ci: run the @cipherstash/migrate database suites in CI by tobyhede · Pull Request #1295 · cipherstash/stack

tobyhede · 2026-10-20T00:33:19Z

Requested by Toby · project thread

Summary

Before: the @cipherstash/migrate database tests (the package behind stash encrypt backfill and stash decrypt backfill) skipped themselves in CI, because no workflow set PG_TEST_URL. A broken resume, --force or concurrent-write guard could merge on green CI.

After: they run on every PR, in the existing Run Tests job, against its Postgres 16 and 17 containers. A guard test fails if they are switched off again.

Changes

tests.yml: a step creates a migrate_test database on the job's Postgres service, and Run tests sets PG_TEST_URL to it. It is a separate database because each migrate suite starts with DROP SCHEMA cipherstash CASCADE, and turbo runs packages in parallel, so in the shared database that drop would race the CLI's live suites.
turbo.json: the test task passes PG_TEST_URL through (turbo withholds unlisted variables).
scripts/__tests__/cli-live-postgres-ci.test.mjs: fails if PG_TEST_URL, its separate database, or the step that creates that database goes missing.

Verification

pnpm run test:scripts: 79 files, 1417 tests pass (1416 before, plus the new guard).
Locally against Postgres 16 with PG_TEST_URL set, @cipherstash/migrate runs 132 tests and all pass (the suites use a stub decryption client, so they need no CipherStash credentials and no EQL install).
The CI run on this PR is the first real check of the psql step on the runner.

Summary by CodeRabbit

Tests
- Added CI coverage to verify that migration tests use a separate PostgreSQL database.
- Added checks confirming the migration database is created before tests run and remains distinct from the CLI test database.
Chores
- Updated test configuration to pass the migration database connection through the test pipeline.

The migrate integration suites (forward and reverse backfill: resume, the force obligation, the concurrent dual-write guard) skip unless PG_TEST_URL is set, and nothing set it, so they ran nowhere and a skipped suite read as a passing one. The run-tests job now creates a separate migrate_test database on its existing Postgres service and passes PG_TEST_URL through turbo. A separate database because each suite drops the cipherstash schema, which would race the CLI live suites running in parallel in the shared one. A guard test fails if the variable, its database or the step that creates it goes missing. Refs #1294 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018TacM4u97tr5yPAFynxYXW

changeset-bot · 2026-10-20T00:33:26Z

⚠️ No Changeset found

Latest commit: a6891cc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-10-20T00:33:27Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: 24c1b563-04e4-40b4-ba46-45b53062fb91

📥 Commits

Reviewing files that changed from the base of the PR and between 6e9f1ee and a6891cc.

📒 Files selected for processing: 3

.github/workflows/tests.yml
scripts/__tests__/cli-live-postgres-ci.test.mjs
turbo.json

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The test workflow now provisions a separate PostgreSQL database for migrate integration tests and passes its URL through Turbo. A CI contract test checks the database configuration and setup order.

Changes: Migrate integration test CI

Layer / File(s)	Summary
Configure and verify the migrate test database `.github/workflows/tests.yml`, `turbo.json`, `scripts/__tests__/cli-live-postgres-ci.test.mjs`	Turbo tracks `PG_TEST_URL` for the test task. The workflow creates the `migrate_test` database and supplies its URL to tests while retaining `STASH_TEST_DATABASE_URL`. The contract test checks that the URL is configured, uses a distinct database, and is created before tests run.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other · Severity of issue fixed: Medium

Suggested reviewers: auxesis

Merge Risk: ⚪ Minimal · up to a6891

The migrate suites are configured to use their separate database in both Postgres test jobs. No actionable merge-blocking risk remains after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: running the `@cipherstash/migrate` database suites in CI.
Linked Issues check		The changes satisfy issue `#1294`. The existing `run-tests` job uses Postgres 16 and 17 services. It creates `migrate_test` before `Run tests`. The `Run tests` step sets `PG_TEST_URL` to that database. …
Out of Scope Changes check		The changes are limited to the workflow database setup, Turbo environment forwarding, and a CI contract test. Each change supports issue `#1294`. No unrelated implementation change is shown.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Linked Issues check

Explanation

The changes satisfy issue #1294. The existing run-tests job uses Postgres 16 and 17 services. It creates migrate_test before Run tests. The Run tests step sets PG_TEST_URL to that database. turbo.json passes PG_TEST_URL through the test task. The contract test checks the variable, separate database, and creation step. Issue #1193 is a follow-up and does not add a requirement for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-22T00:20:54Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T00:22:23.882613Z	`a6891cc`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

cipherstash-agent

Review attestation — source: Claude Code /code-review medium plus cross-check-review-findings (company-skills), against head a6891cc.

Result: no critical, blocking, or other findings.

Checked:

PG_TEST_URL is read only by the three @cipherstash/migrate integration suites, so no other package starts running.
migrate_test is created before Run tests, and the CI image's cipherstash user owns the container, so CREATE DATABASE is permitted.
The suites' DROP SCHEMA cipherstash CASCADE stays off the CLI's live database.
The migrate vitest config sets fileParallelism: false, so the three suites do not race each other on that schema.
turbo.json passes the variable through, and the new guard test covers the URL, the separate database, and the create step's order.
No changeset is needed for a CI-only change, and no skills are affected.

Existing review feedback holds no findings (changeset-bot and bot status only), so nothing was deduplicated.

Generated by Claude Code

tobyhede self-assigned this Oct 20, 2026

tobyhede marked this pull request as ready for review October 22, 2026 00:20

tobyhede requested a review from a team as a code owner October 22, 2026 00:20

cipherstash-agent reviewed Oct 22, 2026

View reviewed changes

auxesis approved these changes Oct 22, 2026

View reviewed changes

tobyhede merged commit 8b097ef into main Oct 23, 2026
32 checks passed

tobyhede deleted the claude/project-thread-0gkq38 branch October 23, 2026 00:35

Navigation Menu

Repository navigation

ci: run the @cipherstash/migrate database suites in CI - #1295

ci: run the @cipherstash/migrate database suites in CI#1295
tobyhede merged 1 commit into
mainfrom
claude/project-thread-0gkq38

tobyhede commented Oct 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

changeset-bot Bot commented Oct 20, 2026

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

cipherstash-agent left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

tobyhede commented Oct 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Verification

Related

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Oct 20, 2026

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

cipherstash-agent left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tobyhede commented Oct 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading