cayce/cayce-ops
1
0
Fork 0
Code Issues 1 Pull Requests 25 Actions 5 Packages Projects Releases 2 Wiki Activity

audit-6: CI runs migrations + integration against Postgres 16

Browse Source 
ci.yml gains a postgres:16 service; alembic upgrade/downgrade/upgrade
round-trip runs on PG, unit tests run -m "not integration", and the
roles.sql integration suite runs with a postgresql-client install.
(Gate executed locally against Postgres 18.6 — see PR description.)
This commit is contained in:
cayce
2026-10-20 02:21:36 +00:00
parent 56b35d3a63
commit c855f01da5
2 changed files with 62 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+31 -3
View File
@@ -8,6 +8,21 @@ on:
jobs: jobs:
lint-test-leaks: lint-test-leaks:
runs-on: ubuntu-latest runs-on: ubuntu-latest
services:
postgres:
image: postgres:16
env:
POSTGRES_USER: cayce
POSTGRES_PASSWORD: ci-only-not-a-secret
POSTGRES_DB: cayce_ops
ports:
- 5432:5432
options: >-
--health-cmd "pg_isready -U cayce -d cayce_ops"
--health-interval 5s --health-timeout 3s --health-retries 10
env:
CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5432/cayce_ops
PGPASSWORD: ci-only-not-a-secret
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -23,11 +38,24 @@ jobs:
- name: Lint (ruff) - name: Lint (ruff)
run: uv run ruff check . run: uv run ruff check .
- name: Migrations smoke test (SQLite) - name: Migrations upgrade/downgrade round-trip (Postgres 16)
run: |
uv run alembic upgrade head
uv run alembic downgrade 0001
uv run alembic upgrade head
uv run alembic downgrade base
uv run alembic upgrade head
- name: Alembic smoke (SQLite)
run: uv run alembic upgrade head run: uv run alembic upgrade head
- name: Tests (pytest) - name: Unit tests (pytest)
run: uv run pytest run: uv run pytest -m "not integration"
- name: Integration tests — roles.sql + daemon cycles (Postgres 16)
run: |
sudo apt-get update && sudo apt-get install -y postgresql-client
uv run pytest -m integration -v
- name: Secret scan (gitleaks, full history) - name: Secret scan (gitleaks, full history)
run: | run: |
.github/workflows/ci.yml
+31 -3
View File
@@ -8,6 +8,21 @@ on:
jobs: jobs:
lint-test-leaks: lint-test-leaks:
runs-on: ubuntu-latest runs-on: ubuntu-latest
services:
postgres:
image: postgres:16
env:
POSTGRES_USER: cayce
POSTGRES_PASSWORD: ci-only-not-a-secret
POSTGRES_DB: cayce_ops
ports:
- 5432:5432
options: >-
--health-cmd "pg_isready -U cayce -d cayce_ops"
--health-interval 5s --health-timeout 3s --health-retries 10
env:
CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5432/cayce_ops
PGPASSWORD: ci-only-not-a-secret
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
@@ -23,11 +38,24 @@ jobs:
- name: Lint (ruff) - name: Lint (ruff)
run: uv run ruff check . run: uv run ruff check .
- name: Migrations smoke test (SQLite) - name: Migrations upgrade/downgrade round-trip (Postgres 16)
run: |
uv run alembic upgrade head
uv run alembic downgrade 0001
uv run alembic upgrade head
uv run alembic downgrade base
uv run alembic upgrade head
- name: Alembic smoke (SQLite)
run: uv run alembic upgrade head run: uv run alembic upgrade head
- name: Tests (pytest) - name: Unit tests (pytest)
run: uv run pytest run: uv run pytest -m "not integration"
- name: Integration tests — roles.sql + daemon cycles (Postgres 16)
run: |
sudo apt-get update && sudo apt-get install -y postgresql-client
uv run pytest -m integration -v
- name: Secret scan (gitleaks, full history) - name: Secret scan (gitleaks, full history)
run: | run: |