Postulo/postulo

Watch

Fork 0

CI: reach each run's PostgreSQL by a name of its own; move brotli past PYSEC-2026-4322 #1040

Merged

tiagoagueda merged 3 commits from ci-postgres-own-host into main

2026-10-23 15:44:36 +00:00

tiagoagueda commented

2026-10-23 14:35:13 +00:00

Owner

Two things fail on main and on every pull request, and neither is the change being proposed. They come in one pull request so that main turns green in one run. Supersedes #1039.

1. PostgreSQL tests: each run reaches its own server

On this runner every job joins the shared forgejo network. Every run's PostgreSQL service was called db, so when two runs overlapped (the push run and the pull-request run of one commit, or two pull requests), Docker's DNS answered db with either server. A test created test_postulo on one server, and pg_dump, psql or the teardown looked for it on the other: FATAL: database "test_postulo" does not exist. This failed #1038 and #1039.

The service gets a second network name, made of the run id and attempt: --network-alias db-${{ github.run_id }}-${{ github.run_attempt }}.
The job's PG_HOST holds that name, and the four connection strings use it.

2. Security audit: brotli

pip-audit --strict reports PYSEC-2026-4322 against brotli 1.2.0, fixed in 1.2.1: uv lock --upgrade-package brotli, nothing else moves.

Tests

zizmor (the workflow lint CI runs): no findings.
tests/test_image_build.py, tests/test_release_tools.py, tests/test_security_audit.py: 103 passed.
The audit over the new lock: no known vulnerabilities.
This run's own PostgreSQL job is the real check that the runner accepts the alias.

🤖 Generated with Claude Code

Two things fail on `main` and on every pull request, and neither is the change being proposed. They come in one pull request so that `main` turns green in one run. Supersedes #1039. ## 1. PostgreSQL tests: each run reaches its own server On this runner every job joins the shared `forgejo` network. Every run's PostgreSQL service was called `db`, so when two runs overlapped (the push run and the pull-request run of one commit, or two pull requests), Docker's DNS answered `db` with either server. A test created `test_postulo` on one server, and `pg_dump`, `psql` or the teardown looked for it on the other: `FATAL: database "test_postulo" does not exist`. This failed #1038 and #1039. - The service gets a second network name, made of the run id and attempt: `--network-alias db-${{ github.run_id }}-${{ github.run_attempt }}`. - The job's `PG_HOST` holds that name, and the four connection strings use it. ## 2. Security audit: brotli `pip-audit --strict` reports PYSEC-2026-4322 against brotli 1.2.0, fixed in 1.2.1: `uv lock --upgrade-package brotli`, nothing else moves. ## Tests - `zizmor` (the workflow lint CI runs): no findings. - `tests/test_image_build.py`, `tests/test_release_tools.py`, `tests/test_security_audit.py`: 103 passed. - The audit over the new lock: no known vulnerabilities. - This run's own PostgreSQL job is the real check that the runner accepts the alias. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 2 commits

2026-10-23 14:35:13 +00:00

CI: reach each run's PostgreSQL by a name of its own fd6236b0ee

The runner puts every job on one shared network, so two runs' db services answered to the
same name: a test created its database on one server and pg_dump looked for it on the other
("database test_postulo does not exist"). The service gets an alias made of the run id and
attempt, and the job connects to that.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Move brotli to 1.2.1, past PYSEC-2026-4322

CI / Unit tests and coverage (Python 3.14) (pull_request) Successful in 12m45s

Details

CI / Checks: lint, migrations, catalogues, settings, built files (pull_request) Successful in 2m33s

Details

CI / Database tests on PostgreSQL (pull_request) Failing after 1m13s

Details

CI / Security audit (pull_request) Successful in 53s

Details

CI / Browser tests (Chromium) (pull_request) Has been cancelled

Details

03b2fa1b85

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda referenced this pull request

2026-10-23 14:35:21 +00:00

Move brotli to 1.2.1, past PYSEC-2026-4322 #1039

tiagoagueda added 1 commit

2026-10-23 15:14:20 +00:00

Find this run's PostgreSQL server by a password of its own

CI / Unit tests and coverage (Python 3.14) (pull_request) Successful in 12m38s

Details

CI / Checks: lint, migrations, catalogues, settings, built files (pull_request) Successful in 2m37s

Details

CI / Database tests on PostgreSQL (pull_request) Successful in 3m24s

Details

CI / Security audit (pull_request) Successful in 52s

Details

CI / Browser tests (Chromium) (pull_request) Successful in 29m31s

Details

5205e8dab4

The runner drops a service's --network-alias, so the run-unique name never
resolved and the job failed at its first connection. Each run's server now
has a password unique to the run, and a step keeps the one address behind
`db` that accepts it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda merged commit cc1bb9375d into main

2026-10-23 15:44:36 +00:00

tiagoagueda deleted branch ci-postgres-own-host

2026-10-23 15:44:36 +00:00

tiagoagueda referenced this pull request from a commit

2026-10-23 15:44:37 +00:00

CI: reach each run's PostgreSQL by a name of its own; move brotli past PYSEC-2026-4322 (#1040)