From c4af6a1f27c1d9bce6d6c8a8c7cab53edf990081 Mon Sep 17 00:00:00 2001
From: Josh Patra <joshpatra12@gmail.com>
Date: Wed, 19 Aug 2026 13:00:20 -0400
Subject: [PATCH] fix(ci): use pinned postgres client image

---
 .github/workflows/ci.yml     | 46 ++----------------------------------
 .github/workflows/docker.yml | 23 +-----------------
 tools/ci/postgres-client.sh  | 23 ++++++++++++++++++
 3 files changed, 26 insertions(+), 66 deletions(-)
 create mode 100755 tools/ci/postgres-client.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f2f33197..4c8c5aba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,28 +45,7 @@ jobs:
 
       - name: Install PostgreSQL 18 client
         shell: bash
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ca-certificates curl
-          sudo install -d /usr/share/postgresql-common/pgdg
-          sudo curl --fail --silent --show-error \
-            --output /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
-            https://www.postgresql.org/media/keys/ACCC4CF8.asc
-          . /etc/os-release
-          printf '%s\n' \
-            'Types: deb' \
-            'URIs: https://apt.postgresql.org/pub/repos/apt' \
-            "Suites: ${VERSION_CODENAME}-pgdg" \
-            "Architectures: $(dpkg --print-architecture)" \
-            'Components: main' \
-            'Signed-By: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc' \
-            | sudo tee /etc/apt/sources.list.d/pgdg.sources >/dev/null
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends postgresql-client-18
-          echo "/usr/lib/postgresql/18/bin" >> "$GITHUB_PATH"
-          export PATH="/usr/lib/postgresql/18/bin:$PATH"
-          pg_dump --version
-          pg_restore --version
+        run: bash tools/ci/postgres-client.sh install
 
       - name: Restore dependencies
         run: python3 tools/tests/timing_report.py --name dotnet-restore -- dotnet restore -p:NuGetAudit=true
@@ -122,28 +101,7 @@ jobs:
 
       - name: Install PostgreSQL 18 client
         shell: bash
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ca-certificates curl
-          sudo install -d /usr/share/postgresql-common/pgdg
-          sudo curl --fail --silent --show-error \
-            --output /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
-            https://www.postgresql.org/media/keys/ACCC4CF8.asc
-          . /etc/os-release
-          printf '%s\n' \
-            'Types: deb' \
-            'URIs: https://apt.postgresql.org/pub/repos/apt' \
-            "Suites: ${VERSION_CODENAME}-pgdg" \
-            "Architectures: $(dpkg --print-architecture)" \
-            'Components: main' \
-            'Signed-By: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc' \
-            | sudo tee /etc/apt/sources.list.d/pgdg.sources >/dev/null
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends postgresql-client-18
-          echo "/usr/lib/postgresql/18/bin" >> "$GITHUB_PATH"
-          export PATH="/usr/lib/postgresql/18/bin:$PATH"
-          pg_dump --version
-          pg_restore --version
+        run: bash tools/ci/postgres-client.sh install
 
       - name: Restore dependencies
         run: python3 tools/tests/timing_report.py --name release-critical-restore -- dotnet restore -p:NuGetAudit=true
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index cbb3f22b..403fa1d8 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -69,28 +69,7 @@ jobs:
 
       - name: Install PostgreSQL 18 client
         shell: bash
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ca-certificates curl
-          sudo install -d /usr/share/postgresql-common/pgdg
-          sudo curl --fail --silent --show-error \
-            --output /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
-            https://www.postgresql.org/media/keys/ACCC4CF8.asc
-          . /etc/os-release
-          printf '%s\n' \
-            'Types: deb' \
-            'URIs: https://apt.postgresql.org/pub/repos/apt' \
-            "Suites: ${VERSION_CODENAME}-pgdg" \
-            "Architectures: $(dpkg --print-architecture)" \
-            'Components: main' \
-            'Signed-By: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc' \
-            | sudo tee /etc/apt/sources.list.d/pgdg.sources >/dev/null
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends postgresql-client-18
-          echo "/usr/lib/postgresql/18/bin" >> "$GITHUB_PATH"
-          export PATH="/usr/lib/postgresql/18/bin:$PATH"
-          pg_dump --version
-          pg_restore --version
+        run: bash tools/ci/postgres-client.sh install
 
       - name: Restore dependencies
         run: dotnet restore -p:NuGetAudit=true
diff --git a/tools/ci/postgres-client.sh b/tools/ci/postgres-client.sh
new file mode 100755
index 00000000..4c47e6a8
--- /dev/null
+++ b/tools/ci/postgres-client.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+image='postgres:18.4-alpine3.23@sha256:996d0920e4ff9df1fc19dacb904492f3c1ec0ec1cc338f0ad7123be7731c5f5e'
+
+if [[ "${1:-}" == install ]]; then
+  : "${RUNNER_TEMP:?RUNNER_TEMP is required}"
+  : "${GITHUB_PATH:?GITHUB_PATH is required}"
+  install_dir="${RUNNER_TEMP}/postgres-18-client"
+  mkdir -p "${install_dir}"
+  ln -sf "$(realpath "${BASH_SOURCE[0]}")" "${install_dir}/pg_dump"
+  ln -sf "$(realpath "${BASH_SOURCE[0]}")" "${install_dir}/pg_restore"
+  echo "${install_dir}" >> "${GITHUB_PATH}"
+  "${install_dir}/pg_dump" --version
+  "${install_dir}/pg_restore" --version
+  exit
+fi
+
+tool="$(basename "$0")"
+[[ "${tool}" == pg_dump || "${tool}" == pg_restore ]] || exit 64
+docker run --rm --network host --user "$(id -u):$(id -g)" \
+  --volume /tmp:/tmp --env PGPASSWORD --env HOME=/tmp \
+  "${image}" "${tool}" "$@"