From c855f01da5ad716dc4eb25fc0b3db71555cbf6be Mon Sep 17 00:00:00 2001 From: Cayce Date: Tue, 20 Oct 2026 02:21:36 +0000 Subject: [PATCH] audit-6: CI runs migrations + integration against Postgres 16 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ci.yml gains a postgres:16 service; alembic upgrade/downgrade/upgrade round-trip runs on PG, unit tests run -m "not integration", and the roles.sql integration suite runs with a postgresql-client install. (Gate executed locally against Postgres 18.6 — see PR description.) --- .gitea/workflows/ci.yml | 34 +++++++++++++++++++++++++++++++--- .github/workflows/ci.yml | 34 +++++++++++++++++++++++++++++++--- 2 files changed, 62 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index d400fef..f5524d0 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -8,6 +8,21 @@ on: jobs: lint-test-leaks: runs-on: ubuntu-latest + services: + postgres: + image: postgres:16 + env: + POSTGRES_USER: cayce + POSTGRES_PASSWORD: ci-only-not-a-secret + POSTGRES_DB: cayce_ops + ports: + - 5432:5432 + options: >- + --health-cmd "pg_isready -U cayce -d cayce_ops" + --health-interval 5s --health-timeout 3s --health-retries 10 + env: + CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5432/cayce_ops + PGPASSWORD: ci-only-not-a-secret steps: - uses: actions/checkout@v4 with: @@ -23,11 +38,24 @@ jobs: - name: Lint (ruff) run: uv run ruff check . - - name: Migrations smoke test (SQLite) + - name: Migrations upgrade/downgrade round-trip (Postgres 16) + run: | + uv run alembic upgrade head + uv run alembic downgrade 0001 + uv run alembic upgrade head + uv run alembic downgrade base + uv run alembic upgrade head + + - name: Alembic smoke (SQLite) run: uv run alembic upgrade head - - name: Tests (pytest) - run: uv run pytest + - name: Unit tests (pytest) + run: uv run pytest -m "not integration" + + - name: Integration tests — roles.sql + daemon cycles (Postgres 16) + run: | + sudo apt-get update && sudo apt-get install -y postgresql-client + uv run pytest -m integration -v - name: Secret scan (gitleaks, full history) run: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d400fef..f5524d0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,6 +8,21 @@ on: jobs: lint-test-leaks: runs-on: ubuntu-latest + services: + postgres: + image: postgres:16 + env: + POSTGRES_USER: cayce + POSTGRES_PASSWORD: ci-only-not-a-secret + POSTGRES_DB: cayce_ops + ports: + - 5432:5432 + options: >- + --health-cmd "pg_isready -U cayce -d cayce_ops" + --health-interval 5s --health-timeout 3s --health-retries 10 + env: + CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5432/cayce_ops + PGPASSWORD: ci-only-not-a-secret steps: - uses: actions/checkout@v4 with: @@ -23,11 +38,24 @@ jobs: - name: Lint (ruff) run: uv run ruff check . - - name: Migrations smoke test (SQLite) + - name: Migrations upgrade/downgrade round-trip (Postgres 16) + run: | + uv run alembic upgrade head + uv run alembic downgrade 0001 + uv run alembic upgrade head + uv run alembic downgrade base + uv run alembic upgrade head + + - name: Alembic smoke (SQLite) run: uv run alembic upgrade head - - name: Tests (pytest) - run: uv run pytest + - name: Unit tests (pytest) + run: uv run pytest -m "not integration" + + - name: Integration tests — roles.sql + daemon cycles (Postgres 16) + run: | + sudo apt-get update && sudo apt-get install -y postgresql-client + uv run pytest -m integration -v - name: Secret scan (gitleaks, full history) run: |