fix build

Author: gugu

.github/workflows/build.yaml

@@ -21,36 +21,50 @@ jobs:
         id: versions
         env:
           GH_TOKEN: ${{ github.token }}
+          PG_MAJOR: "16"
         run: |
           set -euo pipefail
 
+          # Timescale + Toolkit: latest GitHub release (strip leading 'v')
           ts=$(curl -fsSL -H "Authorization: Bearer $GH_TOKEN" \
             https://api.github.com/repos/timescale/timescaledb/releases/latest \
             | jq -r .tag_name | sed 's/^v//')
           tk=$(curl -fsSL -H "Authorization: Bearer $GH_TOKEN" \
             https://api.github.com/repos/timescale/timescaledb-toolkit/releases/latest \
             | jq -r .tag_name | sed 's/^v//')
 
-          reg_token=$(curl -fsSL 'https://ghcr.io/token?service=ghcr.io&scope=repository:cloudnative-pg/postgresql:pull' | jq -r .token)
-          pg=$(curl -fsSL -H "Authorization: Bearer $reg_token" \
-            'https://ghcr.io/v2/cloudnative-pg/postgresql/tags/list?n=10000' \
-            | jq -r '.tags[]' | grep -E '^16\.[0-9]+$' | sort -V | tail -1)
+          # Latest PG minor from postgresql.org, then probe CNPG for a published tag,
+          # walking back if CNPG hasn't republished yet.
+          pg_minor=$(curl -fsSL https://www.postgresql.org/versions.json \
+            | jq -r --arg m "$PG_MAJOR" '.[] | select(.major == $m) | .latestMinor')
+          reg_token=$(curl -fsSL "https://ghcr.io/token?service=ghcr.io&scope=repository:cloudnative-pg/postgresql:pull" | jq -r .token)
+          pg=""
+          for n in $(seq "$pg_minor" -1 0); do
+            code=$(curl -sS -o /dev/null -w "%{http_code}" \
+              -H "Authorization: Bearer $reg_token" \
+              -H "Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.docker.distribution.manifest.v2+json" \
+              "https://ghcr.io/v2/cloudnative-pg/postgresql/manifests/${PG_MAJOR}.${n}")
+            if [ "$code" = "200" ]; then pg="${PG_MAJOR}.${n}"; break; fi
+          done
+          if [ -z "$pg" ]; then
+            echo "No ${PG_MAJOR}.x tag found on ghcr.io/cloudnative-pg/postgresql" >&2
+            exit 1
+          fi
 
           {
             echo "timescale=$ts"
             echo "timescale_minor=$(echo "$ts" | cut -d. -f-2)"
             echo "timescale_major=$(echo "$ts" | cut -d. -f1)"
             echo "timescale_toolkit=$tk"
             echo "postgres=$pg"
-            echo "postgres_minor=$(echo "$pg" | cut -d. -f-2)"
-            echo "postgres_major=$(echo "$pg" | cut -d. -f1)"
+            echo "postgres_major=$PG_MAJOR"
           } >> "$GITHUB_OUTPUT"
 
           {
             echo "## Resolved versions"
             echo "- TimescaleDB: \`$ts\`"
             echo "- TimescaleDB Toolkit: \`$tk\`"
-            echo "- PostgreSQL (CNPG): \`$pg\`"
+            echo "- PostgreSQL (CNPG): \`$pg\` (PG major \`$PG_MAJOR\`)"
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Docker meta
         id: meta
@@ -62,11 +76,10 @@ jobs:
           tags: |
             type=raw,priority=1000,value=latest
             type=raw,priority=999,value=${{ steps.versions.outputs.postgres }}-ts${{ steps.versions.outputs.timescale }}
-            type=raw,priority=998,value=${{ steps.versions.outputs.postgres_minor }}-ts${{ steps.versions.outputs.timescale_minor }}
+            type=raw,priority=998,value=${{ steps.versions.outputs.postgres }}-ts${{ steps.versions.outputs.timescale_minor }}
             type=raw,priority=997,value=${{ steps.versions.outputs.postgres_major }}-ts${{ steps.versions.outputs.timescale_major }}
             type=raw,priority=996,value=${{ steps.versions.outputs.postgres }}
-            type=raw,priority=995,value=${{ steps.versions.outputs.postgres_minor }}
-            type=raw,priority=994,value=${{ steps.versions.outputs.postgres_major }}
+            type=raw,priority=995,value=${{ steps.versions.outputs.postgres_major }}
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
       - name: Set up Buildx
@@ -87,7 +100,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            POSTGRES_VERSION=${{ steps.versions.outputs.postgres }}
+            POSTGRES_VERSION=${{ steps.versions.outputs.postgres_major }}
             CLOUDNATIVEPG_VERSION=${{ steps.versions.outputs.postgres }}
             TIMESCALE_VERSION=${{ steps.versions.outputs.timescale }}
             TIMESCALE_TOOLKIT_VERSION=${{ steps.versions.outputs.timescale_toolkit }}

CLAUDE.md

@@ -11,9 +11,14 @@ A Dockerfile + GitHub Actions pipeline that layers TimescaleDB and TimescaleDB T
 Versions are **not pinned** in this repo. The `Resolve latest versions` step in `.github/workflows/build.yaml` fetches them at build time:
 
 - TimescaleDB + Toolkit: GitHub `releases/latest` of `timescale/timescaledb` and `timescale/timescaledb-toolkit` (leading `v` stripped).
-- PostgreSQL / CNPG: `ghcr.io/v2/cloudnative-pg/postgresql/tags/list`, filtered to `^16\.[0-9]+$` and `sort -V | tail -1`. Only Postgres 16 is tracked — to add another major, add a parallel filter or matrix, don't change `16` in place.
+- PostgreSQL: `https://www.postgresql.org/versions.json` is queried for `latestMinor` of PG major `16` (`PG_MAJOR` env in the step). We then HEAD-probe `ghcr.io/v2/cloudnative-pg/postgresql/manifests/16.<minor>` and walk back one minor at a time until we get a `200` — this tolerates the lag between an upstream PG release and CNPG re-publishing. The tags/list endpoint is intentionally **not** used: it's capped at 1000 entries per page and CNPG has enough historical tags that a plain-minor tag like `16.13` can fall off the first page.
 
-`POSTGRES_VERSION` and `CLOUDNATIVEPG_VERSION` are fed the **same** resolved value (the CNPG tag like `16.11`). The Dockerfile uses `$POSTGRES_VERSION` inside the Timescale apt package name, so this relies on Timescale's Debian repo accepting the full `major.minor` (or on apt's loose matching for the major). If a scheduled build starts failing on `apt-get install` of `timescaledb-2-postgresql-<ver>`, verify the packagecloud triplet first — upstream may not have published yet for a brand-new CNPG minor.
+Two build args derive from different halves of the resolved version:
+
+- `CLOUDNATIVEPG_VERSION` = the full probed tag (e.g. `16.13`) — used as the `FROM` tag.
+- `POSTGRES_VERSION` = the PG major only (e.g. `16`) — used inside the Timescale apt package name `timescaledb-2-postgresql-<major>`. Passing the full `16.13` here will fail (`E: Unable to locate package timescaledb-2-postgresql-16.13`) — Timescale's Debian packages are keyed on the PG major, not the minor.
+
+Changing the tracked PG major means updating `PG_MAJOR` in the resolver step; there is no matrix anymore.
 
 Renovate (`renovate.json`) no longer drives these versions; its regex managers now match nothing in `build.yaml` but are left in place for future use. Don't reintroduce the old Renovate comment pragmas — they'd fight the runtime resolver.