feat(rds): publish prebuilt fakecloud-postgres images, pull-first runtime

[vieiralucas]

Follow-up to #802 (aws_lambda extension). Moves the custom postgres image build out of every user's first CreateDBInstance and into CI.

Summary

• New workflow .github/workflows/docker-rds-images.yml publishes ghcr.io/faiscadev/fakecloud-postgres:<major>-<fakecloud-version> on each release tag (v*), matrix over postgres 13/14/15/16, multi-arch (linux/amd64 + linux/arm64). Mirrors the structure of docker.yml (per-arch push-by-digest + manifest merge). Each release also gets a rolling :<major> tag.
• workflow_dispatch trigger lets us backfill the existing v0.13.0 tag once this lands; future releases auto-publish.
• RdsRuntime::ensure_postgres_image is now pull-first:
  1. process cache hit → use it
  2. docker image inspect succeeds (already on daemon) → use it
  3. docker pull of the prebuilt tag → use it
  4. fall back to local build from the embedded Dockerfile + extension assets (covers dev / unreleased / airgapped).
• Two env knobs added:
  • FAKECLOUD_POSTGRES_REGISTRY — registry prefix override (default ghcr.io/faiscadev).
  • FAKECLOUD_REBUILD_POSTGRES_IMAGE=1 — skip inspect + pull and force a fresh local build (use after editing the embedded Dockerfile or SQL).
• Drop the per-asset content-hash tag suffix (and the sha2 dep added in feat(rds): support PostgreSQL aws_lambda extension (#800) #802); tag is now <major>-<fakecloud-version>, version-coupled with releases.
• Unit test pins the tag formula across default + override registry paths and a trailing-slash edge case.
• Docs synced: website/content/docs/services/rds.md (new "Prebuilt PostgreSQL image" section + engine-image table updated), website/content/local-rds.md, Dockerfile leading comment.

Test plan

• cargo build -p fakecloud-rds
• cargo test -p fakecloud-rds — 120/120 pass (incl. the new postgres_image_tag_resolves_registry_overrides test)
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo fmt --all
• CI green
• After merge: trigger docker-rds-images.yml via workflow_dispatch against v0.13.0 to backfill; confirm 4 images land on ghcr.io.
• Manual smoke from a fresh machine: docker pull ghcr.io/faiscadev/fakecloud-postgres:16-0.13.0 + aws rds create-db-instance --engine postgres ... shows "Pulling prebuilt fakecloud-postgres image" in logs (not "Building").

---

Summary by cubic

Publishes prebuilt PostgreSQL images and makes the RDS runtime pull-first with a local-build fallback. This removes the first-run build cost and ties images to fakecloud release versions.

• New Features

  • Adds .github/workflows/docker-rds-images.yml to publish ghcr.io/faiscadev/fakecloud-postgres:<major>-<fakecloud-version> for Postgres 13–16 on linux/amd64 and linux/arm64, plus rolling :<major>; supports workflow_dispatch.
  • Runtime resolves images via inspect → pull → build; local build covers dev/unreleased/airgapped; tags are <major>-<fakecloud-version>.
  • Env vars: FAKECLOUD_POSTGRES_REGISTRY (registry override) and FAKECLOUD_REBUILD_POSTGRES_IMAGE=1 (force local build).
  • Drops content-hash tag and the sha2 dependency; docs updated and a unit test pins tag resolution (incl. trailing-slash override).

• Bug Fixes

  • Workflow matrix now cross-products pg_version × platform, building all 8 images (4 majors × 2 arches).

^{Written for commit 9eaddd0. Summary will update on new commits. Review in cubic}

[codecov]

Codecov Report

❌ Patch coverage is 31.50685% with 50 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-rds/src/runtime.rs	31.50%	50 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

1 issue found across 7 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/docker-rds-images.yml">

<violation number="1" location=".github/workflows/docker-rds-images.yml:29">
P1: The build matrix is misconfigured: `include` here does not create a pg-version × platform cross-product, so per-version arm64 images are not generated correctly.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}