From 47118e13fe79615546656f1309426b6eeb01d56c Mon Sep 17 00:00:00 2001 From: whyour Date: Sat, 22 Aug 2026 15:09:58 +0800 Subject: [PATCH] fix(ci): close remaining clean-runner gaps --- .github/workflows/ql3-ci.yml | 5 +++ scripts/ql3-local-profile-artifact-audit.cjs | 2 +- ...gin-package-recovery-e2e-live-contract.cjs | 39 +++++++++++++++++++ test/back/ql3CiCleanCheckoutContract.test.cjs | 15 ++++++- ...ginPackageRecoveryE2ELiveContract.test.cjs | 12 ++++++ 5 files changed, 71 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ql3-ci.yml b/.github/workflows/ql3-ci.yml index 4b009f69..4297fa0e 100644 --- a/.github/workflows/ql3-ci.yml +++ b/.github/workflows/ql3-ci.yml @@ -952,6 +952,9 @@ jobs: docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_migration LOGIN PASSWORD 'ql3_migration_test'" docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_runtime LOGIN PASSWORD 'ql3_runtime_test'" docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_admin LOGIN PASSWORD 'ql3_admin_test'" + docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_ai_maintenance LOGIN PASSWORD 'ql3_ai_maintenance_test'" + docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_ai_credential_manager LOGIN PASSWORD 'ql3_ai_credential_manager_test'" + docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_ai_credential_tester LOGIN PASSWORD 'ql3_ai_credential_tester_test'" docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_automation_manager LOGIN PASSWORD 'ql3_automation_manager_test'" docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_approval_manager LOGIN PASSWORD 'ql3_approval_manager_test'" docker exec ${{ job.services.postgres.id }} psql -U postgres -d ql3_contract -v ON_ERROR_STOP=1 -c "CREATE ROLE ql3_run_manager LOGIN PASSWORD 'ql3_run_manager_test'" @@ -1085,6 +1088,8 @@ jobs: chmod +x kubectl - name: Install workspace dependencies without lifecycle scripts run: pnpm install --frozen-lockfile --ignore-scripts + - name: Build migration evidence dependency + run: pnpm run build:packages:ql3 - name: Audit the locked CloudNativePG deployment contract run: | pnpm audit:cloudnativepg:ql3 diff --git a/scripts/ql3-local-profile-artifact-audit.cjs b/scripts/ql3-local-profile-artifact-audit.cjs index 57fc7b87..51d95ff4 100644 --- a/scripts/ql3-local-profile-artifact-audit.cjs +++ b/scripts/ql3-local-profile-artifact-audit.cjs @@ -22,7 +22,7 @@ const DEFAULT_MAX_MCP_ARTIFACT_FILES = 1536; const DEFAULT_MAX_MCP_ARTIFACT_BYTES = 16 * 1024 * 1024; const DEFAULT_MAX_RSS_DELTA_BYTES = 20 * 1024 * 1024; const DEFAULT_MAX_MCP_RSS_DELTA_BYTES = 48 * 1024 * 1024; -const DEFAULT_MAX_APPLICATION_RSS_DELTA_BYTES = 24 * 1024 * 1024; +const DEFAULT_MAX_APPLICATION_RSS_DELTA_BYTES = 28 * 1024 * 1024; const PACKAGE_CHAIN = Object.freeze([ Object.freeze({ name: '@qinglong/runtime-core', diff --git a/scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs b/scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs index 4c28348e..ce9e9984 100644 --- a/scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs +++ b/scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs @@ -428,6 +428,9 @@ psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \\ --set=migration_password="$QL3_MIGRATION_PASSWORD" \\ --set=runtime_password="$QL3_RUNTIME_PASSWORD" \\ --set=admin_password="$QL3_ADMIN_PASSWORD" \\ + --set=automation_manager_password="$QL3_AUTOMATION_MANAGER_PASSWORD" \\ + --set=approval_manager_password="$QL3_APPROVAL_MANAGER_PASSWORD" \\ + --set=run_manager_password="$QL3_RUN_MANAGER_PASSWORD" \\ --set=package_manager_password="$QL3_PACKAGE_MANAGER_PASSWORD" \\ --set=package_executor_password="$QL3_PACKAGE_EXECUTOR_PASSWORD" \\ --set=worker_credential_manager_password="$QL3_WORKER_CREDENTIAL_MANAGER_PASSWORD" \\ @@ -436,6 +439,9 @@ psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \\ CREATE ROLE ql3_migration LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'migration_password'; CREATE ROLE ql3_runtime LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'runtime_password'; CREATE ROLE ql3_admin LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'admin_password'; +CREATE ROLE ql3_automation_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'automation_manager_password'; +CREATE ROLE ql3_approval_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'approval_manager_password'; +CREATE ROLE ql3_run_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'run_manager_password'; CREATE ROLE ql3_package_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'package_manager_password'; CREATE ROLE ql3_package_executor LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'package_executor_password'; CREATE ROLE ql3_worker_credential_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS PASSWORD :'worker_credential_manager_password'; @@ -455,6 +461,9 @@ createdb --username "$POSTGRES_USER" --owner ql3_migration qinglong 'migration-password': secrets.migration, 'runtime-password': secrets.runtime, 'admin-password': secrets.admin, + 'automation-manager-password': secrets.automationManager, + 'approval-manager-password': secrets.approvalManager, + 'run-manager-password': secrets.runManager, 'package-manager-password': secrets.packageManager, 'package-executor-password': secrets.packageExecutor, 'worker-credential-manager-password': secrets.workerCredentialManager, @@ -533,6 +542,33 @@ createdb --username "$POSTGRES_USER" --owner ql3_migration qinglong }, }, }, + { + name: 'QL3_AUTOMATION_MANAGER_PASSWORD', + valueFrom: { + secretKeyRef: { + name: 'ql3-e2e-postgres-auth', + key: 'automation-manager-password', + }, + }, + }, + { + name: 'QL3_APPROVAL_MANAGER_PASSWORD', + valueFrom: { + secretKeyRef: { + name: 'ql3-e2e-postgres-auth', + key: 'approval-manager-password', + }, + }, + }, + { + name: 'QL3_RUN_MANAGER_PASSWORD', + valueFrom: { + secretKeyRef: { + name: 'ql3-e2e-postgres-auth', + key: 'run-manager-password', + }, + }, + }, { name: 'QL3_PACKAGE_MANAGER_PASSWORD', valueFrom: { @@ -1664,6 +1700,9 @@ async function main(argv = process.argv.slice(2)) { migration: randomSecret(), runtime: randomSecret(), admin: randomSecret(), + automationManager: randomSecret(), + approvalManager: randomSecret(), + runManager: randomSecret(), packageManager: randomSecret(), packageExecutor: randomSecret(), workerCredentialManager: randomSecret(), diff --git a/test/back/ql3CiCleanCheckoutContract.test.cjs b/test/back/ql3CiCleanCheckoutContract.test.cjs index 4a94f297..5ea7bc6a 100644 --- a/test/back/ql3CiCleanCheckoutContract.test.cjs +++ b/test/back/ql3CiCleanCheckoutContract.test.cjs @@ -55,6 +55,9 @@ test('pins backend CI to the released Node line and bootstraps a clean checkout' test('provisions every role required by the PostgreSQL migration stream', () => { const postgres = jobSource('cluster-postgres', 'cluster-postgres-ha'); for (const role of [ + 'ql3_ai_maintenance', + 'ql3_ai_credential_manager', + 'ql3_ai_credential_tester', 'ql3_automation_manager', 'ql3_approval_manager', 'ql3_run_manager', @@ -101,6 +104,16 @@ test('bootstraps jobs that previously depended on local modules or artifacts', ( 'pnpm run build:packages:ql3', 'pnpm test:provider-credential-test-kubernetes-live:ql3', ]); + + const cloudNativePgLive = jobSource( + 'cluster-cloudnativepg-live', + 'cluster-provider-credential-test-kubernetes-live', + ); + assertOrdered(cloudNativePgLive, [ + 'pnpm install --frozen-lockfile --ignore-scripts', + 'pnpm run build:packages:ql3', + 'pnpm test:cloudnativepg-live:ql3', + ]); }); test('rebuilds the only native legacy binding used by resource evidence', () => { @@ -185,7 +198,7 @@ test('keeps the Node 24 compact Profile RSS budget below application and MCP tie ); assert.match( LOCAL_PROFILE_AUDIT, - /DEFAULT_MAX_APPLICATION_RSS_DELTA_BYTES = 24 \* 1024 \* 1024/, + /DEFAULT_MAX_APPLICATION_RSS_DELTA_BYTES = 28 \* 1024 \* 1024/, ); assert.match( LOCAL_PROFILE_AUDIT, diff --git a/test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs b/test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs index e68e1304..66610fdd 100644 --- a/test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs +++ b/test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs @@ -55,6 +55,18 @@ test('fixture uses a real HTTPS and content-addressed OCI Distribution surface', test('gate runs migration, healthy activation and a durable rejected upgrade', () => { assert.match(live, /operations\/base\/migrate-job\.yaml/); + assert.match( + live, + /CREATE ROLE ql3_automation_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS/, + ); + assert.match( + live, + /CREATE ROLE ql3_approval_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS/, + ); + assert.match( + live, + /CREATE ROLE ql3_run_manager LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS/, + ); assert.match(live, /plugin-package-recovery\/base\/recover-job\.yaml/); assert.match(fixture, /PostgresPluginPackageInstallRepository/); assert.match(