ci: run the @cipherstash/migrate database suites in CI

.github/workflows/tests.yml

@@ -373,10 +373,21 @@ jobs:
       # races destructively under the other suites in parallel forks).
       # (`supabase-push.live.test.ts` gates on different env vars and still
       # skips here — it needs the Supabase CLI binary.)
+      #
+      # PG_TEST_URL runs `@cipherstash/migrate`'s integration suites (forward
+      # and reverse backfill: resume, force obligation, concurrent dual-writes).
+      # They self-skip without it. They need no credentials, but each opens
+      # with DROP SCHEMA cipherstash CASCADE, so they get a database of their
+      # own: turbo runs packages in parallel, and in the shared one that drop
+      # would race the CLI's live suites.
+      - name: Create the migrate integration database
+        run: psql "postgres://cipherstash:password@localhost:5432/cipherstash" -c 'CREATE DATABASE migrate_test'
+
       - name: Run tests
         run: pnpm run test
         env:
           STASH_TEST_DATABASE_URL: postgres://cipherstash:password@localhost:5432/cipherstash
+          PG_TEST_URL: postgres://cipherstash:password@localhost:5432/migrate_test
 
       # CLI E2E tests drive the built `dist/bin/stash.js` through a real
       # pseudo-terminal via node-pty. Run via turbo so the `^build` + `build`

scripts/__tests__/cli-live-postgres-ci.test.mjs

@@ -22,6 +22,32 @@ describe('CLI live-Postgres CI contract', () => {
     )
   })
 
+  // `@cipherstash/migrate`'s integration suites self-skip without PG_TEST_URL,
+  // so a dropped variable reads as a green run. They DROP the `cipherstash`
+  // schema, so they must not share the CLI live suites' database.
+  it('forwards and supplies the migrate integration database URL', () => {
+    const turbo = readJsonc(join(REPO_ROOT, 'turbo.json'))
+    expect(turbo.tasks.test.env).toContain('PG_TEST_URL')
+
+    const workflow = readWorkflow('.github/workflows/tests.yml')
+    const runTests = workflow.jobs['run-tests'].steps.find(
+      (step) => step.name === 'Run tests',
+    )
+    const url = runTests.env.PG_TEST_URL
+    expect(url).toMatch(/^postgres:\/\/[^/]+\/\w+$/)
+    const database = url.split('/').at(-1)
+    expect(database).not.toBe(
+      runTests.env.STASH_TEST_DATABASE_URL.split('/').at(-1),
+    )
+
+    const steps = workflow.jobs['run-tests'].steps
+    const create = steps.findIndex((step) =>
+      String(step.run ?? '').includes(`CREATE DATABASE ${database}`),
+    )
+    expect(create).toBeGreaterThan(-1)
+    expect(create).toBeLessThan(steps.indexOf(runTests))
+  })
+
   it('runs the live reinstall suite against both pre-17 and current Postgres catalogs', () => {
     const workflow = readWorkflow('.github/workflows/tests.yml')
     const runTests = workflow.jobs['run-tests']

turbo.json

@@ -18,7 +18,7 @@
     "test": {
       "dependsOn": ["^build"],
       "inputs": ["$TURBO_DEFAULT$", ".env*"],
-      "env": ["STASH_TEST_DATABASE_URL"],
+      "env": ["STASH_TEST_DATABASE_URL", "PG_TEST_URL"],
       "cache": false
     },
     // `languages/typescript/packages/bench`'s "build" is `tsc --noEmit` — a typecheck, not a bundle —