feat: release PostgreSQL 18 image

Author: mildman1848

.env.example

@@ -2,7 +2,7 @@
 # Never commit .env or generated secrets.
 
 IMAGE_NAME=postgresql
-APP_VERSION=16.14
+APP_VERSION=18.4
 IMAGE_REVISION=mldm1
 REGISTRY=ghcr.io/mildman1848
 PLATFORMS=linux/amd64,linux/arm64

.github/workflows/docker.yml

@@ -23,9 +23,9 @@ jobs:
     runs-on: ubuntu-latest
     env:
       IMAGE_NAME: postgresql
-      APP_VERSION: 16.14
-      IMAGE_REVISION: mldm2
-      VERSION: 16.14-mldm2
+      APP_VERSION: 18.4
+      IMAGE_REVISION: mldm1
+      VERSION: 18.4-mldm1
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
       GITLAB_REGISTRY_USER: ${{ secrets.GITLAB_REGISTRY_USER }}
@@ -117,6 +117,7 @@ jobs:
             VERSION=${{ env.VERSION }}
             APP_VERSION=${{ env.APP_VERSION }}
             IMAGE_REVISION=${{ env.IMAGE_REVISION }}
+            UPSTREAM_PACKAGE=postgresql18
             VCS_REF=${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

CHANGELOG.md

@@ -6,7 +6,7 @@ All notable changes to this image are documented in this file.
 
 ### Added
 
-- Initial image version `16.14-mldm1` using upstream `16.14`.
+- Initial image version `18.4-mldm1` using upstream `18.4`.
 - Initial LinuxServer.io-style s6-overlay image for PostgreSQL.
 - Local `make` workflow for secure secret generation, linting, building, and smoke testing.
 - GitHub Actions for linting, Docker build, security scanning, Dependabot, and upstream monitoring.

Dockerfile

@@ -5,10 +5,11 @@ FROM ghcr.io/linuxserver/baseimage-alpine:${LSIO_BASE_VERSION}
 
 ARG LSIO_BASE_VERSION
 ARG BUILD_DATE
-ARG APP_VERSION=16.14
-ARG IMAGE_REVISION=mldm2
-ARG VERSION=16.14-mldm2
+ARG APP_VERSION=18.4
+ARG IMAGE_REVISION=mldm1
+ARG VERSION=18.4-mldm1
 ARG VCS_REF
+ARG UPSTREAM_PACKAGE=postgresql18
 
 LABEL build_version="Mildman1848 PostgreSQL version:- ${VERSION} Upstream:- ${APP_VERSION} Revision:- ${IMAGE_REVISION} Build-date:- ${BUILD_DATE}" \
       maintainer="Mildman1848" \
@@ -38,8 +39,8 @@ RUN \
     ca-certificates \
     curl \
     jq \
-    postgresql16 \
-    postgresql16-client \
+    ${UPSTREAM_PACKAGE} \
+    ${UPSTREAM_PACKAGE}-client \
     shadow \
     tzdata && \
   echo "**** cleanup ****" && \

Makefile

@@ -1,9 +1,9 @@
 .DEFAULT_GOAL := help
-SHELL := /usr/bin/env bash
+SHELL := /bin/bash
 
 IMAGE_NAME ?= postgresql
-APP_VERSION ?= 16.14
-IMAGE_REVISION ?= mldm2
+APP_VERSION ?= 18.4
+IMAGE_REVISION ?= mldm1
 VERSION ?= $(APP_VERSION)-$(IMAGE_REVISION)
 IMAGE_TAG ?= $(VERSION)
 REGISTRY ?= ghcr.io/mildman1848
@@ -26,7 +26,7 @@ PUID ?= $(shell id -u)
 PGID ?= $(shell id -g)
 TZ ?= Europe/Berlin
 FORCE ?= 0
-UPSTREAM_PACKAGE ?= postgresql16
+UPSTREAM_PACKAGE ?= postgresql18
 LSIO_BASE_IMAGE ?= ghcr.io/linuxserver/baseimage-alpine:3.24
 SBOM_FORMAT ?= spdx-json
 SBOM_OUTPUT ?= sbom/$(IMAGE_NAME)-$(IMAGE_TAG).spdx.json
@@ -103,15 +103,15 @@ require-image:
 	@$(DOCKER) image inspect '$(IMAGE_REF)' >/dev/null 2>&1 || { echo "ERROR: image not found locally: $(IMAGE_REF)" >&2; echo "Run: make build DOCKER='$(DOCKER)'" >&2; exit 2; }
 
 build: require-dockerfile ## Build local single-platform image with --load.
-	@DOCKER='$(DOCKER)' IMAGE_NAME='$(REGISTRY)/$(IMAGE_NAME)' IMAGE_TAG='$(IMAGE_TAG)' VERSION='$(VERSION)' IMAGE_REVISION='$(IMAGE_REVISION)' APP_VERSION='$(APP_VERSION)' DOCKERFILE='$(DOCKERFILE)' CONTEXT='$(CONTEXT)' PLATFORMS='$(LOAD_PLATFORM)' scripts/buildx-build.sh --load
+	@DOCKER='$(DOCKER)' IMAGE_NAME='$(REGISTRY)/$(IMAGE_NAME)' IMAGE_TAG='$(IMAGE_TAG)' VERSION='$(VERSION)' IMAGE_REVISION='$(IMAGE_REVISION)' APP_VERSION='$(APP_VERSION)' UPSTREAM_PACKAGE='$(UPSTREAM_PACKAGE)' DOCKERFILE='$(DOCKERFILE)' CONTEXT='$(CONTEXT)' PLATFORMS='$(LOAD_PLATFORM)' scripts/buildx-build.sh --load
 
 build-multiarch: require-dockerfile ## Build multiarch image without pushing.
-	@DOCKER='$(DOCKER)' IMAGE_NAME='$(REGISTRY)/$(IMAGE_NAME)' IMAGE_TAG='$(IMAGE_TAG)' VERSION='$(VERSION)' IMAGE_REVISION='$(IMAGE_REVISION)' APP_VERSION='$(APP_VERSION)' DOCKERFILE='$(DOCKERFILE)' CONTEXT='$(CONTEXT)' PLATFORMS='$(PLATFORMS)' scripts/buildx-build.sh
+	@DOCKER='$(DOCKER)' IMAGE_NAME='$(REGISTRY)/$(IMAGE_NAME)' IMAGE_TAG='$(IMAGE_TAG)' VERSION='$(VERSION)' IMAGE_REVISION='$(IMAGE_REVISION)' APP_VERSION='$(APP_VERSION)' UPSTREAM_PACKAGE='$(UPSTREAM_PACKAGE)' DOCKERFILE='$(DOCKERFILE)' CONTEXT='$(CONTEXT)' PLATFORMS='$(PLATFORMS)' scripts/buildx-build.sh
 
 build-manifest: build-multiarch ## Alias for local multiarch manifest validation build.
 
 build-manifest-push: require-dockerfile ## Build and push multiarch image manifest.
-	@DOCKER='$(DOCKER)' IMAGE_NAME='$(REGISTRY)/$(IMAGE_NAME)' IMAGE_TAG='$(IMAGE_TAG)' VERSION='$(VERSION)' IMAGE_REVISION='$(IMAGE_REVISION)' APP_VERSION='$(APP_VERSION)' DOCKERFILE='$(DOCKERFILE)' CONTEXT='$(CONTEXT)' PLATFORMS='$(PLATFORMS)' scripts/buildx-build.sh --push
+	@DOCKER='$(DOCKER)' IMAGE_NAME='$(REGISTRY)/$(IMAGE_NAME)' IMAGE_TAG='$(IMAGE_TAG)' VERSION='$(VERSION)' IMAGE_REVISION='$(IMAGE_REVISION)' APP_VERSION='$(APP_VERSION)' UPSTREAM_PACKAGE='$(UPSTREAM_PACKAGE)' DOCKERFILE='$(DOCKERFILE)' CONTEXT='$(CONTEXT)' PLATFORMS='$(PLATFORMS)' scripts/buildx-build.sh --push
 
 inspect-manifest: ## Inspect a local/remote image manifest.
 	@$(DOCKER) buildx imagetools inspect '$(IMAGE_REF)'
@@ -195,12 +195,12 @@ check-upstream baseimage-check: ## Print current pinned LSIO baseimage and Alpin
 	@$(DOCKER) buildx imagetools inspect '$(LSIO_BASE_IMAGE)' | sed -n '1,80p'
 	@echo ''
 	@echo 'Alpine package signal for $(UPSTREAM_PACKAGE):'
-	@$(DOCKER) run --rm alpine:3.24 sh -c 'apk update >/dev/null && apk search -x "$(UPSTREAM_PACKAGE)"'
+	@$(DOCKER) run --rm alpine:3.24 sh -c 'apk update >/dev/null && apk search -x "$(UPSTREAM_PACKAGE)" "$(UPSTREAM_PACKAGE)-client"'
 	@echo 'Upstream: https://www.postgresql.org/'
 
 release-dry-run: ## Show tags/metadata that would be published.
 	@printf 'Would publish image:\n  %s\n' '$(IMAGE_REF)'
-	@printf 'Additional expected tags:\n  latest on default branch\n  sha-$$(git rev-parse --short HEAD 2>/dev/null || echo unknown)\n'
+	@printf 'Additional expected tags:\n  latest on default branch\n  sha-%s\n' "$$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
 	@printf 'Platforms: %s\n' '$(PLATFORMS)'
 
 release: ## Guarded release target; use workflow_dispatch/push=true first.

README.md

@@ -42,10 +42,10 @@ This image follows the template versioning format:
 Current image version:
 
 ```text
-16.14-mldm1
+18.4-mldm1
 ```
 
-- Upstream application/package version: `16.14`
+- Upstream application/package version: `18.4`
 - Image revision: `mldm1`
 
 ## Local development helpers

UPSTREAM.md

@@ -30,13 +30,13 @@ Upstream status is tracked by `.github/workflows/upstream-monitor.yml`.
 Manual checks:
 
 ```bash
-docker run --rm alpine:3.24 sh -c 'apk update >/dev/null && apk info -v postgresql16'
+docker run --rm alpine:3.24 sh -c 'apk update >/dev/null && apk info -v postgresql18'
 ```
 
 ## Current tracked version
 
-- Upstream version: `16.14`
+- Upstream version: `18.4`
 - Image revision: `mldm1`
-- Combined image version: `16.14-mldm1`
+- Combined image version: `18.4-mldm1`
 
 Packaging-only changes should increment the image revision while keeping the upstream version unchanged.

docs/make-targets.md

@@ -21,7 +21,7 @@ make logs DOCKER='sudo docker'
 | Target | Purpose |
 |---|---|
 | `make info` | Print image metadata and effective refs. |
-| `make version` | Print `16.14-mldm1`. |
+| `make version` | Print `18.4-mldm1`. |
 | `make env-setup` | Create local `.env` from `.env.example`. |
 | `make env-validate` | Validate version/revision metadata. |
 | `make lint` | Static repo checks, s6 checks, private-term scan, Hadolint. |

docs/versioning.md

@@ -9,14 +9,14 @@ This image uses an LSIO-inspired combined version: preserve the upstream Postgre
 Current version:
 
 ```text
-16.14-mldm1
+18.4-mldm1
 ```
 
 ## Components
 
 | Component | Meaning |
 |---|---|
-| `16.14` | PostgreSQL upstream/package version from Alpine `postgresql16`. |
+| `18.4` | PostgreSQL upstream/package version from Alpine `postgresql18`. |
 | `mldm1` | Local image packaging revision for that upstream version. |
 
 `Mildman1848` is allowed as the public namespace/brand. Private household names must not appear in public artifacts.
@@ -32,10 +32,10 @@ Current version:
 The image exposes:
 
 ```text
-org.opencontainers.image.version=16.14-mldm1
+org.opencontainers.image.version=18.4-mldm1
 IMAGE_REVISION=mldm1
-APP_VERSION=16.14
-VERSION=16.14-mldm1
+APP_VERSION=18.4
+VERSION=18.4-mldm1
 ```
 
 Do not use shortened legacy variants of the packaging suffix. The project standard is explicitly `mldm<N>`.

scripts/buildx-build.sh

@@ -12,6 +12,7 @@ VCS_REF="${VCS_REF:-$(git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)
 VERSION="${VERSION:-${IMAGE_TAG}}"
 APP_VERSION="${APP_VERSION:-}"
 IMAGE_REVISION="${IMAGE_REVISION:-}"
+UPSTREAM_PACKAGE="${UPSTREAM_PACKAGE:-postgresql18}"
 ATTESTATIONS="${ATTESTATIONS:-true}"
 
 extra_args=("$@")
@@ -40,6 +41,7 @@ exec ${DOCKER} buildx build \
   --build-arg VERSION="$VERSION" \
   --build-arg APP_VERSION="$APP_VERSION" \
   --build-arg IMAGE_REVISION="$IMAGE_REVISION" \
+  --build-arg UPSTREAM_PACKAGE="$UPSTREAM_PACKAGE" \
   --build-arg VCS_REF="$VCS_REF" \
   --tag "${IMAGE_NAME}:${IMAGE_TAG}" \
   "${attestation_args[@]}" \