Add workflows for publishing images

.github/workflows/build-cnpg-timescaledb-dev.yml

@@ -0,0 +1,46 @@
+name: Build and Push CNPG TimescaleDB (Dev)
+
+on:
+  workflow_dispatch:
+    inputs:
+      pg_major:
+        description: PostgreSQL major version
+        default: '17'
+        required: true
+      tsdb_version:
+        description: TimescaleDB version (semver, e.g. 2.25.0)
+        default: '2.25.0'
+        required: true
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: ECR Login via OIDC
+        id: ecr-login
+        uses: stellar/actions/sdf-ecr-login@main
+        with:
+          aws-oidc-role: ${{ secrets.AWS_GITHUB_OIDC_ROLE }}
+          aws-ecr-login-role: ${{ secrets.AWS_ECR_LOGIN_ROLE }}
+
+      - name: Build and push image
+        env:
+          ECR_REGISTRY: ${{ steps.ecr-login.outputs.ecr-registry }}
+          ECR_REPO: dev/cnpg-timescaledb
+          PG_MAJOR: ${{ inputs.pg_major }}
+          TSDB_VERSION: ${{ inputs.tsdb_version }}
+        run: |
+          TAG="${ECR_REGISTRY}/${ECR_REPO}:pg${PG_MAJOR}-tsdb${TSDB_VERSION}"
+          echo "Building CNPG TimescaleDB image: ${TAG}"
+          docker build --pull --platform linux/amd64 \
+            -f Dockerfile-timescale-cnpg \
+            --build-arg PG_MAJOR=${PG_MAJOR} \
+            --build-arg TSDB_VERSION=${TSDB_VERSION} \
+            -t "${TAG}" .
+          docker push "${TAG}"

.github/workflows/build-cnpg-timescaledb-stg.yml

@@ -0,0 +1,46 @@
+name: Build and Push CNPG TimescaleDB (Stg)
+
+on:
+  workflow_dispatch:
+    inputs:
+      pg_major:
+        description: PostgreSQL major version
+        default: '17'
+        required: true
+      tsdb_version:
+        description: TimescaleDB version (semver, e.g. 2.25.0)
+        default: '2.25.0'
+        required: true
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: ECR Login via OIDC
+        id: ecr-login
+        uses: stellar/actions/sdf-ecr-login@main
+        with:
+          aws-oidc-role: ${{ secrets.AWS_GITHUB_OIDC_ROLE }}
+          aws-ecr-login-role: ${{ secrets.AWS_ECR_LOGIN_ROLE }}
+
+      - name: Build and push image
+        env:
+          ECR_REGISTRY: ${{ steps.ecr-login.outputs.ecr-registry }}
+          ECR_REPO: stg/cnpg-timescaledb
+          PG_MAJOR: ${{ inputs.pg_major }}
+          TSDB_VERSION: ${{ inputs.tsdb_version }}
+        run: |
+          TAG="${ECR_REGISTRY}/${ECR_REPO}:pg${PG_MAJOR}-tsdb${TSDB_VERSION}"
+          echo "Building CNPG TimescaleDB image: ${TAG}"
+          docker build --pull --platform linux/amd64 \
+            -f Dockerfile-timescale-cnpg \
+            --build-arg PG_MAJOR=${PG_MAJOR} \
+            --build-arg TSDB_VERSION=${TSDB_VERSION} \
+            -t "${TAG}" .
+          docker push "${TAG}"

.github/workflows/build-dev.yml

@@ -0,0 +1,28 @@
+name: Build and Push Wallet Backend (Dev)
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: ECR Login via OIDC
+        id: ecr-login
+        uses: stellar/actions/sdf-ecr-login@main
+        with:
+          aws-oidc-role: ${{ secrets.AWS_GITHUB_OIDC_ROLE }}
+          aws-ecr-login-role: ${{ secrets.AWS_ECR_LOGIN_ROLE }}
+
+      - name: Build and push image
+        env:
+          TAG: ${{ steps.ecr-login.outputs.ecr-registry }}/dev/wallet-backend:${{ github.sha }}
+        run: |
+          make docker-build
+          make docker-push

.github/workflows/build-stg.yml

@@ -0,0 +1,30 @@
+name: Build and Push Wallet Backend (Stg)
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: ECR Login via OIDC
+        id: ecr-login
+        uses: stellar/actions/sdf-ecr-login@main
+        with:
+          aws-oidc-role: ${{ secrets.AWS_GITHUB_OIDC_ROLE }}
+          aws-ecr-login-role: ${{ secrets.AWS_ECR_LOGIN_ROLE }}
+
+      - name: Build and push image
+        env:
+          TAG: ${{ steps.ecr-login.outputs.ecr-registry }}/stg/wallet-backend:${{ github.sha }}
+        run: |
+          make docker-build
+          make docker-push

Dockerfile-timescale-cnpg

@@ -0,0 +1,69 @@
+# Multi-stage Dockerfile for TimescaleDB on CloudNativePG (Bookworm base)
+#
+# TimescaleDB official images are incompatible with CNPG due to different
+# data directory paths, init sequences, and permission models. This builds
+# TimescaleDB from the apt repo and layers it onto the CNPG base image.
+#
+# Usage:
+#   docker build -f Dockerfile-timescale-cnpg --build-arg PG_MAJOR=17 --build-arg TSDB_VERSION=2.25.0 -t cnpg-timescaledb .
+
+ARG PG_MAJOR=17
+
+# ---------------------------------------------------------------------------
+# Stage 1: Install TimescaleDB via apt to capture extension artifacts
+# ---------------------------------------------------------------------------
+FROM ghcr.io/cloudnative-pg/postgresql:${PG_MAJOR}-bookworm AS timescaledb-builder
+
+ARG PG_MAJOR
+ARG TSDB_VERSION=2.25.0
+
+USER root
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl gnupg lsb-release \
+    && rm -rf /var/lib/apt/lists/*
+
+# Add Timescale package repository
+RUN echo "deb https://packagecloud.io/timescale/timescaledb/debian/ $(lsb_release -cs) main" \
+        > /etc/apt/sources.list.d/timescaledb.list \
+    && curl -fsSL https://packagecloud.io/timescale/timescaledb/gpgkey \
+        | gpg --dearmor -o /etc/apt/trusted.gpg.d/timescaledb.gpg
+
+# Add PGDG repository for PostgreSQL dependencies
+RUN echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" \
+        > /etc/apt/sources.list.d/pgdg.list \
+    && curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
+        | gpg --dearmor -o /etc/apt/trusted.gpg.d/postgresql.gpg
+
+# Install TimescaleDB pinned to the requested version.
+# The glob (=${TSDB_VERSION}*) matches the distro suffix automatically
+# (e.g., 2.19.3~debian12-1234).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        timescaledb-2-postgresql-${PG_MAJOR}=${TSDB_VERSION}* \
+    && rm -rf /var/lib/apt/lists/*
+
+# ---------------------------------------------------------------------------
+# Stage 2: Assemble final image — only extension artifacts, no build deps
+# ---------------------------------------------------------------------------
+FROM ghcr.io/cloudnative-pg/postgresql:${PG_MAJOR}-bookworm
+
+ARG PG_MAJOR
+
+# Copy TimescaleDB shared libraries
+COPY --from=timescaledb-builder \
+    /usr/lib/postgresql/${PG_MAJOR}/lib/timescaledb*.so \
+    /usr/lib/postgresql/${PG_MAJOR}/lib/
+
+# Copy TimescaleDB extension SQL and control files
+COPY --from=timescaledb-builder \
+    /usr/share/postgresql/${PG_MAJOR}/extension/timescaledb*.sql \
+    /usr/share/postgresql/${PG_MAJOR}/extension/
+COPY --from=timescaledb-builder \
+    /usr/share/postgresql/${PG_MAJOR}/extension/timescaledb.control \
+    /usr/share/postgresql/${PG_MAJOR}/extension/
+
+# Switch to CNPG's unprivileged user (UID 26)
+USER 26
+
+LABEL org.opencontainers.image.title="CloudNativePG + TimescaleDB (Bookworm)"
+LABEL org.opencontainers.image.description="PostgreSQL ${PG_MAJOR} with TimescaleDB for CloudNativePG on Kubernetes"