Release version 1.8.1

The drop_sql loop covered relations, routines, sequences and types but
not pg_collation, so a dump's CREATE COLLATION (OpenProject's ICU
public.versions_name) aborted the ON_ERROR_STOP replay with 'collation
already exists'. Add the fifth UNION ALL branch; DROP COLLATION IF
EXISTS public.<name> CASCADE rides the existing loop, and the loop
already drops every user table, so CASCADE fallout is absorbed by the
IF EXISTS no-ops.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Show docker info
         run: |
@@ -35,7 +35,7 @@ jobs:
 
       - name: Upload E2E artifacts (always)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-artifacts
           path: artifacts
@@ -49,7 +49,7 @@ jobs:
 
     steps:
       - name: Checkout (full history for tags)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -67,7 +67,7 @@ jobs:
           git push -f origin stable
 
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/dependabot-auto-merge.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Fetch dependency metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

CHANGELOG.md

@@ -1,3 +1,40 @@
+# Changelog
+
+## [1.8.1] - 2026-07-12
+
+- Restore: the postgres empty mode also drops user-owned collations in
+  public; dumps containing CREATE COLLATION (e.g. OpenProject's ICU
+  collation versions_name) no longer abort the replay with 'collation
+  already exists'.
+- Maintenance: base image bumped from python 3.11-slim to 3.14-slim.
+
+## [1.8.0] - 2026-07-11
+
+Swarm-aware backups and replayable restores.
+
+- Backup: swarm task containers are never stopped or started manually
+  anymore; they are skipped visibly and backed up hot, while the sql dump
+  stays the consistent database backup.
+- Backup: a container that vanishes between listing and inspect no longer
+  aborts the run; a failing inspect on a container that still exists keeps
+  failing loudly.
+- Backup: pg_dump runs with the no-owner and no-privileges flags so dumps
+  are replayable by the owning app user.
+- Restore: the mariadb empty mode drops all tables in one client session
+  with FOREIGN_KEY_CHECKS disabled; FK-linked parent tables no longer abort
+  the replay with ERROR 1451.
+- Restore: the postgres empty mode drops only current-user-owned objects,
+  and the replay skips superuser-only dump lines without ever touching
+  COPY data blocks.
+- Restore: the replay streams the dump through a temp file instead of
+  buffering it in memory; multi-GB dumps no longer OOM the restore.
+- Tooling: the e2e runner reaches the DinD daemon via docker exec instead
+  of a host-published unencrypted API port.
+- Tooling: new end-to-end test reproducing the swarm stop flake, plus unit
+  tests for the restore filters and the swarm probes; the suite is 36 unit,
+  9 integration and 30 e2e tests.
+- Tooling: Dependabot with auto-merge for minor and patch updates.
+
 ## [1.7.1] - 2026-05-26
 
 * 🔌 MariaDB SQL backups now connect over TCP loopback so the dump always matches the same wildcard-host grant the application uses — no more surprise `ERROR 1045 Access denied` when a localhost-bound auth row preempts.

Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM python:3.11-slim
+FROM python:3.14-slim
 
 WORKDIR /app
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "backup-docker-to-local"
-version = "1.7.1"
+version = "1.8.1"
 description = "Backup Docker volumes to local with rsync and optional DB dumps."
 readme = "README.md"
 requires-python = ">=3.9"

src/baudolo/backup/docker.py

@@ -29,13 +29,20 @@ def is_swarm_task(container: str) -> bool:
     manually: the orchestrator replaces the stopped task and a later
     `docker start` fails on the detached overlay network. A container that
     vanished between listing and inspect (--rm one-shots, task-history GC)
-    counts as not stoppable instead of aborting the whole backup run."""
+    counts as not stoppable instead of aborting the whole backup run; if the
+    container still exists the inspect failure re-raises, so a broken daemon
+    keeps failing the run loudly instead of silently skipping the stop."""
     try:
         out = execute_shell_command(
             "docker inspect --format "
             f"'{{{{index .Config.Labels \"com.docker.swarm.task.id\"}}}}' {container}"
         )
     except BackupException:
+        still_listed = execute_shell_command(
+            f"docker ps -a --filter name=^{container}$ --format '{{{{.Names}}}}'"
+        )
+        if still_listed and still_listed[0].strip():
+            raise
         return True
     return bool(out and out[0].strip())
 

src/baudolo/restore/db/postgres.py

@@ -88,6 +88,11 @@ BEGIN
             OR (t.typtype = 'c' AND EXISTS (
                   SELECT 1 FROM pg_class c2
                    WHERE c2.oid = t.typrelid AND c2.relkind = 'c')))
+    UNION ALL
+    SELECT col.collname AS name, 'COLLATION' AS type
+      FROM pg_collation col JOIN pg_namespace n ON n.oid = col.collnamespace
+     WHERE n.nspname = 'public'
+       AND pg_get_userbyid(col.collowner) = current_user
   ) LOOP
     EXECUTE format('DROP %s IF EXISTS public.%I CASCADE', r.type, r.name);
   END LOOP;

tests/unit/backup/test_docker_swarm.py

@@ -21,7 +21,7 @@ class TestIsSwarmTask(unittest.TestCase):
     @patch.object(
         docker_mod,
         "execute_shell_command",
-        side_effect=BackupException("gone"),
+        side_effect=[BackupException("gone"), []],
     )
     def test_vanished_container_counts_as_not_stoppable(self, _mock) -> None:
         # A container removed between listing and inspect must not abort the
@@ -29,6 +29,18 @@ class TestIsSwarmTask(unittest.TestCase):
         # stop/start and image-inspect path.
         self.assertTrue(docker_mod.is_swarm_task("gone-container"))
 
+    @patch.object(
+        docker_mod,
+        "execute_shell_command",
+        side_effect=[BackupException("daemon hiccup"), ["still-here"]],
+    )
+    def test_inspect_failure_on_existing_container_still_fails(self, _mock) -> None:
+        # If the container still exists, an inspect failure must keep failing
+        # the run: silently skipping the stop would back up a hot volume and
+        # report green without the stop guarantee.
+        with self.assertRaises(BackupException):
+            docker_mod.is_swarm_task("still-here")
+
 
 class TestFilterStoppable(unittest.TestCase):
     @patch.object(docker_mod, "is_swarm_task", side_effect=[False, True, False])

tests/unit/restore/test_postgres_empty_drop.py

@@ -0,0 +1,43 @@
+"""The --empty pre-clean drop must cover every object class a dump can
+re-CREATE ahead of tables; a missed class aborts the replay under
+ON_ERROR_STOP (OpenProject's ICU collation public.versions_name did)."""
+
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from baudolo.restore.db import postgres
+
+
+class TestPostgresEmptyDrop(unittest.TestCase):
+    def _drop_sql(self) -> str:
+        with tempfile.NamedTemporaryFile(suffix=".sql") as fh:
+            Path(fh.name).write_bytes(b"SELECT 1;\n")
+            with mock.patch.object(postgres, "docker_exec") as run:
+                postgres.restore_postgres_sql(
+                    container="c",
+                    db_name="db",
+                    user="u",
+                    password="p",
+                    sql_path=fh.name,
+                    empty=True,
+                )
+        first_call = run.call_args_list[0]
+        return first_call.kwargs["stdin"].decode()
+
+    def test_drop_covers_collations(self) -> None:
+        sql = self._drop_sql()
+        self.assertIn("pg_collation", sql)
+        self.assertIn("'COLLATION' AS type", sql)
+        self.assertIn("pg_get_userbyid(col.collowner) = current_user", sql)
+
+    def test_drop_still_covers_the_other_classes(self) -> None:
+        sql = self._drop_sql()
+        for marker in ("pg_class", "pg_proc", "'SEQUENCE' AS type", "'TYPE' AS type"):
+            self.assertIn(marker, sql)
+        self.assertIn("DROP %s IF EXISTS public.%I CASCADE", sql)
+
+
+if __name__ == "__main__":
+    unittest.main()