJson(needs.combine_results.outputs.matrix) }}

‎.github/workflows/mirror-postgrest.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
- ".github/workflows/mirror-postgrest.yml"
99
- "common.vars*"
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
version:
1316
runs-on: ubuntu-latest

‎.github/workflows/mirror.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
required: true
1414
type: string
1515

16+
permissions:
17+
contents: read
18+
1619
jobs:
1720
mirror:
1821
runs-on: ubuntu-latest

‎.github/workflows/publish-migrations-prod.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Release Migrations - Prod
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
runs-on: [self-hosted, linux]
9+
timeout-minutes: 15
10+
permissions:
11+
id-token: write
12+
contents: read
13+
14+
steps:
15+
- name: Guard
16+
run: |
17+
if [ $GITHUB_REF != 'refs/heads/develop' ]; then
18+
echo "This action can only be run on the develop branch"
19+
exit 1
20+
fi
21+
env:
22+
GITHUB_REF: ${{ github.ref }}
23+
24+
- name: Checkout Repo
25+
uses: actions/checkout@v2
26+
27+
- name: Merging migration files
28+
run: cat $(ls -1) > ../migration-output.sql
29+
working-directory: ${{ github.workspace }}/migrations/db/migrations
30+
31+
- name: configure aws credentials - prod
32+
uses: aws-actions/configure-aws-credentials@v1
33+
with:
34+
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
35+
aws-region: "ap-southeast-1"
36+
37+
- name: Deploy to S3 prod
38+
shell: bash
39+
run: aws s3 sync migrations/db s3://$AWS_S3_BUCKET/migrations/db --delete
40+
env:
41+
AWS_S3_BUCKET: ${{ secrets.PG_INIT_SCRIPT_S3_BUCKET_PROD }}

‎.github/workflows/publish-migrations.yml renamed to ‎.github/workflows/publish-migrations-staging.yml

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1-
name: Release Migrations
1+
name: Release Migrations - Staging
22

33
on:
44
push:
55
branches:
66
- develop
7+
workflow_dispatch:
78

89
jobs:
910
build:
@@ -32,15 +33,3 @@ jobs:
3233
run: aws s3 sync migrations/db s3://$AWS_S3_BUCKET/migrations/db --delete
3334
env:
3435
AWS_S3_BUCKET: ${{ secrets.PG_INIT_SCRIPT_S3_BUCKET_STAGING }}
35-
36-
- name: configure aws credentials - prod
37-
uses: aws-actions/configure-aws-credentials@v1
38-
with:
39-
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
40-
aws-region: "ap-southeast-1"
41-
42-
- name: Deploy to S3 prod
43-
shell: bash
44-
run: aws s3 sync migrations/db s3://$AWS_S3_BUCKET/migrations/db --delete
45-
env:
46-
AWS_S3_BUCKET: ${{ secrets.PG_INIT_SCRIPT_S3_BUCKET_PROD }}

‎.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -44,19 +44,19 @@ jobs:
4444
id: process_release_version
4545
run: |
4646
VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
47-
VERSION=$(echo $VERSION | tr -d '"') # Remove any surrounding quotes
47+
VERSION=$(echo "$VERSION" | tr -d '"') # Remove any surrounding quotes
4848
if [[ "${{ inputs.postgresVersion }}" != "" ]]; then
49-
VERSION=${{ inputs.postgresVersion }}
49+
VERSION="${{ inputs.postgresVersion }}"
5050
fi
5151
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
5252
echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT"
5353
5454
- name: Create a tarball containing the latest nix flake version
5555
working-directory: /tmp/
5656
run: |
57-
mkdir -p ${{ steps.process_release_version.outputs.major_version }}
58-
echo $GITHUB_SHA > ${{ steps.process_release_version.outputs.major_version }}/nix_flake_version
59-
tar -czvf pg_upgrade_bin.tar.gz ${{ steps.process_release_version.outputs.major_version }}
57+
mkdir -p "${{ steps.process_release_version.outputs.major_version }}"
58+
echo "$GITHUB_SHA" > "${{ steps.process_release_version.outputs.major_version }}/nix_flake_version"
59+
tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}"
6060
6161
- name: configure aws credentials - staging
6262
uses: aws-actions/configure-aws-credentials@v1
@@ -66,7 +66,7 @@ jobs:
6666

6767
- name: Upload pg_upgrade scripts to s3 staging
6868
run: |
69-
aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
69+
aws s3 cp /tmp/pg_upgrade_bin.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz"
7070
7171
- name: Slack Notification on Failure
7272
if: ${{ failure() }}
@@ -101,9 +101,9 @@ jobs:
101101
- name: Create a tarball containing the latest nix flake version
102102
working-directory: /tmp/
103103
run: |
104-
mkdir -p ${{ steps.process_release_version.outputs.major_version }}
105-
echo $GITHUB_SHA > ${{ steps.process_release_version.outputs.major_version }}/nix_flake_version
106-
tar -czvf pg_upgrade_bin.tar.gz ${{ steps.process_release_version.outputs.major_version }}
104+
mkdir -p "${{ steps.process_release_version.outputs.major_version }}"
105+
echo "$GITHUB_SHA" > "${{ steps.process_release_version.outputs.major_version }}/nix_flake_version"
106+
tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}"
107107
108108
- name: configure aws credentials - prod
109109
uses: aws-actions/configure-aws-credentials@v1
@@ -113,7 +113,7 @@ jobs:
113113

114114
- name: Upload pg_upgrade scripts to s3 prod
115115
run: |
116-
aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
116+
aws s3 cp /tmp/pg_upgrade_bin.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz"
117117
118118
- name: Slack Notification on Failure
119119
if: ${{ failure() }}

‎.github/workflows/publish-nix-pgupgrade-scripts.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -51,9 +51,9 @@ jobs:
5151
id: process_release_version
5252
run: |
5353
VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
54-
VERSION=$(echo $VERSION | tr -d '"') # Remove any surrounding quotes
54+
VERSION=$(echo "$VERSION" | tr -d '"') # Remove any surrounding quotes
5555
if [[ "${{ inputs.postgresVersion }}" != "" ]]; then
56-
VERSION=${{ inputs.postgresVersion }}
56+
VERSION="${{ inputs.postgresVersion }}"
5757
fi
5858
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
5959
@@ -71,7 +71,7 @@ jobs:
7171

7272
- name: Upload pg_upgrade scripts to s3 staging
7373
run: |
74-
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz
74+
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz"
7575
7676
- name: Slack Notification on Failure
7777
if: ${{ failure() }}
@@ -102,9 +102,9 @@ jobs:
102102
id: process_release_version
103103
run: |
104104
VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
105-
VERSION=$(echo $VERSION | tr -d '"') # Remove any surrounding quotes
105+
VERSION=$(echo "$VERSION" | tr -d '"') # Remove any surrounding quotes
106106
if [[ "${{ inputs.postgresVersion }}" != "" ]]; then
107-
VERSION=${{ inputs.postgresVersion }}
107+
VERSION="${{ inputs.postgresVersion }}"
108108
fi
109109
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
110110
@@ -122,7 +122,7 @@ jobs:
122122

123123
- name: Upload pg_upgrade scripts to s3 prod
124124
run: |
125-
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz
125+
aws s3 cp /tmp/pg_upgrade_scripts.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/pg_upgrade_scripts.tar.gz"
126126
127127
- name: Slack Notification on Failure
128128
if: ${{ failure() }}

‎.github/workflows/qemu-image-build.yml

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ on:
1212
- 'ansible/vars.yml'
1313
workflow_dispatch:
1414

15+
permissions:
16+
contents: read
17+
id-token: write
18+
1519
jobs:
1620
prepare:
1721
runs-on: ubuntu-latest
@@ -26,7 +30,7 @@ jobs:
2630
- name: Set PostgreSQL versions - only builds pg17 atm
2731
id: set-versions
2832
run: |
29-
VERSIONS=$(nix run nixpkgs#yq -- '.postgres_major[1]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c 'split("\n")[:-1]')
33+
VERSIONS=$(nix run nixpkgs#yq -- '.postgres_major[2]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c 'split("\n")[:-1]')
3034
echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
3135
3236
build:
@@ -68,7 +72,7 @@ jobs:
6872
run: |
6973
curl -L https://github.com/mikefarah/yq/releases/download/v4.45.1/yq_linux_arm64 -o yq && chmod +x yq
7074
PG_VERSION=$(./yq '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
71-
PG_VERSION=$(echo $PG_VERSION | tr -d '"') # Remove any surrounding quotes
75+
PG_VERSION=$(echo "$PG_VERSION" | tr -d '"') # Remove any surrounding quotes
7276
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
7377
echo 'postgres-major-version = "'$POSTGRES_MAJOR_VERSION'"' >> common-nix.vars.pkr.hcl
7478
# Ensure there's a newline at the end of the file
@@ -122,8 +126,8 @@ jobs:
122126
REPOSITORY: postgres-vm-image
123127
IMAGE_TAG: ${{ steps.process_release_version.outputs.version }}
124128
run: |
125-
docker build -f Dockerfile-kubernetes -t $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG .
126-
docker push $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG
129+
docker build -f Dockerfile-kubernetes -t "$REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG" .
130+
docker push "$REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG"
127131
128132
# - name: Upload software manifest to s3 staging
129133
# run: |

‎.github/workflows/test.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@ on:
55
- develop
66
pull_request:
77
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
id-token: write
12+
813
jobs:
914
prepare:
1015
runs-on: ubuntu-latest
@@ -57,7 +62,7 @@ jobs:
5762
run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV
5863
- name: Strip quotes from pg major and set env var
5964
run: |
60-
stripped_version=$(echo ${{ matrix.postgres_version }} | sed 's/^"\(.*\)"$/\1/')
65+
stripped_version=$(echo "${{ matrix.postgres_version }}" | sed 's/^"\(.*\)"$/\1/')
6166
echo "PGMAJOR=$stripped_version" >> $GITHUB_ENV
6267
- name: Generate common-nix.vars.pkr.hcl
6368
run: |

‎.github/workflows/testinfra-nix.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ on:
44
pull_request:
55
workflow_dispatch:
66

7+
permissions:
8+
contents: read
9+
id-token: write
10+
711
jobs:
812
prepare:
913
runs-on: ubuntu-latest
@@ -66,7 +70,7 @@ jobs:
6670
- name: Generate common-nix.vars.pkr.hcl
6771
run: |
6872
PG_VERSION=$(sudo nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
69-
PG_VERSION=$(echo $PG_VERSION | tr -d '"') # Remove any surrounding quotes
73+
PG_VERSION=$(echo "$PG_VERSION" | tr -d '"') # Remove any surrounding quotes
7074
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
7175
# Ensure there's a newline at the end of the file
7276
echo "" >> common-nix.vars.pkr.hcl

‎Dockerfile-15

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ ARG pgrouting_release=3.4.1
1010
ARG pgtap_release=1.2.0
1111
ARG pg_cron_release=1.6.2
1212
ARG pgaudit_release=1.7.0
13-
ARG pgjwt_release=9742dab1b2f297ad3811120db7b21451bca2d3c9
1413
ARG pgsql_http_release=1.5.0
1514
ARG plpgsql_check_release=2.2.5
1615
ARG pg_safeupdate_release=1.4

0 commit comments

Comments
 (0)