chore: upgrade to 15.20 (postgres db overlay) #13

2026-11-13T04:31:10Z

autonomic-bot commented

2026-11-13 04:31:10 +00:00

Recipe upgrade for gitea: postgres (optional compose.postgres.yml overlay) 15.19 → 15.20 (PostgreSQL security release, 2026-11-12). This PR is one commit on current upstream main and changes exactly one image line; the recipe version label is intentionally left untouched (publish step below).

Why this is a sidecar-only bump

The survey that opened this run reported gitea/gitea 28.2.0-rootless → 28.3.0-rootless from the local abra checkout. Reconciling the mirror from true upstream first shows that app bump has already landed upstream: git.coopcloud.tech/coop-cloud/gitea master tip is 0fbedb6 "chore: publish 3.6.11+28.3.0-rootless release" (upstreamed from mirror PR #12, verified GREEN on cc-ci, 2026-11-09). No gitea/gitea tag newer than 28.3.0-rootless exists, so the app line is unchanged here. The remaining same-major bump is the postgres overlay.

Image tag table

service	image	current	new	notes
app	gitea/gitea	28.3.0-rootless	28.3.0-rootless (unchanged)	Already bumped + published upstream (mirror PR #12 → `3.6.11+28.3.0-rootless`); no newer tag.
db (optional postgres overlay)	postgres	15.19	15.20	Same-major patch/security release (2026-11-12). Binary-compatible; no `pg_upgrade`, no data-format or volume change.
db (optional mariadb overlay)	mariadb	10.11.19	10.11.19 (held)	10.11 LTS; `10.11.19` is the newest `10.11.x`.

Operator Action Required

Security (postgres): PostgreSQL 15.20 is a security release; its notes name 43 CVEs fixed in this window (https://www.postgresql.org/docs/release/15.20/). Same-major, so an existing 15.x db volume starts unchanged under 15.20 — nothing to migrate.
Behavioural caveat (not applicable here): one 15.20 fix ("composite datums") recommends rebuilding C-language extensions for full protection. The recipe runs stock postgres with no custom C extensions, so there is nothing to rebuild.
No app/config/env/volume/label changes. No gitea 28.x-specific migration (28.3.0 is already live upstream).
app.ini writability: the pre-existing read-only WORK_PATH warning is unrelated and untouched; mirror PR #4 (fix-app-ini-writable) remains open for the operator.

Upstream release notes: app gitea 28.3.0 (already upstream, unchanged here): https://github.com/go-gitea/gitea/releases/tag/v28.3.0
Upstream release notes: postgres 15.19→15.20: https://www.postgresql.org/docs/release/15.20/

Verification

Direct --chaos deploy on cc-ci of this exact WIP commit with COMPOSE_FILE=compose.yml:compose.postgres.yml, upgrading an already-initialised 15.19 db volume in place: the new container logs starting PostgreSQL 15.20, database system is ready to accept connections; Gitea 28.3.0 starts and GET /api/healthz returns {"status":"pass"} with database:ping pass. Dev stack torn down fully (0 stacks, no volumes remain).
Note for CI: the cc-ci gitea suite uses the compose.sqlite3.yml overlay, so !testme does not exercise the postgres overlay. The postgres bump is therefore validated by the direct dev deploy above, not by the CI card. !testme still verifies the recipe PR head is a working recipe.

Recommended release bump (operator, after merge)

abra recipe release gitea -z

Reasoning: sidecar-only same-major patch/security bump, no new recipe feature surface. That publishes 3.6.12+28.3.0-rootless from the current 3.6.11+28.3.0-rootless.

Nothing here is merged; this PR awaits operator review.

CI verification is run against this one-commit PR head. NOT merged — for operator review.

cc @trav @notplants

Recipe upgrade for `gitea`: **postgres (optional `compose.postgres.yml` overlay) 15.19 → 15.20** (PostgreSQL security release, 2026-11-12). This PR is one commit on current upstream main and changes exactly one image line; the recipe version label is intentionally left untouched (publish step below). ## Why this is a sidecar-only bump The survey that opened this run reported `gitea/gitea 28.2.0-rootless → 28.3.0-rootless` from the local abra checkout. Reconciling the mirror from **true upstream first** shows that app bump has **already landed upstream**: `git.coopcloud.tech/coop-cloud/gitea` `master` tip is `0fbedb6` *"chore: publish 3.6.11+28.3.0-rootless release"* (upstreamed from mirror PR #12, verified GREEN on cc-ci, 2026-11-09). No `gitea/gitea` tag newer than `28.3.0-rootless` exists, so the app line is unchanged here. The remaining same-major bump is the postgres overlay. ## Image tag table | service | image | current | new | notes | |---------|-------|---------|-----|-------| | app | gitea/gitea | 28.3.0-rootless | 28.3.0-rootless (unchanged) | Already bumped + published upstream (mirror PR #12 → `3.6.11+28.3.0-rootless`); no newer tag. | | db (optional postgres overlay) | postgres | 15.19 | **15.20** | Same-major patch/security release (2026-11-12). Binary-compatible; no `pg_upgrade`, no data-format or volume change. | | db (optional mariadb overlay) | mariadb | 10.11.19 | 10.11.19 (held) | 10.11 LTS; `10.11.19` is the newest `10.11.x`. | ## Operator Action Required - **Security (postgres):** PostgreSQL **15.20** is a security release; its notes name **43 CVEs** fixed in this window (`https://www.postgresql.org/docs/release/15.20/`). Same-major, so an existing 15.x `db` volume starts unchanged under 15.20 — nothing to migrate. - **Behavioural caveat (not applicable here):** one 15.20 fix ("composite datums") recommends rebuilding **C-language extensions** for full protection. The recipe runs stock postgres with no custom C extensions, so there is nothing to rebuild. - **No** app/config/env/volume/label changes. No gitea 28.x-specific migration (28.3.0 is already live upstream). - **app.ini writability:** the pre-existing read-only `WORK_PATH` warning is unrelated and untouched; mirror PR **#4** (`fix-app-ini-writable`) remains open for the operator. **Upstream release notes:** app gitea 28.3.0 (already upstream, unchanged here): https://github.com/go-gitea/gitea/releases/tag/v28.3.0 **Upstream release notes:** postgres 15.19→15.20: https://www.postgresql.org/docs/release/15.20/ ## Verification - **Direct `--chaos` deploy on cc-ci** of this exact WIP commit with `COMPOSE_FILE=compose.yml:compose.postgres.yml`, upgrading an already-initialised 15.19 `db` volume **in place**: the new container logs `starting PostgreSQL 15.20`, `database system is ready to accept connections`; Gitea 28.3.0 starts and `GET /api/healthz` returns `{"status":"pass"}` with `database:ping` **pass**. Dev stack torn down fully (0 stacks, no volumes remain). - **Note for CI:** the cc-ci `gitea` suite uses the `compose.sqlite3.yml` overlay, so `!testme` does not exercise the postgres overlay. The postgres bump is therefore validated by the direct dev deploy above, not by the CI card. `!testme` still verifies the recipe PR head is a working recipe. ## Recommended release bump (operator, after merge) `abra recipe release gitea -z` Reasoning: sidecar-only same-major patch/security bump, no new recipe feature surface. That publishes `3.6.12+28.3.0-rootless` from the current `3.6.11+28.3.0-rootless`. Nothing here is merged; this PR awaits operator review. CI verification is run against this one-commit PR head. NOT merged — for operator review. cc @trav @notplants

autonomic-bot added 1 commit 2026-11-13 04:31:11 +00:00

chore: upgrade to 15.20 (postgres db overlay)

cc-ci/testme cc-ci: success

Details

5d4fee6b63

autonomic-bot requested review from trav 2026-11-13 04:31:11 +00:00

autonomic-bot requested review from notplants 2026-11-13 04:31:11 +00:00

autonomic-bot commented

2026-11-13 04:31:22 +00:00

!testme

autonomic-bot commented

2026-11-13 04:31:43 +00:00

🌻 cc-ci — gitea @ 5d4fee6b ✅ passed

full logs · dashboard

🌻 **cc-ci** — `gitea` @ `5d4fee6b` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/148/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/148) [![level](https://ci.autonomic.zone/runs/148/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/148) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/148) · [dashboard](https://ci.autonomic.zone/)

All checks were successful

cc-ci/testme cc-ci: success

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin upgrade-15.20:upgrade-15.20

git checkout upgrade-15.20

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/gitea#13