Conversation
📝 WalkthroughWalkthroughThe Windows PostgreSQL build staging logic is refined to copy only runtime directories (bin, lib, share, include), remove auxiliary executables, and validate postgres.exe and initdb.exe exist. Release description and README documentation are updated to reflect this "runtime-only" packaging approach. ChangesPostgreSQL Build & Documentation Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 60 minutes.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/build-postgresql.yml (1)
43-44:⚠️ Potential issue | 🟠 Major | ⚡ Quick winNo integrity check on the upstream EDB ZIP — supply chain gap vs. the Unix build.
The Unix job fetches a
.sha256sidecar from the official PostgreSQL FTP and verifies it before extraction. The Windows job trusts the EDB binary ZIP on TLS alone. A compromised EDB origin or CDN swap would propagate silently.EnterpriseDB does not appear to publish SHA256 checksums for the binary ZIP archives, so a byte-for-byte expected-hash cannot be pinned the same way as the Unix source tarball. However, at minimum, hash the downloaded archive and surface it in the step summary so that any divergence across re-runs is visible:
🛡️ Proposed mitigation: log the hash for audit
Invoke-WebRequest -Uri $url -OutFile upstream.zip + $hash = (Get-FileHash upstream.zip -Algorithm SHA256).Hash + Write-Output "upstream.zip SHA256: $hash" + "## Windows upstream ZIP hash`n``$hash``" | Out-File $env:GITHUB_STEP_SUMMARY -Append Expand-Archive upstream.zip -DestinationPath upstream -ForceIf EDB ever ships per-version checksum files alongside the ZIP (e.g.,
.sha256), replace this with a verification step identical to the Unix job.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/build-postgresql.yml around lines 43 - 44, After downloading upstream.zip with Invoke-WebRequest (before Expand-Archive), compute a SHA256 of upstream.zip (using Get-FileHash -Algorithm SHA256) and append the resulting hex digest to the GitHub Actions step summary (via the GITHUB_STEP_SUMMARY file or $env:GITHUB_STEP_SUMMARY) so the fingerprint is recorded for audit; keep the existing Expand-Archive step, and add a note to replace this with an actual checksum verification (matching the Unix job) if EDB publishes a per-version .sha256 in the future.
🧹 Nitpick comments (1)
.github/workflows/build-postgresql.yml (1)
59-59: 💤 Low valueThe
pgAdmin 4guard is a dead assertion — it can never be true.Since only
bin,lib,share, andincludeare copied intostage/, and pgAdmin resides atpgsql/pgAdmin 4/in the EDB archive (not inside any of those four directories),Test-Path 'stage/pgAdmin 4'is structurally always false. The check conveys intent but provides no real protection.If the goal is to guard against future staging regressions, a broader assertion (e.g., asserting that
stagecontains only the four expected subdirectories plusVERSION) would be more meaningful.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In @.github/workflows/build-postgresql.yml:
- Around line 43-44: After downloading upstream.zip with Invoke-WebRequest
(before Expand-Archive), compute a SHA256 of upstream.zip (using Get-FileHash
-Algorithm SHA256) and append the resulting hex digest to the GitHub Actions
step summary (via the GITHUB_STEP_SUMMARY file or $env:GITHUB_STEP_SUMMARY) so
the fingerprint is recorded for audit; keep the existing Expand-Archive step,
and add a note to replace this with an actual checksum verification (matching
the Unix job) if EDB publishes a per-version .sha256 in the future.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b9c87d44-24c3-4262-a9d8-07e09e17809b
📒 Files selected for processing (2)
.github/workflows/build-postgresql.ymlREADME.md
1 participant
Summary
Verification
Summary by CodeRabbit
Documentation
Chores