chore: build image for postgres python utils

.github/workflows/mozcloud-publish.yaml

@@ -89,3 +89,28 @@ jobs:
       dockerfile_path: tools/spanner/Dockerfile
       image_build_context: tools/spanner
       should_tag_ghcr: true
+
+  build-and-push-syncstorage-rs-postgres-python-utils:
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'push' &&
+        startsWith(github.ref, 'refs/tags/')
+      ) ||
+      (
+        github.event_name == 'pull_request' &&
+        contains(github.event.pull_request.labels.*.name, 'preview') &&
+        github.event.pull_request.head.repo.full_name == github.repository
+      )
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@1b87069d293273436a84dff04954a8950d3ff9ca # v6.1.0
+    with:
+      image_name: syncstorage-rs-postgres-python-utils
+      gar_name: sync-prod
+      project_id: moz-fx-sync-prod
+      dockerfile_path: tools/postgres/Dockerfile
+      image_build_context: tools/postgres
+      should_tag_ghcr: true

tools/postgres/Dockerfile

@@ -0,0 +1,27 @@
+FROM python:3.13-bookworm
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=off \
+    PIP_DISABLE_PIP_VERSION_CHECK=on \
+    PIP_DEFAULT_TIMEOUT=100 \
+    POETRY_VERSION=2.1.3 \
+    POETRY_NO_INTERACTION=1 \
+    POETRY_VIRTUALENVS_CREATE=false \
+    POETRY_CACHE_DIR='/var/cache/pypoetry' \
+    POETRY_HOME='/usr/local'
+
+RUN curl -sSL https://install.python-poetry.org | python3 -
+
+WORKDIR /app/
+
+COPY purge_ttl.py poetry.lock pyproject.toml /app/
+RUN python3 --version
+
+RUN poetry config virtualenvs.create false && \
+    poetry install --without dev --no-interaction --no-ansi
+
+USER nobody
+
+ENTRYPOINT ["/usr/local/bin/python"]
+CMD ["/app/purge_ttl.py"]