ci: Replace ci.yml with better git-hooks check

ansible/vars.yml

@@ -7,9 +7,9 @@ postgres_major:
   - "17"
   - orioledb-17
 postgres_release:
-  postgresorioledb-17: "17.9.0.028-orioledb"
-  postgres17: "17.6.1.175"
   postgres15: "15.14.1.175"
+  postgres17: "17.6.1.175"
+  postgresorioledb-17: "17.9.0.028-orioledb"
 supabase_admin_agent_splay: 30s
 ###############################################################################################################
 # The following block of yaml is for get_url and co throughout the playbook                                   #

nix/hooks.nix

@@ -29,21 +29,47 @@ in
               settings.configPath = "ansible/ansible-lint.yaml";
               verbose = true;
             };
-            no-cli-in-postgres-release = {
+            versioning-scheme = {
               enable = true;
-              name = "no-cli-in-postgres-release";
-              description = "Prevent -cli suffix in postgres_release values in ansible/vars.yml";
-              entry = builtins.toString (
-                pkgs.writeShellScript "no-cli-in-postgres-release" ''
-                  if [ -f ansible/vars.yml ]; then
-                    if ${pkgs.gnugrep}/bin/grep -E '^\s+postgres(orioledb-)?[0-9]+:.*-cli' ansible/vars.yml; then
-                      echo ""
-                      echo "ERROR: postgres_release values in ansible/vars.yml must not contain '-cli' suffix."
-                      echo "The -cli tag is generated automatically by the AMI release workflow."
-                      exit 1
-                    fi
-                  fi
-                ''
+              name = "versioning-scheme";
+              description = "Ensure postgres_release versions match versioning scheme";
+              entry = pkgs.lib.getExe (
+                pkgs.writeShellApplication {
+                  name = "versioning-scheme";
+                  runtimeInputs = with pkgs; [
+                    yq-go
+                  ];
+                  text = ''
+                    exit_code=0
+                    while read -r supa _ version; do
+                      err() { echo "ERROR: postgres_release.$supa=$version is invalid," "$*" >&2; exit_code=1; }
+
+                      flavor=''${supa#postgres*}
+                      major=''${flavor#*-}
+
+                      if [[ $version == *orioledb* ]] && [[ $flavor != orioledb-* ]]; then
+                        err "must not contain orioledb for non-orioledb PGs"
+                        continue
+                      fi
+                      if [[ $version == *-cli ]]; then
+                        err "must not contain -cli suffix"
+                        continue
+                      fi
+
+                      re=^$major
+                      re+='(\.[0-9]+){3}'
+                      if [[ $flavor == orioledb-* ]]; then
+                        re+=-orioledb
+                      fi
+                      re+='(-[0-9a-zA-Z_-]+)?$'
+
+                      if ! [[ $version =~ $re ]]; then
+                        err "does not match $re"
+                      fi
+                    done < <(yq -o props '.postgres_release' ansible/vars.yml)
+                    exit $exit_code
+                  '';
+                }
               );
               files = "^ansible/vars\\.yml$";
               language = "system";