fix(ci): use pinned postgres client image

.github/workflows/ci.yml

@@ -45,28 +45,7 @@ jobs:
 
       - name: Install PostgreSQL 18 client
         shell: bash
-        run: |
+        run: bash tools/ci/postgres-client.sh install
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ca-certificates curl
-          sudo install -d /usr/share/postgresql-common/pgdg
-          sudo curl --fail --silent --show-error \
-            --output /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
-            https://www.postgresql.org/media/keys/ACCC4CF8.asc
-          . /etc/os-release
-          printf '%s\n' \
-            'Types: deb' \
-            'URIs: https://apt.postgresql.org/pub/repos/apt' \
-            "Suites: ${VERSION_CODENAME}-pgdg" \
-            "Architectures: $(dpkg --print-architecture)" \
-            'Components: main' \
-            'Signed-By: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc' \
-            | sudo tee /etc/apt/sources.list.d/pgdg.sources >/dev/null
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends postgresql-client-18
-          echo "/usr/lib/postgresql/18/bin" >> "$GITHUB_PATH"
-          export PATH="/usr/lib/postgresql/18/bin:$PATH"
-          pg_dump --version
-          pg_restore --version
 
       - name: Restore dependencies
         run: python3 tools/tests/timing_report.py --name dotnet-restore -- dotnet restore -p:NuGetAudit=true
@@ -122,28 +101,7 @@ jobs:
 
       - name: Install PostgreSQL 18 client
         shell: bash
-        run: |
+        run: bash tools/ci/postgres-client.sh install
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ca-certificates curl
-          sudo install -d /usr/share/postgresql-common/pgdg
-          sudo curl --fail --silent --show-error \
-            --output /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
-            https://www.postgresql.org/media/keys/ACCC4CF8.asc
-          . /etc/os-release
-          printf '%s\n' \
-            'Types: deb' \
-            'URIs: https://apt.postgresql.org/pub/repos/apt' \
-            "Suites: ${VERSION_CODENAME}-pgdg" \
-            "Architectures: $(dpkg --print-architecture)" \
-            'Components: main' \
-            'Signed-By: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc' \
-            | sudo tee /etc/apt/sources.list.d/pgdg.sources >/dev/null
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends postgresql-client-18
-          echo "/usr/lib/postgresql/18/bin" >> "$GITHUB_PATH"
-          export PATH="/usr/lib/postgresql/18/bin:$PATH"
-          pg_dump --version
-          pg_restore --version
 
       - name: Restore dependencies
         run: python3 tools/tests/timing_report.py --name release-critical-restore -- dotnet restore -p:NuGetAudit=true

.github/workflows/docker.yml

@@ -69,28 +69,7 @@ jobs:
 
       - name: Install PostgreSQL 18 client
         shell: bash
-        run: |
+        run: bash tools/ci/postgres-client.sh install
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends ca-certificates curl
-          sudo install -d /usr/share/postgresql-common/pgdg
-          sudo curl --fail --silent --show-error \
-            --output /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
-            https://www.postgresql.org/media/keys/ACCC4CF8.asc
-          . /etc/os-release
-          printf '%s\n' \
-            'Types: deb' \
-            'URIs: https://apt.postgresql.org/pub/repos/apt' \
-            "Suites: ${VERSION_CODENAME}-pgdg" \
-            "Architectures: $(dpkg --print-architecture)" \
-            'Components: main' \
-            'Signed-By: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc' \
-            | sudo tee /etc/apt/sources.list.d/pgdg.sources >/dev/null
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends postgresql-client-18
-          echo "/usr/lib/postgresql/18/bin" >> "$GITHUB_PATH"
-          export PATH="/usr/lib/postgresql/18/bin:$PATH"
-          pg_dump --version
-          pg_restore --version
 
       - name: Restore dependencies
         run: dotnet restore -p:NuGetAudit=true

tools/ci/postgres-client.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+image='postgres:18.4-alpine3.23@sha256:996d0920e4ff9df1fc19dacb904492f3c1ec0ec1cc338f0ad7123be7731c5f5e'
+
+if [[ "${1:-}" == install ]]; then
+  : "${RUNNER_TEMP:?RUNNER_TEMP is required}"
+  : "${GITHUB_PATH:?GITHUB_PATH is required}"
+  install_dir="${RUNNER_TEMP}/postgres-18-client"
+  mkdir -p "${install_dir}"
+  ln -sf "$(realpath "${BASH_SOURCE[0]}")" "${install_dir}/pg_dump"
+  ln -sf "$(realpath "${BASH_SOURCE[0]}")" "${install_dir}/pg_restore"
+  echo "${install_dir}" >> "${GITHUB_PATH}"
+  "${install_dir}/pg_dump" --version
+  "${install_dir}/pg_restore" --version
+  exit
+fi
+
+tool="$(basename "$0")"
+[[ "${tool}" == pg_dump || "${tool}" == pg_restore ]] || exit 64
+docker run --rm --network host --user "$(id -u):$(id -g)" \
+  --volume /tmp:/tmp --env PGPASSWORD --env HOME=/tmp \
+  "${image}" "${tool}" "$@"