One --exclude-table-data flag shrinks this nightly Postgres backup; a separate R2 lifecycle rule keeps it a year

`--exclude-table-data` keeps the table and drops the rows. The core archive still carries catalog.products' table definition, its indexes and its constraints ^[5]. Restore it and you get a schema-complete database with one empty table. You refill that table from whatever built the catalogue in the first place.

The split pays only when the big table is the rebuildable one. At Munchable the catalogue is roughly 400 MB, dominates the dump, and is the half that could be regenerated ^[6]. Accounts, entitlements, contribution rewards and their revisions, consent records, support threads and the curated taxonomy come to a few megabytes and cannot be ^[7].

The full dump is kept about 30 days and the core dump for a year ^[4][5], roughly twelve times as long for the archive that is cheap to hold ^[22]. Neither number is enforced by the job. The bucket has lifecycle rules per prefix instead ^[9], and the post is blunt about why: "The workflow never deletes anything, because deleting backups from CI is how you lose them to a date-math bug." ^[10] Both prefixes together fit inside R2's free storage tier at effectively zero cost ^[8].

The failure that started the hardening was a connection string ^[11]. The provider offers three ways in and two of them cannot work from this runner ^[12]. The direct host is IPv6-only on this plan and GitHub's hosted runners are IPv4-only ^[13]. The transaction pooler on port 6543 is the app's own DATABASE_URL, and pg_dump cannot run against it because transaction mode does not provide the session-level features it needs ^[14]. Only the session pooler on 5432 works ^[15].

So the job now reads the host and port out of the secret, tests them against those two cases, and exits in the first seconds with an error annotation that names the fix ^[15]. It never parses the password, and the post justifies reading the host by pointing out that libpq prints it in its own errors anyway ^[16]. Each message points at docs/DB-BACKUPS.md, so whoever opens a red run at 4am has somewhere to go ^[17].

Then two commands per file. `test -s` catches the zero-byte dump, and `pg_restore --list` parses the whole table of contents, which is how a dump that died halfway gets caught without a restore ^[18]. The third check compares the two file sizes: if the core dump is not smaller than the full one, `--exclude-table-data` matched nothing, most likely because the bulk table was renamed ^[19]. That one only warns; the job keeps going ^[19].

Upload order is deliberate. The small archive goes first, so a failure on the larger upload still leaves the important half in the bucket ^[20]. The write-up also notes that the runner ships an older Postgres client whose PATH entry wins by default ^[21].

Little of this is a template. The endpoint rules are one provider's topology ^[12][13] and the zero-cost figure is Cloudflare's pricing ^[8]. The transferable part is smaller: check the endpoint before running a dump against it, and parse the archive before trusting it. The post covers one repository.