Skip to content

Commit 6eebf1d

Browse files
tobyhedetobyhede
committed
ci: gate e2e property suite + unconditional source doc validation (CIP-3141)
Adds a dedicated test:sqlx:e2e mise task and CI job for the proptest-e2e suite (needs ZeroKMS creds; the credential-free shards run the fixture suite), and runs source doc validation unconditionally.
1 parent c55fa2b commit 6eebf1d

3 files changed

Lines changed: 113 additions & 3 deletions

File tree

‎.github/workflows/test-eql.yml‎

Lines changed: 76 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -268,9 +268,13 @@ jobs:
268268
run: |
269269
mise run postgres:up postgres-${POSTGRES_VERSION} --extra-args "--detach --wait"
270270
271-
- name: Validate SQL documentation (Postgres ${{ matrix.postgres-version }})
271+
# Source-only doc checks (coverage + required-tags) moved to the
272+
# unconditional `docs-static` job so they run on every PR (incl. docs-only)
273+
# and exactly once, not per-Postgres. This step keeps only the DB-backed
274+
# SQL-syntax validation, which genuinely needs the per-version Postgres.
275+
- name: Validate documented SQL syntax (Postgres ${{ matrix.postgres-version }})
272276
run: |
273-
mise run docs:validate
277+
mise run docs:validate:documented-sql
274278
275279
- name: Clean-DB v3 install smoke (Postgres ${{ matrix.postgres-version }})
276280
run: |
@@ -460,6 +464,75 @@ jobs:
460464
run: |
461465
mise run --output prefix test:splinter --postgres ${POSTGRES_VERSION}
462466
467+
# Source-only SQL documentation validation (coverage + required Doxygen tags).
468+
# Deliberately NOT relevance-gated: it runs on EVERY pull_request — including
469+
# docs-only PRs that skip the heavy jobs — so documentation is always
470+
# validated. DB-free and creds-free (the psql-backed syntax check stays in the
471+
# per-version `validate` job).
472+
docs-static:
473+
name: "SQL doc validation"
474+
runs-on: blacksmith-16vcpu-ubuntu-2204
475+
steps:
476+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
477+
with:
478+
persist-credentials: false
479+
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
480+
with:
481+
version: 2026.4.0
482+
install: true
483+
cache: true
484+
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
485+
with:
486+
workspaces: .
487+
shared-key: sqlx-tests
488+
save-if: false
489+
- name: Validate SQL doc coverage + required tags
490+
run: |
491+
mise run docs:validate:source
492+
493+
# The e2e (fresh-encryption) property suite. Encrypts random values through
494+
# ZeroKMS at run time, so it needs CS_* creds and is PG-version-independent —
495+
# one PG17 run, never the matrix. Compiles the `proptest-e2e`-gated binaries
496+
# (which the default-feature sharded archive excludes) and runs only the
497+
# e2e oracle. Like build-archive, it holds CS_* and so carries the same
498+
# fork-PR guard to keep the secrets off fork runs.
499+
e2e:
500+
name: "e2e property suite (fresh encryption)"
501+
needs: [changes, setup]
502+
if: >-
503+
(github.event_name == 'merge_group'
504+
|| github.event_name == 'workflow_dispatch'
505+
|| (github.event_name == 'pull_request' && needs.changes.outputs.relevant == 'true'))
506+
&& (github.event_name != 'pull_request'
507+
|| github.event.pull_request.head.repo.full_name == github.repository)
508+
runs-on: blacksmith-16vcpu-ubuntu-2204
509+
env:
510+
POSTGRES_VERSION: "17"
511+
CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
512+
CS_WORKSPACE_CRN: ${{ secrets.CS_WORKSPACE_CRN }}
513+
CS_CLIENT_ID: ${{ secrets.CS_CLIENT_ID }}
514+
CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
515+
steps:
516+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
517+
with:
518+
persist-credentials: false
519+
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
520+
with:
521+
version: 2026.4.0
522+
install: true
523+
cache: true
524+
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
525+
with:
526+
workspaces: .
527+
shared-key: sqlx-tests
528+
save-if: false
529+
- name: Setup database (Postgres 17)
530+
run: |
531+
mise run postgres:up postgres-${POSTGRES_VERSION} --extra-args "--detach --wait"
532+
- name: Run e2e property suite
533+
run: |
534+
mise run test:sqlx:e2e
535+
463536
# The ONE required status check. Stable name on every event, so branch
464537
# protection never references an event-dependent leaf name (which would
465538
# deadlock). Passes iff every needed job is success or skipped. Treating
@@ -469,7 +542,7 @@ jobs:
469542
ci-required:
470543
name: "ci-required"
471544
needs: [changes, setup, build-archive, test, validate, schema, rust-crates,
472-
codegen, self-contained-v3, matrix-coverage, splinter]
545+
codegen, self-contained-v3, matrix-coverage, splinter, docs-static, e2e]
473546
if: always()
474547
runs-on: blacksmith-16vcpu-ubuntu-2204
475548
steps:

‎mise.toml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,22 @@ echo "Running Rust tests..."
8989
cargo test --features proptest-e2e
9090
"""
9191

92+
[tasks."test:sqlx:e2e"]
93+
description = "Run ONLY the e2e (fresh-encryption) property suite — needs ZeroKMS creds"
94+
# Prep builds + migrates + regenerates fixtures (the latter needs CS_* creds,
95+
# which the dedicated CI `e2e` job supplies). The e2e suite is the only one that
96+
# encrypts fresh values through ZeroKMS at run time, so it cannot run from the
97+
# credential-free sharded archive; it gets its own job. The fixture suite (which
98+
# DOES run in the shards) is intentionally excluded here via the `e2e_oracle`
99+
# filter so this job does not duplicate sharded work — it only compiles the
100+
# `proptest-e2e`-gated binaries and runs the fresh-encryption oracle.
101+
depends = ["test:sqlx:prep"]
102+
dir = "{{config_root}}/tests/sqlx"
103+
run = """
104+
echo "Running e2e property suite (fresh ZeroKMS encryption)..."
105+
cargo test --features proptest-e2e e2e_oracle
106+
"""
107+
92108
[tasks."test:sqlx:watch"]
93109
description = "Run SQLx tests in watch mode (rebuild EQL on changes)"
94110
# Same prep as test:sqlx so watch mode starts from a migrated DB + fresh

‎tasks/docs/validate/source.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env bash
2+
#MISE description="Source-only SQL doc validation (coverage + required tags, no DB)"
3+
# Build first so generated encrypted-domain SQL exists under src/.
4+
#MISE depends=["build"]
5+
#
6+
# This is the DB-free subset of `docs:validate`: coverage + required-tags read
7+
# the `--!` doxygen comments out of src/**/*.sql and need no Postgres. It exists
8+
# so CI can validate documentation on EVERY PR (including docs-only PRs that skip
9+
# the heavy, relevance-gated jobs) without standing up a database. The
10+
# `documented-sql` syntax check (which needs psql) stays in the per-Postgres
11+
# `validate` job.
12+
13+
set -e
14+
15+
echo
16+
echo "Checking documentation coverage..."
17+
mise run --output prefix docs:validate:coverage
18+
19+
echo
20+
echo "Validating required tags..."
21+
mise run --output prefix docs:validate:required-tags

0 commit comments

Comments
 (0)