test(stack): EQL v3 integration harness + shared test kit, and two Supabase adapter fixes (PR1 of 4) #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Integration — Supabase (EQL v3) | |
| # Real ZeroKMS ciphertext, a real PostgREST, and `supabase/postgres` — the only | |
| # job that proves the Supabase v3 adapter's queries return the right rows. The | |
| # unit suites drive a mock that records strings; they cannot. | |
| # | |
| # Separate from `tests.yml` on purpose: these suites need CipherStash credentials | |
| # and a database, and they THROW rather than skip when unconfigured. Keeping them | |
| # out of the unit job is what lets `pnpm test` stay runnable with neither. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'packages/stack/src/supabase/**' | |
| - 'packages/stack/src/eql/v3/**' | |
| - 'packages/stack/integration/**' | |
| - 'packages/test-kit/**' | |
| - 'packages/cli/src/installer/**' | |
| - 'local/docker-compose.supabase.yml' | |
| - 'local/supabase-init.sql' | |
| - '.github/workflows/integration-supabase.yml' | |
| - '.github/actions/integration-setup/**' | |
| pull_request: | |
| branches: ['**'] | |
| paths: | |
| - 'packages/stack/src/supabase/**' | |
| - 'packages/stack/src/eql/v3/**' | |
| - 'packages/stack/integration/**' | |
| - 'packages/test-kit/**' | |
| - 'packages/cli/src/installer/**' | |
| - 'local/docker-compose.supabase.yml' | |
| - 'local/supabase-init.sql' | |
| - '.github/workflows/integration-supabase.yml' | |
| - '.github/actions/integration-setup/**' | |
| jobs: | |
| integration: | |
| name: Supabase v3 integration (db=${{ matrix.db }}) | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| # Fork PRs have no secrets. Skip cleanly rather than fail loudly on something | |
| # the contributor cannot fix — `tests.yml` still gives them a green signal. | |
| if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }} | |
| strategy: | |
| # A one-element matrix, not a cross-product: the Supabase adapter only ever | |
| # runs against the Supabase variant. Kept as a matrix so adding a second | |
| # database is a one-line change. | |
| matrix: | |
| db: [supabase] | |
| env: | |
| CS_WORKSPACE_CRN: ${{ secrets.CS_WORKSPACE_CRN }} | |
| CS_CLIENT_ID: ${{ secrets.CS_CLIENT_ID }} | |
| CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }} | |
| CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }} | |
| # Job-level env, not a `.env` file: `dotenv/config` does not override an | |
| # already-set `process.env`, so these win and no secret is written to disk. | |
| # | |
| # `postgres` here is deliberately NOT a superuser on this image — that is | |
| # what makes the EQL install, the grants, and the ORE opclass skip behave | |
| # as they do on a real Supabase project. | |
| DATABASE_URL: postgres://postgres:password@localhost:55433/postgres | |
| PGRST_URL: http://localhost:55430 | |
| # Scoped to the suites this database serves. The Drizzle suites talk to | |
| # plain Postgres and get their own job; the harness and bloom suites are | |
| # adapter-agnostic and run here because a database is already up. | |
| CS_IT_SUITE: >- | |
| integration/supabase/**/*.integration.test.ts, | |
| integration/harness.integration.test.ts, | |
| integration/match-bloom.integration.test.ts | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ./.github/actions/integration-setup | |
| # Fast pre-flight: fail in seconds if a secret was rotated or cleared, | |
| # before paying for the ~2 GB supabase/postgres pull. The in-test | |
| # `requireIntegrationEnv` is the correctness guarantee; this is the cheap one. | |
| - name: Require CipherStash secrets | |
| uses: ./.github/actions/require-cs-secrets | |
| with: | |
| workspace-crn: ${{ secrets.CS_WORKSPACE_CRN }} | |
| client-id: ${{ secrets.CS_CLIENT_ID }} | |
| client-key: ${{ secrets.CS_CLIENT_KEY }} | |
| client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }} | |
| - name: Start ${{ matrix.db }} | |
| run: docker compose -f local/docker-compose.${{ matrix.db }}.yml up -d --wait | |
| # `globalSetup` installs EQL v3 by shelling out to the real | |
| # `stash eql install --eql-version 3 --supabase --direct`, so an installer | |
| # regression fails here rather than hiding behind a test-only SQL apply. | |
| - name: Supabase v3 integration suites | |
| run: pnpm --filter @cipherstash/stack run test:integration | |
| - name: Stop ${{ matrix.db }} | |
| if: always() | |
| run: docker compose -f local/docker-compose.${{ matrix.db }}.yml down -v |