Orchestrate managed local Forge migrations - #321
Conversation
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 35664395 | Triggered | Generic Password | 0fd9208 | scripts/ci/prove-installer-managed-migrations.sh | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3a6221c10c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| done | ||
| PATH="$controlled_path" | ||
| export PATH | ||
| run "$description" "$runuser_bin" -u postgres --preserve-environment -- "$MANAGED_LOCAL_BASH" -c 'cd "$1"; case "$2" in |
There was a problem hiding this comment.
On native Linux installs that fall back to runuser or sudo, this command changes to $REPO_ROOT/web after switching to the postgres account. If Forge is checked out beneath a typical 0700 or 0750 home directory, postgres cannot traverse the path, so the first managed migration fails even though PostgreSQL administration was resolved successfully. The mirrored sudo path at line 1601 has the same problem; run the repository code as the invoking user or stage it in a protected, readable location before switching identities.
Useful? React with 👍 / 👎.
| MANAGED_LOCAL_NODE="$(trusted_linux_tool node)" || die "Could not find a root-owned non-writable node for elevated managed migrations." | ||
| MANAGED_LOCAL_NPM="$(trusted_linux_tool npm)" || die "Could not find a root-owned non-writable npm for elevated managed migrations." | ||
| MANAGED_LOCAL_NPX="$(trusted_linux_tool npx)" || die "Could not find a root-owned non-writable npx for elevated managed migrations." |
There was a problem hiding this comment.
On Linux systems where the accepted Node 22 installation comes from nvm, asdf, or another user-managed path, this fixed-path resolver either reports that Node/npm/npx are missing or silently selects an older system Node. ensure_node explicitly accepts the caller's PATH runtime, and --upgrade skips dependency installation, so managed migrations can fail after the installer has already declared the runtime ready. Resolve a compatible protected toolchain from the validated runtime or explicitly verify that the elevated Node is version 22 or newer.
Useful? React with 👍 / 👎.
1 participant
Summary
The native installer-managed local database path now runs the existing versioned migration sequence: release-role bootstrap, migrations through 0025, S3 bootstrap and 0026, S4 bootstrap and 0027, the S5 cleanup wrapper, then the ordinary latest migrator. Custom
DATABASE_URLand Docker paths retain ordinary operator-managed migration behavior.Root cause
A local database at migration 0025 has the release-owner boundary but not the administrator-installed 0026 S3 bootstrap helper. The installer previously invoked ordinary
db:migratedirectly, which failed on the missing helper.Security boundary
Administrator access is process-only through the existing passwordless local peer/socket path. The installer sets
postgresql:///forgewithPGHOST/PGUSER; it does not persist or log an admin credential, change the Forge application role, or alter the existing bootstrap/migration SQL.Validation
bash -n scripts/install.shbash -n scripts/test-install-managed-migrations.shscripts/test-install-managed-migrations.shgit diff --checkcd web && npx tsc --noEmitcd web && npm run lintcd web && npm test -- --run __tests__/epic-172-s3-release.test.ts __tests__/epic-172-s4-context.test.ts(36 tests)The focused harness covers sequencing, mocked current/sudo/runuser peer selection, custom/Docker bypass, dry-run, unavailable admin, S5 failure cleanup intent, idempotent orchestration reruns, and a non-leaking test sentinel. It is wired into Web CI. No live Forge database or installer was run.