CI-local Postgres smoke for PR preview burn-in#481
Merged
Conversation
Issue: AP-303
📝 WalkthroughWalkthroughCI now includes a Postgres smoke job that provisions a local PostgreSQL service, runs migrations as the database owner, and executes local smoke tests via the ChangesPostgres Smoke Testing with Label-Gated Preview Deployments
Sequence Diagram(s) sequenceDiagram
participant CI as GitHub Actions (postgres-smoke job)
participant Script as smoke-ci-postgres.mjs
participant Migrate as pnpm --filter `@agent-paste/db` migrate
participant Smoke as smoke-local-mvp.mjs (local harness)
participant DB as PostgreSQL service container
CI->>DB: start postgres:16-alpine (healthchecks)
CI->>Script: run pnpm smoke:ci:postgres with DATABASE_URL & runtime password
Script->>Migrate: run migrations (owner DATABASE_URL)
Migrate->>DB: apply committed migrations
Script->>Smoke: invoke local smoke with runtime app_role URL
Smoke->>DB: connect as app_role (RLS)
DB-->>Smoke: smoke results
Smoke-->>Script: exit status
Script-->>CI: pass/fail
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/agents/workflow/config.md (1)
3-3:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUpdate the "Last updated" date.
The date is stale (2026-06-09), but this PR was created on 2026-06-11 and includes substantive changes to this file.
📅 Proposed fix
-Last updated: 2026-06-09 +Last updated: 2026-06-11🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/agents/workflow/config.md` at line 3, Update the "Last updated" metadata string by replacing the stale date after the literal "Last updated:" with the PR creation date 2026-06-11 so the top-of-file header reflects the current change; edit the line that reads "Last updated: 2026-06-09" to "Last updated: 2026-06-11".
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 240: Replace the floating Postgres tag with a pinned digest: locate the
service declaration that uses "image: postgres:16-alpine" (the Postgres smoke
job/service) and change it to the corresponding image@sha256:<digest> for
postgres:16-alpine so the workflow uses a specific immutable image; obtain the
correct sha256 from Docker Hub or your trusted registry and update the image
string accordingly.
- Around line 257-260: The Checkout step using
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 (labelled "Checkout")
currently leaves the workflow token persisted; update that checkout step to
explicitly set persist-credentials: false so the workflow token is not available
to subsequent git operations.
In @.github/workflows/pr-preview.yml:
- Line 37: Add an unlabeled teardown path so removing the "full-pr-preview"
label immediately destroys resources: update the PR preview workflow condition
(the if using contains(..., 'full-pr-preview')) to not gate teardown-only jobs,
or add a new job triggered on pull_request: types: [unlabeled] that invokes the
existing cleanup logic; ensure this job calls the same cleanup entrypoint used
by .github/workflows/pr-preview-cleanup.yml (cleanup-stale-pr-previews.mjs) and
that the script is updated to treat PRs missing the 'full-pr-preview' label as
stale when invoked for an unlabeled event.
In `@docs/agents/workflow/config.md`:
- Line 151: The phrase "needs deployed" is nonstandard; search for the exact
string "needs deployed" (e.g., the snippet "preview smoke when a PR is labeled
`full-pr-preview` or needs deployed Worker") and replace it across the three
occurrences in the docs with a formal alternative such as "needs to be deployed"
or "requires deployment" so the sentence reads clearly (e.g., "preview smoke
when a PR is labeled `full-pr-preview` or needs to be deployed Worker" → rewrite
to "preview smoke when a PR is labeled `full-pr-preview` or requires a deployed
Worker" or "…or needs to be deployed"). Ensure the replacement preserves
surrounding punctuation and markdown formatting.
In `@scripts/local-jobs-bridge.mjs`:
- Around line 87-111: The createJobsEnv function currently allows both repo and
db to be provided which leads to ambiguous behavior (jobs prefer
LOCAL_MVP_REPOSITORY over DB); modify createJobsEnv to explicitly reject
simultaneous inputs by adding a validation at the start that throws an Error
when both repo and db are present, ensuring callers must pass only one of
LOCAL_MVP_REPOSITORY (repo) or DB; update any tests or callers if needed and
reference createJobsEnv, LOCAL_MVP_REPOSITORY, DB, and createLocalMvpSqlExecutor
to locate the change.
---
Outside diff comments:
In `@docs/agents/workflow/config.md`:
- Line 3: Update the "Last updated" metadata string by replacing the stale date
after the literal "Last updated:" with the PR creation date 2026-06-11 so the
top-of-file header reflects the current change; edit the line that reads "Last
updated: 2026-06-09" to "Last updated: 2026-06-11".
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ae6db5a7-9ef5-46fe-94d7-d1600dede033
📒 Files selected for processing (12)
.github/workflows/ci.yml.github/workflows/pr-preview.ymldocs/agents/workflow/config.mddocs/development.mddocs/ops/first-deploy.mddocs/ops/status/hosted-ops.mddocs/specs/local-dev.mdpackage.jsonscripts/README.mdscripts/local-jobs-bridge.mjsscripts/local-mvp-server.mjsscripts/smoke-ci-postgres.mjs
Issue: AP-303
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/pr-preview-cleanup.yml (1)
24-26:⚠️ Potential issue | 🟠 Major | ⚡ Quick winGrant
issues: writeor drop the PR comments.
github.rest.issues.createComment()uses the Issues API, and GitHub documentsissues: writeas the permission for adding issue comments. With onlycontents: readandpull-requests: write, the cleanup status/failure comment steps can fail and turn a successful cleanup job red. (docs.github.com)Fix
permissions: contents: read + issues: write pull-requests: writeAlso applies to: 111-125
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-preview-cleanup.yml around lines 24 - 26, The workflow's permissions block currently only grants contents: read and pull-requests: write but the job uses github.rest.issues.createComment(), which requires issues: write; update the permissions section to add issues: write (i.e., add "issues: write" alongside the existing keys) so the cleanup status/failure comment steps that call github.rest.issues.createComment() can succeed, or alternatively remove/replace those steps so they don't call the Issues API.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/pr-preview-cleanup.yml:
- Around line 24-26: The workflow's permissions block currently only grants
contents: read and pull-requests: write but the job uses
github.rest.issues.createComment(), which requires issues: write; update the
permissions section to add issues: write (i.e., add "issues: write" alongside
the existing keys) so the cleanup status/failure comment steps that call
github.rest.issues.createComment() can succeed, or alternatively remove/replace
those steps so they don't call the Issues API.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5fc8410b-7865-45db-8097-dcaf2756b4cf
📒 Files selected for processing (7)
.github/workflows/ci.yml.github/workflows/pr-preview-cleanup.ymldocs/agents/workflow/config.mddocs/ops/first-deploy.mddocs/ops/status/hosted-ops.mdscripts/README.mdscripts/local-jobs-bridge.mjs
|
agent-paste PR preview resources were cleaned up. The shared Preview GitHub Environment is retained for future preview deploys. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a CI-local Postgres/RLS smoke path so default PR CI can exercise the database-backed local harness without provisioning Neon branches, Hyperdrive configs, or deployed PR-preview Workers.
Changes
pnpm smoke:ci:postgres, which runs migrations against a Postgres owner URL and drivessmoke-local-mvp.mjsthroughapp_role.Postgres smokeCI job using a job-localpostgres:16-alpineservice.full-pr-previewlabel.Risk: HIGH
app_role/RLS.full-pr-previewwhen deployed Worker evidence is needed.Test plan
pnpm verifypnpm test:coverageDATABASE_URL=postgres://agent_paste:agent_paste@127.0.0.1:55432/agent_paste DATABASE_RUNTIME_ROLE_PASSWORD=agent-paste-ci-app-role pnpm smoke:ci:postgresagainst disposablepostgres:16-alpinegitleaks,biome,prettier-docs,typechecktest-coverage,verifyReview: local
ziw-code-reviewclean after docs correction; CodeRabbit auto-review enabled, no manual trigger.Issue: AP-303
Summary by CodeRabbit
New Features
Documentation