Skip to content

Commit f8e570f

Browse files
asheshvasheshv
authored
ci: run data-isolation tests in server mode (#10019)
The existing run-python-tests-pg.yml workflow hardcodes SERVER_MODE = False in config_local.py. Every test that gates itself on `config.SERVER_MODE` — including the data-isolation suites — skips itself in CI today. That gap is what allowed the admin-bypass regression in 9a76ed8 to ship (see #9933, #10006): the change to web/pgadmin/utils/server_access.py changed access-control behaviour but the only tests covering it were server-mode-only and therefore never ran. This workflow plugs that gap with a narrow, cheap server-mode CI job: - Single OS (ubuntu-22.04), single PG version (18) — no matrix - SERVER_MODE = True in config_local.py - Runs only the two data-isolation test modules: browser.server_groups.tests.test_sg_data_isolation browser.server_groups.servers.tests.test_server_data_isolation Locally with SERVER_MODE=True both modules finish in well under half a second (3 + 6 tests), so the marginal CI cost is dominated by the PG/python setup, not the tests themselves. Future access-control changes to server_access.py (or related helpers) will fail this workflow if they regress the existing isolation guarantees, before they reach master
1 parent 92dd7c7 commit f8e570f

1 file changed

Lines changed: 193 additions & 0 deletions

File tree

‎.github/workflows/run-python-tests-server-mode.yml‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
name: Run Python tests in server mode (data isolation)
2+
3+
# This workflow runs the data-isolation tests with SERVER_MODE=True.
4+
# The main run-python-tests-pg.yml workflow runs everything with
5+
# SERVER_MODE=False, so any test that gates itself on `config.SERVER_MODE`
6+
# (notably web/pgadmin/browser/server_groups/tests/test_sg_data_isolation.py
7+
# and web/pgadmin/browser/server_groups/servers/tests/test_server_data_isolation.py)
8+
# skips itself in CI. That gap allowed the admin-bypass regression in
9+
# 9a76ed8 to ship; this workflow exists so regressions to the centralized
10+
# access-control helpers in web/pgadmin/utils/server_access.py are caught.
11+
#
12+
# Scope is intentionally narrow: one OS, one PG version, only the
13+
# data-isolation modules. Keep it cheap to run on every PR.
14+
15+
on:
16+
push:
17+
branches: [ "master" ]
18+
pull_request:
19+
branches: [ "master" ]
20+
21+
workflow_dispatch:
22+
23+
concurrency:
24+
group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
25+
cancel-in-progress: true
26+
27+
jobs:
28+
run-python-tests-server-mode:
29+
runs-on: ubuntu-24.04
30+
31+
env:
32+
PG_VER: 18
33+
34+
steps:
35+
- uses: actions/checkout@v4
36+
with:
37+
# We don't run any authenticated git operations after checkout
38+
# (no push, no submodule fetch, no comment back to the PR), so
39+
# persisting the token in the local git config only widens the
40+
# blast radius of an unrelated step compromise.
41+
persist-credentials: false
42+
43+
- name: Update python version
44+
uses: actions/setup-python@v5
45+
with:
46+
python-version: '3.10'
47+
48+
- name: Setup the PGDG APT repo
49+
# apt-key is deprecated on Ubuntu 24.04+; install the key into
50+
# /etc/apt/keyrings/ and reference it via signed-by= in the
51+
# sources.list entry instead.
52+
run: |
53+
sudo install -d -m 0755 /etc/apt/keyrings
54+
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc \
55+
| sudo gpg --dearmor -o /etc/apt/keyrings/pgdg.gpg
56+
sudo sh -c 'echo "deb [signed-by=/etc/apt/keyrings/pgdg.gpg] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
57+
58+
- name: Uninstall PostgreSQL if already present
59+
run: |
60+
if [ -n "$(ls /etc/postgresql/*/*/postgresql.conf 2>/dev/null)" ]; then
61+
installed_pg_version=$( pg_config --version | cut -d ' ' -f 2 | cut -d '.' -f 1 )
62+
echo "Installed PostgreSQL version: $installed_pg_version"
63+
if [ $installed_pg_version != ${PG_VER} ]; then
64+
sudo pg_dropcluster $installed_pg_version main --stop
65+
sudo apt-get -y remove "postgresql-${installed_pg_version}"
66+
fi
67+
fi
68+
69+
- name: Install platform dependencies
70+
run: |
71+
sudo apt update
72+
sudo apt install -y libpq-dev libffi-dev libssl-dev libkrb5-dev zlib1g-dev postgresql-${PG_VER}
73+
74+
- name: Start PostgreSQL
75+
run: |
76+
sudo su -c "echo local all all trust > /etc/postgresql/${PG_VER}/main/pg_hba.conf"
77+
sudo sed -i "s/port = 543[0-9]/port = 59${PG_VER}/g" /etc/postgresql/${PG_VER}/main/postgresql.conf
78+
sudo su - postgres -c "/usr/lib/postgresql/${PG_VER}/bin/postgres -D /var/lib/postgresql/${PG_VER}/main -c config_file=/etc/postgresql/${PG_VER}/main/postgresql.conf &"
79+
80+
# Bounded readiness wait: 60 attempts × 2s = 120s cap. If PG
81+
# never becomes ready, fail fast with logs rather than hanging
82+
# until the job timeout.
83+
for attempt in $(seq 1 60); do
84+
if sudo runuser -l postgres -c "pg_isready -p 59${PG_VER}" 2>/dev/null; then
85+
break
86+
fi
87+
>&2 echo "Postgres is unavailable (attempt ${attempt}/60) - sleeping for 2 seconds"
88+
sleep 2
89+
if [ "$attempt" -eq 60 ]; then
90+
>&2 echo "Postgres failed to become ready within 120 seconds"
91+
sudo tail -n 200 /var/log/postgresql/postgresql-${PG_VER}-main.log || true
92+
exit 1
93+
fi
94+
done
95+
96+
- name: Install Python dependencies
97+
run: make install-python-testing
98+
99+
- name: Create the test configuration (SERVER_MODE=True)
100+
run: |
101+
mkdir -p var
102+
cat <<EOF > web/config_local.py
103+
from config import *
104+
105+
# Debug mode
106+
DEBUG = True
107+
108+
# App mode — this is the whole point of this workflow.
109+
SERVER_MODE = True
110+
111+
# Log
112+
CONSOLE_LOG_LEVEL = DEBUG
113+
FILE_LOG_LEVEL = DEBUG
114+
115+
DEFAULT_SERVER = '127.0.0.1'
116+
117+
UPGRADE_CHECK_ENABLED = False
118+
119+
LOG_FILE = "$(pwd)/var/pgadmin4.log"
120+
SESSION_DB_PATH = "$(pwd)/var/sessions"
121+
STORAGE_DIR = "$(pwd)/var/storage"
122+
SQLITE_PATH = "$(pwd)/var/pgadmin4.db"
123+
TEST_SQLITE_PATH = "$(pwd)/var/pgadmin4.db"
124+
AZURE_CREDENTIAL_CACHE_DIR = "$(pwd)/var/azurecredentialcache"
125+
EOF
126+
127+
cat <<EOF > web/regression/test_config.json
128+
{
129+
"pgAdmin4_login_credentials": {
130+
"new_password": "NEWPASSWORD",
131+
"login_password": "PASSWORD",
132+
"login_username": "USER@EXAMPLE.COM"
133+
},
134+
"pgAdmin4_test_user_credentials": {
135+
"new_password": "NEWPASSWORD",
136+
"login_password": "PASSWORD",
137+
"login_username": "USER2@EXAMPLE.COM"
138+
},
139+
"pgAdmin4_test_non_admin_credentials": {
140+
"new_password": "NEWPASSWORD",
141+
"login_password": "PASSWORD",
142+
"login_username": "USER3@EXAMPLE.COM"
143+
},
144+
"server_group": 1,
145+
"server_credentials": [
146+
{
147+
"name": "PostgreSQL ${{ env.PG_VER }}",
148+
"comment": "PostgreSQL ${{ env.PG_VER }} Server",
149+
"db_username": "postgres",
150+
"host": "/var/run/postgresql",
151+
"db_password": "postgres",
152+
"db_port": 59${{ env.PG_VER }},
153+
"maintenance_db": "postgres",
154+
"sslmode": "prefer",
155+
"tablespace_path": "/var/lib/postgresql/tablespaces/${{ env.PG_VER }}",
156+
"enabled": true,
157+
"default_binary_paths": {
158+
"pg": "/usr/lib/postgresql/${{ env.PG_VER }}/bin",
159+
"ppas": ""
160+
}
161+
}
162+
],
163+
"server_update_data": [
164+
{
165+
"comment": "This is test update comment"
166+
}
167+
]
168+
}
169+
EOF
170+
171+
- name: Run server-group data isolation tests
172+
run: |
173+
. venv/bin/activate
174+
python web/regression/runtests.py --pkg browser.server_groups.tests --modules test_sg_data_isolation
175+
176+
- name: Run server data isolation tests
177+
run: |
178+
. venv/bin/activate
179+
python web/regression/runtests.py --pkg browser.server_groups.servers.tests --modules test_server_data_isolation
180+
181+
- name: Archive server log
182+
if: success() || failure()
183+
uses: actions/upload-artifact@v4
184+
with:
185+
name: server-log-server-mode
186+
path: var/pgadmin4.log
187+
188+
- name: Archive regression log
189+
if: success() || failure()
190+
uses: actions/upload-artifact@v4
191+
with:
192+
name: regression-log-server-mode
193+
path: web/regression/regression.log

0 commit comments

Comments
 (0)