test(integration): port the wire suite, drop its gate, wire up CI

coderdan · coderdan · commit 8f9df8b54a5b · 2026-07-10T23:14:50.000+10:00
Completes the Supabase half of PR1. 655 tests now run in one job against real
ZeroKMS ciphertext, a real PostgREST, and supabase/postgres.

- `supabase-v3-pgrest-live.test.ts` moves to `integration/supabase/wire.
  integration.test.ts`, de-gated. It is NOT superseded by the real-crypto
  matrix: it uniquely proves the 23514 rejection of a narrowed encryptQuery
  term (a shape the adapter cannot produce, so it must be hand-built), dense
  PostgREST parse edges, plaintext-passthrough containment, and the grants as
  `anon`. Its stubbed ZeroKMS is the point — it needs no credentials.

  Its `installEqlV3IfNeeded` + `SUPABASE_PERMISSIONS_SQL_V3` calls are gone:
  `globalSetup` installs both by running the real `stash eql install
  --eql-version 3 --supabase --direct`. Re-applying them here would only have
  tested a hand-rolled approximation of the installer.

- `LIVE_SUPABASE_PGREST_ENABLED` / `describeLiveSupabasePgrest` are deleted along
  with the `live-coverage-guard` assertion that policed them. The guard existed
  because a false gate meant a silent whole-suite skip on a green job; a suite
  that throws needs no such guard. The remaining `LIVE_*` gates and their
  assertions stay — their suites have not moved.

- `tests.yml` loses the PostgREST step and `PGRST_URL`. The moved suite was its
  only consumer, so the unit job no longer starts a container it does not need.

- `integration-supabase.yml` runs the suites on `supabase/postgres` + PostgREST,
  fork-PR gated, secrets passed as job env rather than written to a `.env`.
  `CS_IT_SUITE` scopes the run to the suites this database serves, so the
  Drizzle suites (plain Postgres, no PostgREST) can have their own job without
  either provisioning the other's dependencies.

Verified: 655 pass / 8 skipped under the exact CI invocation; `pnpm test` still
runs 1554 unit tests and zero integration tests; both typechecks clean.
diff --git a/.github/workflows/integration-supabase.yml b/.github/workflows/integration-supabase.yml
@@ -0,0 +1,99 @@
+name: Integration — Supabase (EQL v3)
+
+# Real ZeroKMS ciphertext, a real PostgREST, and `supabase/postgres` — the only
+# job that proves the Supabase v3 adapter's queries return the right rows. The
+# unit suites drive a mock that records strings; they cannot.
+#
+# Separate from `tests.yml` on purpose: these suites need CipherStash credentials
+# and a database, and they THROW rather than skip when unconfigured. Keeping them
+# out of the unit job is what lets `pnpm test` stay runnable with neither.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'packages/stack/src/supabase/**'
+      - 'packages/stack/src/eql/v3/**'
+      - 'packages/stack/integration/**'
+      - 'packages/test-kit/**'
+      - 'packages/cli/src/installer/**'
+      - 'local/docker-compose.supabase.yml'
+      - 'local/supabase-init.sql'
+      - '.github/workflows/integration-supabase.yml'
+      - '.github/actions/integration-setup/**'
+  pull_request:
+    branches: ['**']
+    paths:
+      - 'packages/stack/src/supabase/**'
+      - 'packages/stack/src/eql/v3/**'
+      - 'packages/stack/integration/**'
+      - 'packages/test-kit/**'
+      - 'packages/cli/src/installer/**'
+      - 'local/docker-compose.supabase.yml'
+      - 'local/supabase-init.sql'
+      - '.github/workflows/integration-supabase.yml'
+      - '.github/actions/integration-setup/**'
+
+jobs:
+  integration:
+    name: Supabase v3 integration (db=${{ matrix.db }})
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # Fork PRs have no secrets. Skip cleanly rather than fail loudly on something
+    # the contributor cannot fix — `tests.yml` still gives them a green signal.
+    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+
+    strategy:
+      # A one-element matrix, not a cross-product: the Supabase adapter only ever
+      # runs against the Supabase variant. Kept as a matrix so adding a second
+      # database is a one-line change.
+      matrix:
+        db: [supabase]
+
+    env:
+      CS_WORKSPACE_CRN: ${{ secrets.CS_WORKSPACE_CRN }}
+      CS_CLIENT_ID: ${{ secrets.CS_CLIENT_ID }}
+      CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
+      CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
+      # Job-level env, not a `.env` file: `dotenv/config` does not override an
+      # already-set `process.env`, so these win and no secret is written to disk.
+      #
+      # `postgres` here is deliberately NOT a superuser on this image — that is
+      # what makes the EQL install, the grants, and the ORE opclass skip behave
+      # as they do on a real Supabase project.
+      DATABASE_URL: postgres://postgres:password@localhost:55433/postgres
+      PGRST_URL: http://localhost:55430
+      # Scoped to the suites this database serves. The Drizzle suites talk to
+      # plain Postgres and get their own job; the harness and bloom suites are
+      # adapter-agnostic and run here because a database is already up.
+      CS_IT_SUITE: >-
+        integration/supabase/**/*.integration.test.ts,
+        integration/harness.integration.test.ts,
+        integration/match-bloom.integration.test.ts
+
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/integration-setup
+
+      # Fast pre-flight: fail in seconds if a secret was rotated or cleared,
+      # before paying for the ~2 GB supabase/postgres pull. The in-test
+      # `requireIntegrationEnv` is the correctness guarantee; this is the cheap one.
+      - name: Require CipherStash secrets
+        uses: ./.github/actions/require-cs-secrets
+        with:
+          workspace-crn: ${{ secrets.CS_WORKSPACE_CRN }}
+          client-id: ${{ secrets.CS_CLIENT_ID }}
+          client-key: ${{ secrets.CS_CLIENT_KEY }}
+          client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }}
+
+      - name: Start ${{ matrix.db }}
+        run: docker compose -f local/docker-compose.${{ matrix.db }}.yml up -d --wait
+
+      # `globalSetup` installs EQL v3 by shelling out to the real
+      # `stash eql install --eql-version 3 --supabase --direct`, so an installer
+      # regression fails here rather than hiding behind a test-only SQL apply.
+      - name: Supabase v3 integration suites
+        run: pnpm --filter @cipherstash/stack run test:integration
+
+      - name: Stop ${{ matrix.db }}
+        if: always()
+        run: docker compose -f local/docker-compose.${{ matrix.db }}.yml down -v
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -103,34 +103,6 @@ jobs:
           echo "CS_CLIENT_ACCESS_KEY=${{ secrets.CS_CLIENT_ACCESS_KEY }}" >> ./packages/protect/.env
           echo "DATABASE_URL=postgres://cipherstash:password@localhost:5432/cipherstash" >> ./packages/protect/.env
 
-      # PostgREST for `supabase-v3-pgrest-live.test.ts` — the only suite that
-      # executes the supabase v3 adapter against a real server rather than a
-      # mock that records strings.
-      #
-      # Started as a STEP, not a `services:` entry. The role it connects as
-      # (`authenticator`, a non-superuser member of `anon`) does not exist in
-      # the postgres image, and service containers all start before the repo is
-      # checked out — so there is no point at which a `services:` PostgREST
-      # could find it. A step runs after the roles exist, deterministically.
-      #
-      # `PGRST_DB_ANON_ROLE: anon` is the whole point: pointing it at the DB
-      # owner would make every grant check pass vacuously.
-      - name: Start PostgREST
-        run: |
-          PGPASSWORD=password psql -h localhost -U cipherstash -d cipherstash \
-            -v ON_ERROR_STOP=1 -f ./local/postgrest-roles.sql
-          docker run -d --name postgrest --network host \
-            -e PGRST_DB_URI="postgres://authenticator:authpass@localhost:5432/cipherstash" \
-            -e PGRST_DB_SCHEMAS=public \
-            -e PGRST_DB_ANON_ROLE=anon \
-            -e PGRST_DB_CHANNEL_ENABLED=true \
-            postgrest/postgrest:v12.2.12
-          for i in $(seq 1 30); do
-            curl -sf -o /dev/null http://localhost:3000/ && exit 0
-            sleep 1
-          done
-          echo "PostgREST did not become ready"; docker logs postgrest; exit 1
-
       - name: Create .env file in ./packages/stack/
         run: |
           touch ./packages/stack/.env
@@ -139,7 +111,6 @@ jobs:
           echo "CS_CLIENT_KEY=${{ secrets.CS_CLIENT_KEY }}" >> ./packages/stack/.env
           echo "CS_CLIENT_ACCESS_KEY=${{ secrets.CS_CLIENT_ACCESS_KEY }}" >> ./packages/stack/.env
           echo "DATABASE_URL=postgres://cipherstash:password@localhost:5432/cipherstash" >> ./packages/stack/.env
-          echo "PGRST_URL=http://localhost:3000" >> ./packages/stack/.env
 
       - name: Create .env file in ./packages/protect-dynamodb/
         run: |
diff --git a/packages/stack/__tests__/helpers/live-gate.ts b/packages/stack/__tests__/helpers/live-gate.ts
@@ -51,24 +51,8 @@ export const LIVE_PG_ENABLED = Boolean(process.env.DATABASE_URL)
 
 export const describeLivePgOnly = LIVE_PG_ENABLED ? describe : describe.skip
 
-/**
- * True when a real PostgREST is reachable AND a `DATABASE_URL` is configured.
- *
- * The supabase v3 adapter talks to PostgREST, not to Postgres — the aliasing
- * `prop:db_name::jsonb` casts, the `cs` containment mapping, the quoted
- * envelopes inside `or=(…)`, and the full storage envelope every `public.*`
- * domain CHECK must accept are all things only a real server can execute.
- * Everything else in the repo asserts them as strings against a mock.
- *
- * NO CipherStash creds: the suite builds structurally-valid envelopes itself
- * (the domain CHECKs are structural — `v`/`i`/`c` plus the domain's index
- * terms), so it can run wherever the DB-only suites run. It proves the WIRE and
- * the GRANTS. Cryptographic round-tripping is `drizzle-v3/operators-live-pg`'s
- * job and needs the credentials.
- */
-export const LIVE_SUPABASE_PGREST_ENABLED =
-  Boolean(process.env.PGRST_URL) && LIVE_PG_ENABLED
-
-export const describeLiveSupabasePgrest = LIVE_SUPABASE_PGREST_ENABLED
-  ? describe
-  : describe.skip
+// The PostgREST gate (`LIVE_SUPABASE_PGREST_ENABLED` / `describeLiveSupabasePgrest`)
+// is gone. Its only consumer, `supabase-v3-pgrest-live.test.ts`, moved to
+// `integration/supabase/wire.integration.test.ts`, which THROWS on missing
+// configuration instead of skipping — so no gate, and nothing for the
+// coverage guard to assert.
diff --git a/packages/stack/__tests__/live-coverage-guard.test.ts b/packages/stack/__tests__/live-coverage-guard.test.ts
@@ -57,7 +57,6 @@ import {
   LIVE_EQL_V3_PG_ENABLED,
   LIVE_LOCK_CONTEXT_ENABLED,
   LIVE_PG_ENABLED,
-  LIVE_SUPABASE_PGREST_ENABLED,
 } from './helpers/live-gate'
 
 // GitHub Actions always sets CI=true; treat any truthy CI as "must run live".
@@ -125,26 +124,6 @@ describe('live-coverage guard', () => {
     },
   )
 
-  it.runIf(IN_CI)(
-    'CI must have PGRST_URL so the live supabase PostgREST suite does not silently skip',
-    () => {
-      expect(
-        LIVE_SUPABASE_PGREST_ENABLED,
-        'CI must run the live supabase PostgREST suite — ' +
-          '`LIVE_SUPABASE_PGREST_ENABLED` is false. This needs a ' +
-          '`DATABASE_URL` AND a `PGRST_URL` pointing at the pinned ' +
-          '`postgrest/postgrest` service in .github/workflows/tests.yml (no ' +
-          'CS_* creds — the domain CHECKs are structural). It is ' +
-          'the ONLY suite that executes the adapter against a real PostgREST — ' +
-          'the `prop:db_name::jsonb` aliasing selects, the `cs` containment ' +
-          'mapping, and the full-envelope filter operands that every `public.*` ' +
-          'domain CHECK must accept. Everything else asserts those as strings ' +
-          'against a mock, so a false value here means the wire encoding is ' +
-          'unproven while CI stays green.',
-      ).toBe(true)
-    },
-  )
-
   // Local dev with no creds: nothing to assert. Keep at least one always-run
   // assertion so the file is never reported as fully empty/pending.
   it('is always collected (guard file runs outside every live gate)', () => {
diff --git a/packages/stack/integration/helpers/pgrest.ts b/packages/stack/integration/helpers/pgrest.ts
@@ -18,7 +18,9 @@ export function makePostgrestClient(): SupabaseClientLike {
   const url = process.env.PGRST_URL
   if (!url) {
     throw new Error(
-      'PGRST_URL is not set — makePostgrestClient() must only be called behind `describeLiveSupabasePgrest`',
+      'PGRST_URL is not set. The integration `globalSetup` asserts it before any ' +
+        'suite is collected, so reaching this means makePostgrestClient() was ' +
+        'called outside the integration harness.',
     )
   }
   return new PostgrestClient(url) as unknown as SupabaseClientLike
diff --git a/packages/stack/integration/supabase/adapter.ts b/packages/stack/integration/supabase/adapter.ts
@@ -9,10 +9,7 @@ import {
 import postgres from 'postgres'
 import { encryptedTable } from '@/eql/v3'
 import { encryptedSupabaseV3 } from '@/supabase'
-import {
-  makePostgrestClient,
-  reloadSchemaCache,
-} from '../../__tests__/helpers/pgrest'
+import { makePostgrestClient, reloadSchemaCache } from '../helpers/pgrest'
 
 /**
  * The Supabase v3 adapter under real ZeroKMS ciphertext.
diff --git a/packages/stack/integration/supabase/select-alias.integration.test.ts b/packages/stack/integration/supabase/select-alias.integration.test.ts
@@ -3,10 +3,7 @@ import postgres from 'postgres'
 import { afterAll, beforeAll, expect, it } from 'vitest'
 import { encryptedTable, types } from '@/eql/v3'
 import { encryptedSupabaseV3 } from '@/supabase'
-import {
-  makePostgrestClient,
-  reloadSchemaCache,
-} from '../../__tests__/helpers/pgrest'
+import { makePostgrestClient, reloadSchemaCache } from '../helpers/pgrest'
 
 /**
  * `Date` reconstruction across every way PostgREST can key a result row.
diff --git a/packages/stack/integration/supabase/wire.integration.test.ts b/packages/stack/integration/supabase/wire.integration.test.ts
@@ -28,26 +28,21 @@
  * `permission denied for schema eql_v3_internal` (see `supabase-v3-grants-pg`).
  */
 
-import 'dotenv/config'
+import { databaseUrl } from '@cipherstash/test-kit'
 import postgres from 'postgres'
-import { afterAll, beforeAll, expect, it } from 'vitest'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 import type { EncryptionClient } from '@/encryption'
 import { encryptedTable, types } from '@/eql/v3'
 import { EncryptedQueryBuilderV3Impl } from '@/supabase/query-builder-v3'
-import { SUPABASE_PERMISSIONS_SQL_V3 } from '../../cli/src/installer/grants'
-import { installEqlV3IfNeeded } from './helpers/eql-v3'
 import {
-  describeLiveSupabasePgrest,
-  LIVE_SUPABASE_PGREST_ENABLED,
-} from './helpers/live-gate'
-import { makePostgrestClient, reloadSchemaCache } from './helpers/pgrest'
-import { narrowedQueryTerm, storageEnvelope } from './helpers/v3-envelope'
+  narrowedQueryTerm,
+  storageEnvelope,
+} from '../../__tests__/helpers/v3-envelope'
+import { makePostgrestClient, reloadSchemaCache } from '../helpers/pgrest'
 
 const TABLE = 'protect_ci_v3_pgrest'
 
-const sql = LIVE_SUPABASE_PGREST_ENABLED
-  ? postgres(process.env.DATABASE_URL as string, { prepare: false })
-  : (undefined as unknown as postgres.Sql)
+const sql = postgres(databaseUrl(), { prepare: false })
 
 // A DECLARED table: `createdAt → created_at` is the rename the aliasing
 // `prop:db_name::jsonb` select exists for, and a synthesized table (property ==
@@ -211,12 +206,9 @@ function from(): any {
 const ADA_CREATED = new Date('2026-01-02T03:04:05.000Z')
 
 beforeAll(async () => {
-  if (!LIVE_SUPABASE_PGREST_ENABLED) return
-  await installEqlV3IfNeeded(sql)
-
-  // The shipped Supabase grants — the thing under test, not a hand-rolled
-  // approximation. Re-applied after install because the bundle DROPs eql_v3.
-  await sql.unsafe(SUPABASE_PERMISSIONS_SQL_V3)
+  // EQL v3 and the Supabase grants are installed once per run by `globalSetup`,
+  // which shells out to the real `stash eql install --eql-version 3 --supabase`.
+  // Re-applying them here would only test a hand-rolled approximation.
   await sql.unsafe(`DROP TABLE IF EXISTS ${TABLE}`)
   await sql.unsafe(`
     CREATE TABLE ${TABLE} (
@@ -245,12 +237,11 @@ beforeAll(async () => {
 }, 180_000)
 
 afterAll(async () => {
-  if (!LIVE_SUPABASE_PGREST_ENABLED) return
   await sql.unsafe(`DROP TABLE IF EXISTS ${TABLE}`)
   await sql.end()
 })
 
-describeLiveSupabasePgrest('supabase v3 adapter over real PostgREST', () => {
+describe('supabase v3 adapter over real PostgREST (wire + grants)', () => {
   it('inserts raw envelopes that clear every domain CHECK, as anon', async () => {
     const { error, status } = await from().insert({
       row_key: 'ada',
diff --git a/packages/stack/integration/vitest.config.ts b/packages/stack/integration/vitest.config.ts
@@ -11,11 +11,20 @@ import { sharedAlias } from '../../../vitest.shared'
  * jobs. That separation is what lets the integration suites throw on missing
  * configuration instead of skipping.
  *
- * `SUITE_GLOB` selects the adapter, so one config serves both without a second
- * near-identical file. CI passes it per job; locally it defaults to everything.
+ * `CS_IT_SUITE` selects which suites run, so one config serves every adapter
+ * without a second near-identical file. Comma-separated globs; each CI job scopes
+ * itself to the adapter it provisioned a database for. Locally it defaults to
+ * everything.
+ *
+ * Scoping matters: the Drizzle suites talk straight to Postgres and the Supabase
+ * suites need PostgREST, so a job running both would have to provision both.
  */
-const SUITE_GLOB =
+const SUITE_GLOBS = (
   process.env['CS_IT_SUITE'] ?? 'integration/**/*.integration.test.ts'
+)
+  .split(',')
+  .map((glob) => glob.trim())
+  .filter(Boolean)
 
 export default defineConfig({
   resolve: {
@@ -34,7 +43,7 @@ export default defineConfig({
   },
   test: {
     root: resolve(__dirname, '..'),
-    include: [SUITE_GLOB],
+    include: SUITE_GLOBS,
     globalSetup: [resolve(__dirname, 'global-setup.ts')],
     server: {
       deps: {

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,9 @@ export function makePostgrestClient(): SupabaseClientLike {`
`18`	`18`	`const url = process.env.PGRST_URL`
`19`	`19`	`if (!url) {`
`20`	`20`	`throw new Error(`
`21`		- 'PGRST_URL is not set — makePostgrestClient() must only be called behind `describeLiveSupabasePgrest`',
	`21`	+ 'PGRST_URL is not set. The integration `globalSetup` asserts it before any ' +
	`22`	`+ 'suite is collected, so reaching this means makePostgrestClient() was ' +`
	`23`	`+ 'called outside the integration harness.',`
`22`	`24`	`)`
`23`	`25`	`}`
`24`	`26`	`return new PostgrestClient(url) as unknown as SupabaseClientLike`