(airflow) branch main updated: Build pgbouncer-exporter image from a pinned commit rather than a tag (#71746)

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git


The following commit(s) were added to refs/heads/main by this push:
     new 3864d8f5a54 Build pgbouncer-exporter image from a pinned commit rather than a tag (#71746)
3864d8f5a54 is described below

commit 3864d8f5a540befdadb27425411f959458ee0ca6
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Tue Aug 18 20:17:46 2026 +0200

    Build pgbouncer-exporter image from a pinned commit rather than a tag (#71746)
    
    The airflow-pgbouncer-exporter image is built by downloading the upstream
    source from a mutable git tag:
    
        https://github.com/jbub/pgbouncer_exporter/archive/v${VERSION}.tar.gz
    
    v0.18.0 is a lightweight tag, so it can be moved to different content without
    anything in this repository changing. build_and_push.sh pins only the version
    string, so a re-tag upstream is inherited silently on the next image rebuild.
    The exporter runs in the pgbouncer pod, which holds the metadata-DB stats
    credentials, so what goes into it is worth identifying exactly.
    
    Build from the commit the reviewed tag points at instead. The commit id names
    the content, so the build no longer depends on the tag continuing to mean what
    it meant when it was reviewed. PGBOUNCER_EXPORTER_COMMIT_SHA is set alongside
    PGBOUNCER_EXPORTER_VERSION and passed through as a build arg; the two are
    updated together.
    
    The commit is also recorded as an image label
    (org.apache.airflow.pgbouncer-exporter.commit-sha) so a published image says
    which source it was built from.
    
    Verified that the pinned commit resolves to the same file set as the v0.18.0
    tag, and that the archive still has a single top-level directory so the
    existing --strip-components 1 continues to apply.
    
    A checksum pin was considered and not used: GitHub's auto-generated archive
    tarballs are not guaranteed to be byte-stable, so a sha256 of one can break the
    build without the source having changed. The sibling pgbouncer image can pin a
    checksum because it downloads an uploaded release asset, which is stable. If
    maintainers would rather carry a checksum here too, it can be added on top.
    
    Generated-by: Claude Opus 5 (1M context) following the guidelines at
    https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
---
 chart/dockerfiles/pgbouncer-exporter/Dockerfile        | 8 +++++++-
 chart/dockerfiles/pgbouncer-exporter/build_and_push.sh | 7 +++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/chart/dockerfiles/pgbouncer-exporter/Dockerfile b/chart/dockerfiles/pgbouncer-exporter/Dockerfile
index 32b477e7d45..7a290aa713a 100644
--- a/chart/dockerfiles/pgbouncer-exporter/Dockerfile
+++ b/chart/dockerfiles/pgbouncer-exporter/Dockerfile
@@ -21,12 +21,16 @@ ARG GO_VERSION="1.23.7"
 FROM golang:${GO_VERSION} AS builder
 
 ARG PGBOUNCER_EXPORTER_VERSION
+ARG PGBOUNCER_EXPORTER_COMMIT_SHA
 
 WORKDIR /usr/src/myapp
 
 SHELL ["/bin/bash", "-o", "pipefail", "-e", "-u", "-x", "-c"]
 
-RUN URL="https://github.com/jbub/pgbouncer_exporter/archive/v${PGBOUNCER_EXPORTER_VERSION}.tar.gz" \
+# Fetch the source by commit id rather than by tag. Git tags are mutable: `vX.Y.Z` on the
+# upstream repository can be moved to different content without anything in this image's
+# build inputs changing, so a tag alone does not identify what we build. A commit id does.
+RUN URL="https://github.com/jbub/pgbouncer_exporter/archive/${PGBOUNCER_EXPORTER_COMMIT_SHA}.tar.gz" \
     && curl -L "${URL}" | tar -zx --strip-components 1 \
     && PLATFORM=$([ "$(uname -m)" = "aarch64" ] && echo "arm64" || echo "amd64" )\
     && GOOS=linux GOARCH="${PLATFORM}" CGO_ENABLED=0 go build -v
@@ -41,12 +45,14 @@ RUN apk --no-cache add libressl libressl-dev openssl
 COPY --from=builder /usr/src/myapp/pgbouncer_exporter /bin
 
 ARG PGBOUNCER_EXPORTER_VERSION
+ARG PGBOUNCER_EXPORTER_COMMIT_SHA
 ARG AIRFLOW_PGBOUNCER_EXPORTER_VERSION
 ARG GO_VERSION
 ARG COMMIT_SHA
 
 LABEL org.apache.airflow.component="pgbouncer-exporter" \
     org.apache.airflow.pgbouncer-exporter.version="${PGBOUNCER_EXPORTER_VERSION}" \
+    org.apache.airflow.pgbouncer-exporter.commit-sha="${PGBOUNCER_EXPORTER_COMMIT_SHA}" \
     org.apache.airflow.go.version="${GO_VERSION}" \
     org.apache.airflow.airflow-pgbouncer-exporter.version="${AIRFLOW_PGBOUNCER_EXPORTER_VERSION}" \
     org.apache.airflow.commit-sha="${COMMIT_SHA}" \
diff --git a/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh b/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
index 0acbcc24403..b5cd45becb4 100755
--- a/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
+++ b/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
@@ -23,6 +23,12 @@ readonly DOCKERHUB_REPO
 
 PGBOUNCER_EXPORTER_VERSION="0.18.0"
 readonly PGBOUNCER_EXPORTER_VERSION
+# The commit that PGBOUNCER_EXPORTER_VERSION's tag pointed at when it was reviewed. The image
+# is built from this commit, not from the tag: tags on the upstream repository are mutable and
+# can be moved to different content without this file changing. Update both together, and
+# re-check the diff upstream when you do.
+PGBOUNCER_EXPORTER_COMMIT_SHA="1b1faecd80fdeb0f4d8baa0d423e8b58e4ab9aa5"
+readonly PGBOUNCER_EXPORTER_COMMIT_SHA
 
 AIRFLOW_PGBOUNCER_EXPORTER_VERSION="2026.04.17"
 readonly AIRFLOW_PGBOUNCER_EXPORTER_VERSION
@@ -58,6 +64,7 @@ docker buildx build . \
     --pull \
     --push \
     --build-arg "PGBOUNCER_EXPORTER_VERSION=${PGBOUNCER_EXPORTER_VERSION}" \
+    --build-arg "PGBOUNCER_EXPORTER_COMMIT_SHA=${PGBOUNCER_EXPORTER_COMMIT_SHA}" \
     --build-arg "AIRFLOW_PGBOUNCER_EXPORTER_VERSION=${AIRFLOW_PGBOUNCER_EXPORTER_VERSION}"\
     --build-arg "COMMIT_SHA=${COMMIT_SHA}" \
     --build-arg "GO_VERSION=${EXPECTED_GO_VERSION}" \