Skip to content

Add pg-tle-test CI job - #16

Merged
jnasbyupgrade merged 8 commits into
masterfrom
fix-claude-review-gate
Jul 31, 2026
Merged

Add pg-tle-test CI job#16
jnasbyupgrade merged 8 commits into
masterfrom
fix-claude-review-gate

Conversation

@jnasbyupgrade

@jnasbyupgrade jnasbyupgrade commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Adds a pg-tle-test CI job, porting the smoke-test portion of cat_tools' pg_tle job (cat_tools#47): builds pg_tle 1.5.2 from source, registers count_nulls purely through pg_tle (never make install'ed), and verifies via bin/assert_fs_clean that nothing touches disk while a fresh CREATE EXTENSION count_nulls resolves and null_count() works. PG matrix is 12-17, pg_tle's own floor. Not porting cat_tools' update-path testing yet - that needs bin/test_existing, which only exists on the still-unmerged extension-update-test/pgxntool-update branches.

Surfaced three real bugs along the way, all fixed: pgtle.sh rejected count_nulls' stable pseudo-version files (pgxntool#57, fixed in pgxntool 2.2.0 via #17); this job's PGTLE_VERSION env var collided with pgxntool's own same-named Makefile variable (pgxntool#78), renamed to PG_TLE_BUILD_VERSION; and the version assertion checked PGXNVERSION instead of the control file's actual default_version.

Also tightens claude-code-review.yml's gate to check the PR author (user.login == 'jnasbyupgrade') rather than same-repo-only, since this repo has another collaborator (decibel) who shouldn't be able to trigger it.

@coderabbitai

coderabbitai Bot commented Jul 25, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0be07124-2606-42ce-a927-fde1788dffe6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix-claude-review-gate

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

… fork

The gate checked github.event.pull_request.head.repo.owner.login == 'jnasbyupgrade',
written back when PRs came from that personal fork. Now that the convention is to
push branches directly to this repo instead (never the fork), every PR's head repo
owner is Postgres-Extensions, not jnasbyupgrade - so the condition never matched and
claude-review silently skipped on every single PR this session (#12, #13, #14 all
show it as skipped). Replaced with head.repo.full_name == github.repository, which
is actually a tighter trust boundary than the old check: it only allows PRs whose
head branch lives in this exact repo, requiring push access here, rather than
naming one specific external fork as trusted.
…h pg_tle

Ports the smoke-test portion of cat_tools' pg-tle-test job (Postgres-Extensions/cat_tools PR #47) so count_nulls gets the same coverage: build pg_tle 1.5.2 from source, register the extension against template1 via pg_tle instead of a filesystem .control file, and verify with bin/assert_fs_clean (copied over unchanged - it's already extension-agnostic) that nothing ever lands on disk while a fresh CREATE EXTENSION count_nulls in a smoke-test db resolves and null_count() actually works.

Matrix is [17, 16, 15, 14, 13, 12] for this job specifically: count_nulls' own supported range is 10-17, but pg_tle 1.5.2 only supports 12+ (pgxntool/pgtle_versions.md), so 10 and 11 are dropped here.

Deliberately NOT porting cat_tools' update-path portion (TEST_EXISTING_DEPLOY=pgtle bin/test_existing update-scenario ...): count_nulls' master has no bin/test_existing at all - that infrastructure only exists on the still-unmerged extension-update-test/pgxntool-update branches. Once that lands, the update-path half of this job can be added the same way cat_tools did it.
@jnasbyupgrade
jnasbyupgrade force-pushed the fix-claude-review-gate branch from d89b461 to 84b21fb Compare July 29, 2026 21:43
…ntool's own Makefile variable

pgxntool's pgtle: target reads a make variable also named PGTLE_VERSION to
restrict SQL generation to one version range. Make auto-imports environment
variables as make variables, so this job's own env: PGTLE_VERSION silently
overrode it: make run-pgtle generated into pg_tle/1.5.2/ (the literal pinned
version, passed straight through as --pgtle-version) instead of the correct
range directory pg_tle/1.5.0+/, then failed when --run looked for that range
directory and it didn't exist. Confirmed reproducing with a one-line
`PGTLE_VERSION=1.5.2 make pgtle`, no CI or database needed. Renamed to
PG_TLE_BUILD_VERSION, which doesn't collide. Filed as
Postgres-Extensions/pgxntool#78 (also affects cat_tools' own pg-tle-test job,
which uses the same env var name, once it upgrades pgxntool - worth a
heads-up there too).
…RSION

PR #13 (merged) flipped count_nulls.control's default_version to the stable
pseudo-version, so a version-less CREATE EXTENSION now installs 'stable', not
the last real release. The smoke test's version assertion still compared
against PGXNVERSION (the PGXN distribution version, from META.in.json, still
1.0.0) - the exact distribution-vs-extension-version distinction RELEASE.md
documents. Confirmed failing in CI (installed=stable expected=1.0.0) and
locally (`make -s print-EXTENSION_count_nulls_VERSION` correctly reports
stable). Fixed to assert against that variable instead.
…me-repo

The same-repo check (head.repo.full_name == github.repository) added earlier this PR only re-established that the fork-era check had gone stale -- it didn't restore the original trust boundary. This repo has another collaborator (decibel) with push access, so any same-repo PR or @claude comment from them would still burn CLAUDE_CODE_OAUTH_TOKEN, which is tied to jnasbyupgrade's personal account. Both workflows now check the actual triggering identity instead: claude-code-review.yml on github.event.pull_request.user.login (the PR's original author, stable across synchronize events and unspoofable by PR content), and claude.yml on github.actor (whoever's comment/review/issue triggered the event) -- correct regardless of whether the PR happens to live in this repo or an external fork.
@jnasbyupgrade jnasbyupgrade changed the title Fix claude-review's trust gate: allow same-repo PRs, not just the old fork Restrict Claude workflows to jnasbyupgrade, add pg-tle-test CI job Jul 30, 2026
# Conflicts:
#	.github/workflows/claude.yml
@jnasbyupgrade
jnasbyupgrade marked this pull request as ready for review July 31, 2026 19:25
@jnasbyupgrade jnasbyupgrade changed the title Restrict Claude workflows to jnasbyupgrade, add pg-tle-test CI job Restrict claude-code-review's trust gate to jnasbyupgrade, add pg-tle-test CI job Jul 31, 2026
@jnasbyupgrade jnasbyupgrade changed the title Restrict claude-code-review's trust gate to jnasbyupgrade, add pg-tle-test CI job Add a pg-tle-test CI job Jul 31, 2026
@jnasbyupgrade jnasbyupgrade changed the title Add a pg-tle-test CI job Add pg-tle-test CI job Jul 31, 2026
pg_tle 1.5.2 already supports PG 12-18 (pgxntool/pgtle_versions.md); count_nulls' own test matrix gains 18 in #21. Verified locally end-to-end: pg_tle 1.5.2 builds against PG 18.4, and count_nulls installs and works when deployed purely through it (matching what this job's steps do in CI).
…to the baseline

Previously make pgtap ran before the pre-pg_tle baseline snapshot, so whatever it put on disk was silently accepted as part of the expected starting state -- if a future pgxntool change to make pgtap ever also happened to touch count_nulls' own files, that would be folded into the baseline unexamined and no later check would ever catch it.

Generalized bin/assert_fs_clean's verify to take the expected new filename as an explicit argument (previously hardcoded to pg_tle.control) so the same snapshot/verify machinery -- diffing against a pre-step baseline rather than assuming a fixed exclude list -- can also assert make pgtap installed exactly pgtap.control and nothing else, before folding that into the real pre-pg_tle baseline. Verified locally: the happy path passes, verify fails loudly if the expected file never appears, and it fails loudly if an unexpected extra file shows up alongside it.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant