From 5e3924f18f9e7dee0c678cf4d19831a2af32df6f Mon Sep 17 00:00:00 2001
From: Dimitri Fontaine <dim@tapoueh.org>
Date: Mon, 27 Jul 2026 21:16:59 +0200
Subject: [PATCH] ci: fix dpkg-query format-string escaping in
 check-versions.yml

The "Check PGDG minor versions" step always reported every supported PG
version as stale, failing the job on every scheduled run regardless of
whether PGDG had actually released anything new.

Root cause: dpkg-query -f="\\${Version}" postgresql-${pg} -- this line
sits inside docker run --rm "$IMAGE" bash -c '...', where the entire
inner script is single-quoted by the outer (runner) shell, so no
expansion happens there and \\${Version} is passed through literally.
Inside the container's own bash -c, though, that text is inside a
double-quoted -f="..." argument: \\ collapses to one literal backslash,
and the now-unescaped ${Version} gets parameter-expanded as a shell
variable -- which was never set, so it expands to nothing. dpkg-query
ends up invoked with a bare backslash as its format string instead of
the literal ${Version} template it needs, and returns nothing.

With `installed` always empty and `available` resolving correctly via
the separately (correctly) quoted apt-cache/awk one line below, every
PG version compared unequal and got flagged STALE, forcing
pgdg_changed=true unconditionally.

Fix: \\${Version} -> \${Version} (one fewer backslash). The outer
single quotes still pass it through unchanged; the container's bash
now sees \$ inside the double-quoted string, which escapes to a
literal $, yielding the literal string ${Version} dpkg-query expects.

Verified locally: built a throwaway debian:bookworm-slim container,
installed postgresql-17 from the real PGDG repo the same way
Dockerfile.base does, and ran both the old and fixed format strings
against it.

  old (\\${Version}): installed=[]                       (garbage, always empty)
  new (\${Version}):  installed=[17.10-1.pgdg12+1]
                       available=[17.10-1.pgdg12+1]      (correctly matches -> not stale)
---
 .github/workflows/check-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check-versions.yml b/.github/workflows/check-versions.yml
index 5b5e08352..0c2b37929 100644
--- a/.github/workflows/check-versions.yml
+++ b/.github/workflows/check-versions.yml
@@ -124,7 +124,7 @@ jobs:
             apt-get update -qq 2>/dev/null
             CHANGED=false
             for pg in 14 15 16 17; do
-              installed=$(dpkg-query -W -f="\\${Version}" postgresql-${pg} 2>/dev/null || echo "")
+              installed=$(dpkg-query -W -f="\${Version}" postgresql-${pg} 2>/dev/null || echo "")
               available=$(apt-cache show postgresql-${pg} 2>/dev/null \
                 | awk "/^Version:/{print \$2; exit}")
               if [ -z "$installed" ] && [ -z "$available" ]; then