feat(ql3): admit plugin secret action jobs

packages/ql3-cluster-postgres/test/entrypoints.test.cjs

@@ -367,11 +367,16 @@ test('Approved Action execution authority is isolated behind its explicit subpat
   const runtime = require('@qinglong/cluster-postgres/runtime');
   const admin = require('@qinglong/cluster-postgres/admin');
   const ingress = require('@qinglong/cluster-postgres/worker-ingress');
+  const packageExecutor = require('@qinglong/cluster-postgres/package-executor');
   const authority = require('@qinglong/cluster-postgres/approved-action-execution');
   assert.equal(root.PostgresApprovedActionExecutionRepository, undefined);
   assert.equal(runtime.PostgresApprovedActionExecutionRepository, undefined);
   assert.equal(admin.PostgresApprovedActionExecutionRepository, undefined);
   assert.equal(ingress.PostgresApprovedActionExecutionRepository, undefined);
+  assert.equal(
+    packageExecutor.PostgresApprovedActionExecutionRepository,
+    authority.PostgresApprovedActionExecutionRepository,
+  );
   assert.equal(
     typeof authority.PostgresApprovedActionExecutionRepository,
     'function',

packages/ql3-cluster-postgres/test/postgres.integration.test.cjs

@@ -3581,6 +3581,22 @@ if (!migrationConnectionString) {
       const executions = new PostgresApprovedActionExecutionRepository(
         executorDatabase.pool,
       );
+      const pendingSecretActions =
+        await executions.listReconciliableExecutions({
+          nowMs: claimedAtMs,
+          limit: 1,
+          actionTypes: [consumed.dispatch.action.actionType],
+        });
+      assert.equal(pendingSecretActions.truncated, false);
+      assert.equal(pendingSecretActions.executions.length, 1);
+      assert.equal(
+        pendingSecretActions.executions[0].dispatch.id,
+        consumed.dispatch.id,
+      );
+      assert.equal(
+        pendingSecretActions.executions[0].execution.status,
+        'pending',
+      );
       const claimed = await executions.claimExecution({
         dispatchId: consumed.dispatch.id,
         owner: 'package_admission_dispatcher',
@@ -3598,6 +3614,22 @@ if (!migrationConnectionString) {
         expectedVersion: claimed.snapshot.execution.version,
         startedAtMs: admittedAtMs,
       });
+      const executingSecretActions =
+        await executions.listReconciliableExecutions({
+          nowMs: admittedAtMs,
+          limit: 1,
+          actionTypes: [consumed.dispatch.action.actionType],
+        });
+      assert.equal(executingSecretActions.truncated, false);
+      assert.equal(executingSecretActions.executions.length, 1);
+      assert.equal(
+        executingSecretActions.executions[0].dispatch.id,
+        consumed.dispatch.id,
+      );
+      assert.equal(
+        executingSecretActions.executions[0].execution.status,
+        'executing',
+      );
       const lock = resolvePluginPackageInstallProposal(
         proposal,
         consumed.dispatch,