This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 3864d8f5a54 Build pgbouncer-exporter image from a pinned commit rather
than a tag (#71746)
3864d8f5a54 is described below
commit 3864d8f5a540befdadb27425411f959458ee0ca6
Author: Jarek Potiuk <[email protected]>
AuthorDate: Tue Aug 18 20:17:46 2026 +0200
Build pgbouncer-exporter image from a pinned commit rather than a tag
(#71746)
The airflow-pgbouncer-exporter image is built by downloading the upstream
source from a mutable git tag:
https://github.com/jbub/pgbouncer_exporter/archive/v${VERSION}.tar.gz
v0.18.0 is a lightweight tag, so it can be moved to different content
without
anything in this repository changing. build_and_push.sh pins only the
version
string, so a re-tag upstream is inherited silently on the next image
rebuild.
The exporter runs in the pgbouncer pod, which holds the metadata-DB stats
credentials, so what goes into it is worth identifying exactly.
Build from the commit the reviewed tag points at instead. The commit id
names
the content, so the build no longer depends on the tag continuing to mean
what
it meant when it was reviewed. PGBOUNCER_EXPORTER_COMMIT_SHA is set
alongside
PGBOUNCER_EXPORTER_VERSION and passed through as a build arg; the two are
updated together.
The commit is also recorded as an image label
(org.apache.airflow.pgbouncer-exporter.commit-sha) so a published image says
which source it was built from.
Verified that the pinned commit resolves to the same file set as the v0.18.0
tag, and that the archive still has a single top-level directory so the
existing --strip-components 1 continues to apply.
A checksum pin was considered and not used: GitHub's auto-generated archive
tarballs are not guaranteed to be byte-stable, so a sha256 of one can break
the
build without the source having changed. The sibling pgbouncer image can
pin a
checksum because it downloads an uploaded release asset, which is stable. If
maintainers would rather carry a checksum here too, it can be added on top.
Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
---
chart/dockerfiles/pgbouncer-exporter/Dockerfile | 8 +++++++-
chart/dockerfiles/pgbouncer-exporter/build_and_push.sh | 7 +++++++
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/chart/dockerfiles/pgbouncer-exporter/Dockerfile
b/chart/dockerfiles/pgbouncer-exporter/Dockerfile
index 32b477e7d45..7a290aa713a 100644
--- a/chart/dockerfiles/pgbouncer-exporter/Dockerfile
+++ b/chart/dockerfiles/pgbouncer-exporter/Dockerfile
@@ -21,12 +21,16 @@ ARG GO_VERSION="1.23.7"
FROM golang:${GO_VERSION} AS builder
ARG PGBOUNCER_EXPORTER_VERSION
+ARG PGBOUNCER_EXPORTER_COMMIT_SHA
WORKDIR /usr/src/myapp
SHELL ["/bin/bash", "-o", "pipefail", "-e", "-u", "-x", "-c"]
-RUN
URL="https://github.com/jbub/pgbouncer_exporter/archive/v${PGBOUNCER_EXPORTER_VERSION}.tar.gz";
\
+# Fetch the source by commit id rather than by tag. Git tags are mutable:
`vX.Y.Z` on the
+# upstream repository can be moved to different content without anything in
this image's
+# build inputs changing, so a tag alone does not identify what we build. A
commit id does.
+RUN
URL="https://github.com/jbub/pgbouncer_exporter/archive/${PGBOUNCER_EXPORTER_COMMIT_SHA}.tar.gz";
\
&& curl -L "${URL}" | tar -zx --strip-components 1 \
&& PLATFORM=$([ "$(uname -m)" = "aarch64" ] && echo "arm64" || echo
"amd64" )\
&& GOOS=linux GOARCH="${PLATFORM}" CGO_ENABLED=0 go build -v
@@ -41,12 +45,14 @@ RUN apk --no-cache add libressl libressl-dev openssl
COPY --from=builder /usr/src/myapp/pgbouncer_exporter /bin
ARG PGBOUNCER_EXPORTER_VERSION
+ARG PGBOUNCER_EXPORTER_COMMIT_SHA
ARG AIRFLOW_PGBOUNCER_EXPORTER_VERSION
ARG GO_VERSION
ARG COMMIT_SHA
LABEL org.apache.airflow.component="pgbouncer-exporter" \
org.apache.airflow.pgbouncer-exporter.version="${PGBOUNCER_EXPORTER_VERSION}" \
+
org.apache.airflow.pgbouncer-exporter.commit-sha="${PGBOUNCER_EXPORTER_COMMIT_SHA}"
\
org.apache.airflow.go.version="${GO_VERSION}" \
org.apache.airflow.airflow-pgbouncer-exporter.version="${AIRFLOW_PGBOUNCER_EXPORTER_VERSION}"
\
org.apache.airflow.commit-sha="${COMMIT_SHA}" \
diff --git a/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
b/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
index 0acbcc24403..b5cd45becb4 100755
--- a/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
+++ b/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
@@ -23,6 +23,12 @@ readonly DOCKERHUB_REPO
PGBOUNCER_EXPORTER_VERSION="0.18.0"
readonly PGBOUNCER_EXPORTER_VERSION
+# The commit that PGBOUNCER_EXPORTER_VERSION's tag pointed at when it was
reviewed. The image
+# is built from this commit, not from the tag: tags on the upstream repository
are mutable and
+# can be moved to different content without this file changing. Update both
together, and
+# re-check the diff upstream when you do.
+PGBOUNCER_EXPORTER_COMMIT_SHA="1b1faecd80fdeb0f4d8baa0d423e8b58e4ab9aa5"
+readonly PGBOUNCER_EXPORTER_COMMIT_SHA
AIRFLOW_PGBOUNCER_EXPORTER_VERSION="2026.04.17"
readonly AIRFLOW_PGBOUNCER_EXPORTER_VERSION
@@ -58,6 +64,7 @@ docker buildx build . \
--pull \
--push \
--build-arg "PGBOUNCER_EXPORTER_VERSION=${PGBOUNCER_EXPORTER_VERSION}" \
+ --build-arg
"PGBOUNCER_EXPORTER_COMMIT_SHA=${PGBOUNCER_EXPORTER_COMMIT_SHA}" \
--build-arg
"AIRFLOW_PGBOUNCER_EXPORTER_VERSION=${AIRFLOW_PGBOUNCER_EXPORTER_VERSION}"\
--build-arg "COMMIT_SHA=${COMMIT_SHA}" \
--build-arg "GO_VERSION=${EXPECTED_GO_VERSION}" \
