Port stateful credstore gateway

.github/workflows/cfs.yml

@@ -65,8 +65,14 @@ jobs:
           base_ref="${{ github.base_ref }}"
 
           if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$base_ref" ]; then
-            git fetch --no-tags --depth=1 origin "$base_ref"
-            changed_files="$(git diff --name-only "origin/$base_ref"...HEAD)"
+            # Full (not --depth=1) fetch so the three-dot diff can find a merge
+            # base: checkout uses fetch-depth: 0 (full HEAD), so a shallow base
+            # ref has no reachable common ancestor and the diff fails with
+            # "no merge base" (notably on fork PRs). Tolerate a failed fetch and
+            # a failed diff so this detection step never hard-fails the job (the
+            # run shell is `bash -eo pipefail`, so an unguarded fetch would exit).
+            git fetch --no-tags origin "$base_ref" || true
+            changed_files="$(git diff --name-only "origin/$base_ref"...HEAD 2>/dev/null || true)"
           else
             changed_files="$(
               git diff --name-only HEAD~1 HEAD 2>/dev/null || true

config/e2e-local.yaml

@@ -196,6 +196,15 @@ gears:
     config:
       vendor: "constructorfabric"
 
+  credstore:
+    database:
+      server: "sqlite_users"
+      file: "credstore.db"
+    config:
+      # Gateway selects its value-store backend plugin by GTS vendor;
+      # must match static-credstore-plugin (default "constructorfabric").
+      vendor: "constructorfabric"
+
   static-credstore-plugin:
     config:
       secrets:

config/e2e-scope-enforcement.yaml

@@ -25,6 +25,15 @@ logging:
     file_level: debug
 
 gears:
+  credstore:
+    database:
+      server: "sqlite_users"
+      file: "credstore.db"
+    config:
+      # Gateway selects its value-store backend plugin by GTS vendor;
+      # must match static-credstore-plugin (default "constructorfabric").
+      vendor: "constructorfabric"
+
   api-gateway:
     config:
       bind_addr: "0.0.0.0:8086"

config/e2e-tr-authz.yaml

@@ -177,6 +177,15 @@ gears:
     config:
       vendor: "constructorfabric"
 
+  credstore:
+    database:
+      server: "sqlite_users"
+      file: "credstore.db"
+    config:
+      # Gateway selects its value-store backend plugin by GTS vendor;
+      # must match static-credstore-plugin (default "constructorfabric").
+      vendor: "constructorfabric"
+
   static-credstore-plugin:
     config:
       secrets:

config/mini-chat.yaml

@@ -101,6 +101,15 @@ gears:
     config:
       max_field_length: 100
 
+  credstore:
+    database:
+      server: "sqlite_mini_chat"
+      file: "credstore.db"
+    config:
+      # Gateway selects its value-store backend plugin by GTS vendor;
+      # must match static-credstore-plugin (default "constructorfabric").
+      vendor: "constructorfabric"
+
   static-credstore-plugin:
     config:
       secrets:

config/quickstart-windows.yaml

@@ -211,6 +211,15 @@ gears:
           parent_id: "00000000-0000-0000-0000-000000000011"
           status: active
 
+  credstore:
+    database:
+      server: "sqlite_users"
+      file: "credstore.db"
+    config:
+      # Gateway selects its value-store backend plugin by GTS vendor;
+      # must match static-credstore-plugin (default "constructorfabric").
+      vendor: "constructorfabric"
+
   static-credstore-plugin:
     config:
       secrets:

config/quickstart.yaml

@@ -330,6 +330,15 @@ gears:
           parent_id: "00000000-0000-0000-0000-000000000005"
           status: active
 
+  credstore:
+    database:
+      server: "sqlite_users"
+      file: "credstore.db"
+    config:
+      # Gateway selects its value-store backend plugin by GTS vendor;
+      # must match static-credstore-plugin (default "constructorfabric").
+      vendor: "constructorfabric"
+
   static-credstore-plugin:
     config:
       secrets:

config/static-tenants.yaml

@@ -19,6 +19,15 @@ database:
         max_conns: 5
 
 gears:
+  credstore:
+    database:
+      server: "sqlite_test"
+      file: "credstore.db"
+    config:
+      # Gateway selects its value-store backend plugin by GTS vendor;
+      # must match static-credstore-plugin (default "constructorfabric").
+      vendor: "constructorfabric"
+
   api-gateway:
     config:
       bind_addr: "127.0.0.1:8087"