fix: bootstrap NOLOGIN roles before seeding test users

InsForge Docker image is vanilla Postgres with no pre-created roles.
Unlike Supabase (where supabase start creates anon/authenticated/service_role),
we must explicitly run pgpm admin-users bootstrap to create the NOLOGIN base
roles (anon, authenticated, project_admin) from pgpm.json config before the
deploy SQL can GRANT to them.

Author: pyramation

.github/workflows/ci.yml

@@ -79,8 +79,11 @@ jobs:
       - name: Install pgpm CLI globally
         run: npm install -g pgpm
 
-      - name: Seed pg and app_user
+      - name: Bootstrap roles and seed test users
         run: |
+          # InsForge image is vanilla Postgres — no pre-created roles
+          # (unlike Supabase where `supabase start` creates them)
+          pgpm admin-users bootstrap --yes
           pgpm admin-users add --test --yes
 
       - name: Test ${{ matrix.package }}

Makefile

@@ -9,6 +9,7 @@ ssh:
 	docker exec -it postgres /bin/bash
 
 roles:
+	pgpm admin-users bootstrap --yes
 	pgpm admin-users add --test --yes
 
 install:

README.md

@@ -16,10 +16,13 @@ Built with [`insforge-test`](https://www.npmjs.com/package/insforge-test) — an
 ```sh
 docker-compose up -d
 pnpm install
+make roles
 cd packages/hello-world
 pnpm test:watch
 ```
 
+> **Note:** Unlike Supabase (where `supabase start` pre-creates roles), the InsForge Docker image is vanilla Postgres. `make roles` runs `pgpm admin-users bootstrap` to create the `anon`, `authenticated`, and `project_admin` NOLOGIN roles before seeding test users.
+
 ## InsForge Roles
 
 InsForge uses three built-in PostgreSQL roles: