Merge branch 'develop' into etienne/sec-493-switch-pg_hba-to-use-include-directive

Author: staaldraad

.claude/skills/pg-security-release-analysis/SKILL.md

@@ -2,22 +2,27 @@ name: Build AMI
 description: Build both stage 1 and stage 2 AMIs
 
 inputs:
-  postgres_version:
-    description: 'PostgreSQL major version (e.g., 15)'
-    required: true
-  region:
-    description: 'AWS region'
+  ami_name_prefix:
+    description: 'Prefix for the AMI name'
     required: true
   ami_regions:
     description: 'AMI regions as JSON array (e.g., ["us-east-1"])'
     required: true
+  arch:
+    description: Architecture to build AMI for (amd64|arm64)
+    required: true
   git_sha:
     description: 'Git SHA for this build'
     required: true
-  ami_name_prefix:
-    description: 'Prefix for the AMI name'
-    required: false
-    default: 'supabase-postgres'
+  instance_type:
+    description: 'EC2 instance type for the build'
+    required: true
+  postgres_version:
+    description: 'PostgreSQL major version (e.g., 15)'
+    required: true
+  region:
+    description: 'AWS region'
+    required: true
 
 outputs:
   stage2_ami_id:
@@ -33,6 +38,13 @@ outputs:
 runs:
   using: "composite"
   steps:
+    - name: Verify arch
+      shell: bash
+      run: |
+        case ${{ inputs.arch }} in
+        amd64 | arm64) ;;
+        *) echo "Unknown arch input, expected:(amd64|arm64) got:${{ inputs.arch }}" >&2 && exit 1 ;;
+        esac
     - name: Set execution ID
       id: set-execution-id
       shell: bash
@@ -60,12 +72,12 @@ runs:
         AWS_RETRY_MODE: adaptive
         AWS_REGION: ${{ inputs.region }}
       run: |
-        nix run .#build-ami -- stage1 \
+        nix run .#build-ami -- stage1 ${{ inputs.arch }} \
           -var "git-head-version=${{ inputs.git_sha }}" \
           -var "packer-execution-id=${{ env.EXECUTION_ID }}" \
           -var "ansible_arguments=-e postgresql_major=${{ inputs.postgres_version }}" \
           -var 'ami_regions=${{ inputs.ami_regions }}' \
-          amazon-arm64-nix.pkr.hcl
+          amazon-${{ inputs.arch }}-nix.pkr.hcl
 
     - name: Build AMI stage 2
       id: build-stage2
@@ -78,10 +90,11 @@ runs:
         AWS_RETRY_MODE: adaptive
         AWS_REGION: ${{ inputs.region }}
       run: |
-        nix run .#build-ami -- stage2 \
+        nix run .#build-ami -- stage2 ${{ inputs.arch }} \
           -var "git-head-version=${{ inputs.git_sha }}" \
           -var "packer-execution-id=${{ env.EXECUTION_ID }}" \
           -var "postgres_major_version=${{ inputs.postgres_version }}" \
           -var "ami_name=${{ inputs.ami_name_prefix }}" \
           -var "git_sha=${{ inputs.git_sha }}" \
+          -var "instance_type=${{ inputs.instance_type }}" \
           stage2-nix-psql.pkr.hcl

.github/actions/build-ami/action.yml

@@ -0,0 +1,74 @@
+name: 'Nix build with retry'
+description: |
+  Runs `nix build --accept-flake-config -L` and retries on transient network
+  errors (codeload.github.com 5xx, DNS, TLS, connection resets). Genuine build
+  failures exit immediately without retrying.
+inputs:
+  attr:
+    description: 'The flake attribute to build, including the leading `.#`, e.g. `.#psql_17_cli_portable`'
+    required: true
+  extra-args:
+    description: 'Additional arguments inserted between `-L` and the attribute, e.g. `--system aarch64-linux`'
+    required: false
+    default: ''
+  attempts:
+    description: 'Maximum number of attempts'
+    required: false
+    default: '3'
+  initial-delay-seconds:
+    description: 'Backoff before the second attempt; doubled before each subsequent attempt'
+    required: false
+    default: '30'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: nix build (with retry)
+      shell: bash
+      env:
+        ATTR: ${{ inputs.attr }}
+        EXTRA_ARGS: ${{ inputs.extra-args }}
+        ATTEMPTS: ${{ inputs.attempts }}
+        INITIAL_DELAY: ${{ inputs.initial-delay-seconds }}
+      run: |
+        set -uo pipefail
+
+        log_file=$(mktemp)
+        trap 'rm -f "$log_file"' EXIT
+
+        # Patterns that indicate a transient network/upstream failure rather
+        # than a real build error. Keep conservative — false positives waste
+        # CI minutes by re-running deterministic build failures.
+        transient_re='HTTP error 5[0-9][0-9]|error: unable to download|Failed to open archive|Connection (reset|refused|timed out)|Couldn'\''t resolve host|Could not resolve host|unexpected end[- ]of[- ]file|SSL connection|TLS connection|Resource temporarily unavailable|Temporary failure in name resolution'
+
+        delay="$INITIAL_DELAY"
+        rc=0
+        for attempt in $(seq 1 "$ATTEMPTS"); do
+          echo "::group::nix build attempt ${attempt}/${ATTEMPTS}: ${ATTR} ${EXTRA_ARGS}"
+          # Stream to console AND capture for post-hoc pattern matching.
+          # PIPESTATUS preserves nix's exit code through the tee.
+          nix build --accept-flake-config -L ${EXTRA_ARGS} "${ATTR}" 2>&1 | tee "$log_file"
+          rc=${PIPESTATUS[0]}
+          echo "::endgroup::"
+
+          if [ "$rc" -eq 0 ]; then
+            exit 0
+          fi
+
+          if [ "$attempt" -ge "$ATTEMPTS" ]; then
+            echo "::error::nix build failed after ${attempt} attempt(s) (exit ${rc})"
+            exit "$rc"
+          fi
+
+          if grep -qE "$transient_re" "$log_file"; then
+            echo "::warning::Transient error on attempt ${attempt}; sleeping ${delay}s then retrying"
+            sleep "$delay"
+            delay=$((delay * 2))
+          else
+            echo "::error::nix build failed with non-transient error on attempt ${attempt} (exit ${rc}); not retrying"
+            exit "$rc"
+          fi
+        done
+
+        # Defensive — loop should always exit via one of the branches above.
+        exit "$rc"

.github/actions/nix-build-retry/action.yml

@@ -12,14 +12,21 @@ on:
         required: true
         type: string
         default: 'main'
+      arch:
+        description: 'Architecture to build'
+        required: true
+        type: choice
+        options:
+          - arm64
+          - amd64
 
 permissions:
   contents: write
   id-token: write
 
 jobs:
   build:
-    runs-on: large-linux-arm
+    runs-on: ${{ github.event.inputs.arch == 'amd64' && 'blacksmith-2vcpu-ubuntu-2404' || 'large-linux-arm' }}
     timeout-minutes: 150
 
     steps:
@@ -41,6 +48,25 @@ jobs:
         run: |
           echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
+      - name: Set arch-specific variables
+        id: arch_vars
+        run: |
+          ARCH="${{ github.event.inputs.arch }}"
+          echo "arch=$ARCH" >>"$GITHUB_OUTPUT"
+          if [ "$ARCH" = "amd64" ]; then
+            {
+              echo "ami_name_prefix=supabase-postgres-x86"
+              echo "arch_suffix=-x86"
+              echo "instance_type=c6i.4xlarge"
+            } >> "$GITHUB_OUTPUT"
+          else
+            {
+              echo "ami_name_prefix=supabase-postgres"
+              echo "arch_suffix="
+              echo "instance_type=c6g.4xlarge"
+            } >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Install nix
         uses: ./.github/actions/nix-install-ephemeral
         with:
@@ -55,8 +81,11 @@ jobs:
         with:
           postgres_version: ${{ github.event.inputs.postgres_version }}
           region: us-east-1
+          ami_name_prefix: ${{ steps.arch_vars.outputs.ami_name_prefix }}
           ami_regions: '["us-east-1"]'
+          arch: ${{ steps.arch_vars.outputs.arch }}
           git_sha: ${{ steps.get_sha.outputs.sha }}
+          instance_type: ${{ steps.arch_vars.outputs.instance_type }}
 
       - name: Grab release version
         id: process_release_version
@@ -86,13 +115,14 @@ jobs:
             -e "ami_release_version=${{ steps.process_release_version.outputs.version }}" \
             -e "internal_artifacts_bucket=${{ secrets.ARTIFACTS_BUCKET }}" \
             -e "postgres_major_version=${{ github.event.inputs.postgres_version }}" \
+            -e "arch=${{ github.event.inputs.arch }}" \
             manifest-playbook.yml
 
       - name: Upload nix flake revision to s3 staging
         run: |
-          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
-          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
-          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}${{ steps.arch_vars.outputs.arch_suffix }}/20.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}${{ steps.arch_vars.outputs.arch_suffix }}/24.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}${{ steps.arch_vars.outputs.arch_suffix }}/upgrade_bundle.tar.gz
 
       - name: configure aws credentials - prod
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
@@ -107,19 +137,20 @@ jobs:
             -e "ami_release_version=${{ steps.process_release_version.outputs.version }}" \
             -e "internal_artifacts_bucket=${{ secrets.PROD_ARTIFACTS_BUCKET }}" \
             -e "postgres_major_version=${{ github.event.inputs.postgres_version }}" \
+            -e "arch=${{ github.event.inputs.arch }}" \
             manifest-playbook.yml
     
       - name: Upload nix flake revision to s3 prod
         run: |
-          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
-          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
-          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades${{ steps.arch_vars.outputs.arch_suffix }}/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades${{ steps.arch_vars.outputs.arch_suffix }}/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades${{ steps.arch_vars.outputs.arch_suffix }}/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
 
       - name: Create release
         uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
-          name: ${{ steps.process_release_version.outputs.version }}
-          tag_name: ${{ steps.process_release_version.outputs.version }}
+          name: ${{ steps.process_release_version.outputs.version }}${{ steps.arch_vars.outputs.arch_suffix }}
+          tag_name: ${{ steps.process_release_version.outputs.version }}${{ steps.arch_vars.outputs.arch_suffix }}
           target_commitish: ${{ steps.get_sha.outputs.sha }}
 
       - name: Slack Notification on Failure