Jakob Wennberg
5369349e9e
Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override). Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly. Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure. 40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run). Full details in the PR body.
101 lines
3.6 KiB
YAML
101 lines
3.6 KiB
YAML
name: pg-real tests
|
|
|
|
on: [pull_request]
|
|
|
|
# Neither job writes anything back: they read the repo, stand up a throwaway
|
|
# Postgres, and run tests. Without this block both inherit the repository's
|
|
# default token permissions, which are broader than that.
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: pg-real-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
coverage-gate:
|
|
# Enforces the database.md rule: a migration touching a trigger/RPC/RLS/
|
|
# DEFERRABLE must come with a *.pg.test.ts change. Previously instruction-
|
|
# only. Escape hatch: `-- pg-test: covered-by <path>` / `-- pg-test: skip
|
|
# (<reason>)` comments inside the migration.
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
# Full history so the merge-base with the PR base branch exists.
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
|
|
with:
|
|
node-version: 20
|
|
- name: Require pg-real coverage for trigger/RPC/RLS migrations
|
|
env:
|
|
PG_GATE_BASE: origin/${{ github.base_ref }}
|
|
run: node scripts/check-pg-test-coverage.mjs
|
|
|
|
pg-real:
|
|
runs-on: ubuntu-latest
|
|
|
|
services:
|
|
postgres:
|
|
# Supabase image ships the auth schema, auth.uid(), and the extensions
|
|
# (uuid-ossp, pg_cron, btree_gist, vector) this repo's migrations need.
|
|
# Plain postgres:15 would require manual bootstrap SQL.
|
|
image: supabase/postgres:15.8.1.060
|
|
env:
|
|
POSTGRES_PASSWORD: postgres
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U postgres"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
|
|
env:
|
|
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
|
|
PGPASSWORD: postgres
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
# Deliberately no `cache: npm` here. This workflow runs on pull_request
|
|
# only, so the cache is never written on main, and GitHub scopes caches
|
|
# by ref: every PR uploaded its own 284 MB copy under an identical key
|
|
# that no other PR could ever restore. Fourteen dead copies (4 GB, 40% of
|
|
# the repo quota) accumulated in a single day. If this is ever worth
|
|
# caching again, it has to be actions/cache/save on main plus
|
|
# actions/cache/restore here, which is the only shape that gets hits.
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
|
|
with:
|
|
node-version: 20
|
|
|
|
- run: npm ci
|
|
|
|
- name: Install psql client
|
|
run: sudo apt-get update && sudo apt-get install -y --no-install-recommends postgresql-client
|
|
|
|
- name: Bootstrap storage schema
|
|
# The supabase/postgres image ships a partial storage schema; the rest
|
|
# is provisioned by the storage-api service at runtime, which we do
|
|
# not run in CI. This aligns the schema with what migrations expect.
|
|
run: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -q -f tests/pg/bootstrap.sql
|
|
|
|
- name: Apply migrations
|
|
run: |
|
|
set -euo pipefail
|
|
shopt -s nullglob
|
|
files=(supabase/migrations/*.sql)
|
|
if [ ${#files[@]} -eq 0 ]; then
|
|
echo "No migration files found"
|
|
exit 1
|
|
fi
|
|
for f in "${files[@]}"; do
|
|
echo "Applying $f"
|
|
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -q -f "$f"
|
|
done
|
|
|
|
- run: npm run test:pg
|