From 311d76e2dfc017202a3d231f2f240b28d7c2d1e2 Mon Sep 17 00:00:00 2001 From: Liam Noonan Date: Mon, 6 Jul 2026 12:33:12 +0000 Subject: [PATCH 1/3] Fix clang/llvm Base for Postgres 14-18 was bumped from alpine v3.23 to v3.24 in docker-library/official-images@769849f Alpine v3.24 dropped support for clang19/llvm19, which caused pgvector-build to fail for versions 14 and up. As it turns out, using hardcoded clang19/llvm19 was already not the best idea as it did not match the version used by postgres itself. Only postgres 13 uses clang19 and llvm19, everything above uses clang21 and llvm21. Also, pgvector 0.8.1 does not support pg12 https://github.com/pgvector/pgvector/blob/fb1b8966ebb9254032b6d0e7a594fdcc86f8efcc/CHANGELOG.md?plain=1#L34 Ultimately, I beleive pgvector was only properly installed in a few versions. This commit makes sure it is installed from 13 upwards and also tests that it is installed and working. --- Dockerfile | 7 ++++-- tests/test.py | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index e5260c5..5b0fcd2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -19,8 +19,11 @@ ENV CERTS="{}" \ WAN_USERS='["all"]' \ HBA_EXTRA_RULES="" RUN apk add --no-cache python3 py3-netifaces \ - && if [ "${PG_MAJOR:-0}" -ge 12 ]; then \ - apk add --no-cache --virtual .pgvector-build build-base clang19 llvm19 linux-headers ca-certificates; \ + && if [ "${PG_MAJOR:-0}" -ge 13 ]; then \ + PG_CLANG="$(pg_config --configure | tr "'" "\n" | sed -n 's/^CLANG=clang-//p')"; \ + PG_LLVM="$(pg_config --configure | tr "'" "\n" | sed -n 's#^LLVM_CONFIG=/usr/lib/llvm\([0-9][0-9]*\)/bin/llvm-config#\1#p')"; \ + test -n "${PG_CLANG}" && test -n "${PG_LLVM}" && test "${PG_CLANG}" = "${PG_LLVM}"; \ + apk add --no-cache --virtual .pgvector-build build-base linux-headers ca-certificates "clang${PG_CLANG}" "llvm${PG_LLVM}"; \ wget -qO- "https://github.com/pgvector/pgvector/archive/refs/tags/v${PGVECTOR_VERSION}.tar.gz" \ | tar -xz -C /tmp; \ cd "/tmp/pgvector-${PGVECTOR_VERSION}" \ diff --git a/tests/test.py b/tests/test.py index c0e9966..8111807 100755 --- a/tests/test.py +++ b/tests/test.py @@ -356,6 +356,73 @@ def test_hba_extra_rules_added(self): for rule in hba_extra_rules: self.assertIn(rule, hba_conf) + def test_pgvector_extension(self): + """Test that pgvector is installed and works.""" + if float(local.env["DOCKER_TAG"].split("-")[0]) < 13: + self.skipTest("pgvector not built for PostgreSQL < 13") + self.postgres_container = docker( + "container", + "run", + "-d", + "--network", + "lan", + "-e", + "POSTGRES_DB=test_db", + "-e", + "POSTGRES_PASSWORD=test_password", + "-e", + "POSTGRES_USER=test_user", + CONF_EXTRA, + self.image, + ).strip() + self._check_local_connection() + self.assertEqual( + "vector\n", + docker( + "container", + "exec", + self.postgres_container, + "psql", + "--command", + "SELECT name FROM pg_available_extensions WHERE name = 'vector';", + "--dbname", + "test_db", + "--no-align", + "--tuples-only", + "--username", + "test_user", + ), + ) + docker( + "container", + "exec", + self.postgres_container, + "psql", + "--command", + "CREATE EXTENSION vector;", + "--dbname", + "test_db", + "--username", + "test_user", + ) + self.assertEqual( + "1\n", + docker( + "container", + "exec", + self.postgres_container, + "psql", + "--command", + "SELECT ('[1,2,3]'::vector <-> '[1,2,4]'::vector)::int;", + "--dbname", + "test_db", + "--no-align", + "--tuples-only", + "--username", + "test_user", + ), + ) + if __name__ == "__main__": unittest.main() From 85f46b5fc5ddb80e77ebe84936820506ac678600 Mon Sep 17 00:00:00 2001 From: Jairo Llopis Date: Mon, 22 Jun 2026 11:52:09 +0100 Subject: [PATCH 2/3] ci: run build-test-push on all PRs and fix ghcr push auth Fork PRs previously skipped the build-test-push job entirely, preventing contributors from getting build and test feedback. The GHCR push step used || between independent secrets: BOT_TOKEN || GITHUB_TOKEN and BOT_LOGIN || repository_owner. When only one BOT_* secret was set, credentials became a mismatched pair, causing a denied: denied authentication failure from ghcr.io. Changes: - Remove same-repo restriction from job condition so all PRs run the pipeline. - Use && to ensure both BOT_TOKEN and BOT_LOGIN must exist together to be used; otherwise fall back to the always- available GITHUB_TOKEN + github.repository_owner pair. - Expose BOT_TOKEN and BOT_LOGIN as env vars so they can be evaluated in the if: condition. - Allow GHCR push on fork PRs when bot credentials are available; skip only when GITHUB_TOKEN would be read-only (fork PR without BOT_TOKEN/BOT_LOGIN). - Use github.repository_owner as fallback username instead of github.actor to avoid confusion in org fork scenarios. --- .github/workflows/ci.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3ffd4ea..6112667 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -25,7 +25,7 @@ jobs: - uses: pre-commit/action@v1.0.1 build-test-push: - if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) + if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event_name == 'pull_request' runs-on: ubuntu-latest needs: pre-commit permissions: @@ -62,6 +62,8 @@ jobs: # Github does not allow evaluating a secret in an if condition, so we need to set them as environment variables DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} DOCKERHUB_LOGIN: ${{ secrets.DOCKERHUB_LOGIN }} + BOT_TOKEN: ${{ secrets.BOT_TOKEN }} + BOT_LOGIN: ${{ secrets.BOT_LOGIN }} steps: # Image repo names have to be lowercase. - name: Lowercase image repository name @@ -98,8 +100,9 @@ jobs: REGISTRY_USERNAME: ${{ env.DOCKERHUB_LOGIN }} run: ./hooks/push - name: Push Docker Image to GitHub Registry + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || env.BOT_TOKEN && env.BOT_LOGIN env: REGISTRY_HOST: ghcr.io - REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }} - REGISTRY_USERNAME: ${{ secrets.BOT_LOGIN || github.repository_owner }} + REGISTRY_TOKEN: ${{ secrets.BOT_LOGIN && secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }} + REGISTRY_USERNAME: ${{ secrets.BOT_TOKEN && secrets.BOT_LOGIN || github.repository_owner }} run: ./hooks/push From 89cd20cbd5cd604a9fe3999cfb366e5a3d5e89fb Mon Sep 17 00:00:00 2001 From: Jairo Llopis Date: Fri, 12 Jun 2026 10:36:08 +0100 Subject: [PATCH 3/3] fix(pgvector): target x86-64-v2 for CPU portability MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without explicit CFLAGS, make detects the host CPU features (e.g. AVX-512) and generates a .so that crashes with "signal 4: Illegal instruction" on older x86-64 CPUs. Pinning -march=x86-64-v2 ensures compatibility with any x86-64 processor from the last ~15 years. Without this patch, for example you cannot install PGVector if your server runs an Intel® i9-13900 processor. ARM64 builds are not affected. @moduon MT-14612 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 5b0fcd2..af49463 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,7 +27,7 @@ RUN apk add --no-cache python3 py3-netifaces \ wget -qO- "https://github.com/pgvector/pgvector/archive/refs/tags/v${PGVECTOR_VERSION}.tar.gz" \ | tar -xz -C /tmp; \ cd "/tmp/pgvector-${PGVECTOR_VERSION}" \ - && make PG_CONFIG=/usr/local/bin/pg_config \ + && make $(if [ "$(uname -m)" = "x86_64" ]; then echo 'CFLAGS=-march=x86-64-v2'; fi) PG_CONFIG=/usr/local/bin/pg_config \ && make install PG_CONFIG=/usr/local/bin/pg_config; \ cd / && rm -rf "/tmp/pgvector-${PGVECTOR_VERSION}"; \ apk del .pgvector-build; \