build-package (all-pg-azure-storage): `citus/packaging:ubuntu-focal-all release` exits 1 silently after PG-version banner

[ihalatci]

Symptom

On migrate/all-pg-azure-storage-app-token, the build-package "Build packages" step runs docker run citus/packaging:ubuntu-focal-all release, prints only its 3-line PostgreSQL-version banner, then exits 1 with NO inner build error and NO auth error. Publish is correctly skipped (branch ≠ MAIN_BRANCH).

Evidence it is NOT the token migration and NOT the pin

• App-token steps GREEN in all runs (mint / export both GH_TOKEN+GITHUB_TOKEN / clone tools).
• Pin EXONERATED: run 28519513963 (SHA 45745bf) reverted the tools pin to the last-green v0.8.28 and failed identically to the v0.8.36 runs (28518692981, 28519998752).
• Access CONFIRMED by owner: cituspackagingapp has access to citusdata/pgazure.
• Same-day all-citus v0.8.36 app-token build-package (28505518289) was fully GREEN.

Classification

H1 — environmental drift of the mutable citus/packaging:ubuntu-focal-all image between the last green base run 27188719742 (2026-06-09, SHA e6d4079, unmigrated) and 2026-07-01. Base branch e6d4079 sat unmigrated and was NOT re-run in that window, so there is no same-period unmigrated control on this image.

Suggested owner follow-up (not done here)

• Inspect the focal-all container's inner stderr (raw log zip).
• Compare the current citus/packaging:ubuntu-focal-all digest vs the 2026-06-09 build.
• And/or run a fully-unmigrated (v0.8.28 + org PAT, app-token block removed) build-package from e6d4079 on a throwaway branch to definitively separate H1 from any residual token interaction (publish stays gated OFF on a non-MAIN branch).

Related

Blocks merge of the GitHub App token migration PR #1192 (merge held pending resolution).

[ihalatci]

Migration PR: #1192 (merge held pending resolution of this base-image red).