fix(ci): pin current DHI postgres index

Author: terion-labs

.github/workflows/mirror-hardened-images.yml

@@ -33,10 +33,10 @@ jobs:
             target_digest: sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de
             arches: amd64,arm64
           - name: postgres
-            source: dhi.io/postgres@sha256:e8327d2f17677e94b5337a8bde47092d841bb10b718a2f77d4cd8a913b31f0e6
+            source: dhi.io/postgres@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed
             target: ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22
             package: terrarium-dhi-postgres
-            source_digest: sha256:e8327d2f17677e94b5337a8bde47092d841bb10b718a2f77d4cd8a913b31f0e6
+            source_digest: sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed
             target_digest: auto
             arches: amd64,arm64
     env:

ansible/roles/idp_zitadel/defaults/main.yml

@@ -14,7 +14,7 @@ terrarium_docker_registry_config_path: /root/.docker/config.json
 terrarium_docker_hardened_images: auto
 terrarium_docker_hardened_image_mirrors: true
 terrarium_zitadel_postgres_image: ""
-terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22@sha256:e8327d2f17677e94b5337a8bde47092d841bb10b718a2f77d4cd8a913b31f0e6"
+terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed"
 terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22"
 terrarium_zitadel_postgres_image_fallback: "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308"
 terrarium_zitadel_pat_expiration: "2099-01-01T00:00:00Z"

ansible/site.yml

@@ -57,7 +57,7 @@
     terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de"
     terrarium_oauth2_proxy_image_fallback: "quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd"
     terrarium_zitadel_postgres_image: ""
-    terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22@sha256:e8327d2f17677e94b5337a8bde47092d841bb10b718a2f77d4cd8a913b31f0e6"
+    terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed"
     terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22"
     terrarium_zitadel_postgres_image_fallback: "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308"
     terrarium_email: ""

tests/ansible-bootstrap-cert.test.ts

@@ -4,7 +4,7 @@ import { describe, expect, test } from "bun:test";
 
 const repoRoot = join(import.meta.dir, "..");
 const POSTGRES_DHI_IMAGE =
-  "dhi.io/postgres:17.9-alpine3.22@sha256:e8327d2f17677e94b5337a8bde47092d841bb10b718a2f77d4cd8a913b31f0e6";
+  "dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed";
 const POSTGRES_MIRROR_IMAGE =
   "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22";
 const POSTGRES_FALLBACK_IMAGE =

tests/hardened-image-mirror.test.ts

@@ -6,7 +6,7 @@ const repoRoot = join(import.meta.dir, "..");
 
 const OAUTH2_PROXY_DIGEST = "sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e";
 const OAUTH2_PROXY_MIRROR_DIGEST = "sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de";
-const POSTGRES_DIGEST = "sha256:e8327d2f17677e94b5337a8bde47092d841bb10b718a2f77d4cd8a913b31f0e6";
+const POSTGRES_DIGEST = "sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed";
 
 describe("Docker Hardened Image mirror workflow", () => {
   test("mirrors pinned multi-arch DHI indexes to GHCR with digest checks", () => {