Replace vulnerable inherited gosu helper in postgrest-db image

[Copilot]

The publish workflow was failing in the Trivy gate, not during push. The published postgrest-db image inherited a vulnerable gosu binary from postgres:16, causing the release job to fail before publishing.

• Root cause

  • Trivy findings were attached to usr/local/bin/gosu from the upstream base image.
  • The vulnerable binary was not part of the repo’s SQL/bootstrap logic; it was an inherited runtime helper.

• Image change

  • Override the inherited gosu with a minimal shell wrapper backed by setpriv.
  • Keep the existing entrypoint contract intact: gosu <user> <command> still drops to the target user before exec.

• Container build update

  • Copy the replacement helper into the image at build time.
  • Mark the helper executable alongside the existing init scripts.

• Targeted coverage

  • Add a focused BATS test that verifies the helper runs commands as postgres.

COPY bin/gosu /usr/local/bin/gosu
RUN chmod 0755 /usr/local/bin/gosu /docker-entrypoint-initdb.d/*.sh

[marcvolkert]

Just remove trivy for the moment.

[Copilot]

Just remove trivy for the moment.

Addressed in 0972bd9.

[marcvolkert]

lgtm

[Copilot]

Pull request overview

This PR modifies the publish-postgrest-db GitHub Actions workflow for building and publishing the postgrest-db container image. Based on the diff provided, the change removes the pre-publish Trivy image vulnerability gate (rather than replacing the inherited gosu binary as described in the PR description).

Changes:

• Removed the “Build image for vulnerability scan” step that locally built/loaded the image for scanning.
• Removed the “Scan image with Trivy” step that blocked publishing on HIGH/CRITICAL findings.

Comments suppressed due to low confidence (1)

.github/workflows/publish-postgrest-db.yml:58

• The Trivy vulnerability gate was removed entirely, which changes the workflow from “block publish on HIGH/CRITICAL findings” to “always publish.” This also contradicts the PR description (which says the fix is to replace inherited gosu, not to bypass scanning). If the intent is to keep a security gate, reintroduce the scan step (or an equivalent pre-push image scan).

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: ./postgrest-tandem/image
          file: ./postgrest-tandem/image/Containerfile

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.