diff --git a/.github/actions/nix-install-ephemeral/action.yml b/.github/actions/nix-install-ephemeral/action.yml index af4c2292d4..2ff94fbedd 100644 --- a/.github/actions/nix-install-ephemeral/action.yml +++ b/.github/actions/nix-install-ephemeral/action.yml @@ -5,22 +5,14 @@ inputs: description: 'AWS region for the Nix binary cache S3 bucket' required: false default: 'us-east-1' - force-clean: - description: Whether to delete pre-existing nix paths - required: false - default: 'false' push-to-cache: description: 'Whether to push build outputs to the Nix binary cache' required: false default: 'false' - multi-user: - description: Whether to install nix in multi-user mode (default true) or single-user mode - required: false - default: 'true' runs: using: 'composite' steps: - - name: aws-creds + - name: configure aws credentials uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 if: ${{ inputs.push-to-cache == 'true' }} with: @@ -28,90 +20,13 @@ runs: aws-region: ${{ inputs.aws-region }} output-credentials: true role-duration-seconds: 7200 - - name: Force Clean Pre-Existing Nix Paths - if: inputs.force-clean == 'true' - shell: bash - run: sudo rm -rf /nix /etc/nix "$HOME/.nix-profile" "$HOME/.nix-channels" "$HOME/.config/nix" - - name: Ensure /etc/nix exists + - name: setup nix shell: bash - run: sudo mkdir -p /etc/nix - - name: Setup AWS credentials for Nix - if: ${{ inputs.push-to-cache == 'true' }} - shell: bash - run: | - sudo -H aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID - sudo -H aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY - sudo -H aws configure set aws_session_token $AWS_SESSION_TOKEN - sudo -H aws configure set region ${{ inputs.aws-region }} - sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()" - cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null - #!/usr/bin/env bash - set -euo pipefail - set -f - - export IFS=' ' - /nix/var/nix/profiles/default/bin/nix copy --max-jobs 5 --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' $OUT_PATHS - EOF - sudo chmod +x /etc/nix/upload-to-cache.sh + run: cd ${{ github.action_path }} && ./setup-nix.sh env: + AWS_REGION: ${{ inputs.aws-region }} + PUSH_TO_CACHE: ${{ inputs.push-to-cache == 'true' }} NIX_SIGN_SECRET_KEY: ${{ env.NIX_SIGN_SECRET_KEY }} - - name: Install Nix - shell: bash - run: | - if [[ "${{ inputs.multi-user }}" == true ]]; then - daemon=--daemon - nixconfdir=/etc/nix - path=/nix/var/nix/profiles/default/bin - tmpconf=/tmp/nix-extra.conf - - echo 'access-tokens = github.com=${{ github.token }}' | sudo tee $nixconfdir/github.nix.conf >/dev/null - sudo chmod 400 $nixconfdir/github.nix.conf - else - daemon=--no-daemon - nixconfdir=$HOME/.config/nix - path=$HOME/.nix-profile/bin - tmpconf=$nixconfdir/nix.conf # --nix-extra-conf-files is ignored for single-user installs - - mkdir -p "$(dirname $tmpconf)" - echo 'access-tokens = github.com=${{ github.token }}' | tee $nixconfdir/github.nix.conf >/dev/null - chmod 400 $nixconfdir/github.nix.conf - fi - - cat >$tmpconf <<'NIXCONF' - always-allow-substitutes = true - extra-experimental-features = flakes nix-command - extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com - extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= - max-jobs = 4 - NIXCONF - - - if [[ -e /dev/kvm ]]; then - echo 'extra-system-features = kvm' >>$tmpconf - fi - - if [[ "${{ inputs.push-to-cache }}" == true ]]; then - echo 'post-build-hook = /etc/nix/upload-to-cache.sh' >>$tmpconf - fi - - echo "!include $nixconfdir/github.nix.conf" >>$tmpconf - - curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- $daemon --yes --nix-extra-conf-file $tmpconf - - sudo cat $nixconfdir/nix.conf - - # Add nix to PATH for subsequent steps - echo "$path" >> "$GITHUB_PATH" - name: Print Nix version shell: bash run: nix --version - - name: Setup KVM permissions - shell: bash - run: | - if [ -e /dev/kvm ]; then - sudo chown runner /dev/kvm - sudo chmod 666 /dev/kvm - echo "KVM configured: $(ls -l /dev/kvm)" - else - echo "KVM device not available" - fi diff --git a/.github/actions/nix-install-ephemeral/setup-github-access.sh b/.github/actions/nix-install-ephemeral/setup-github-access.sh new file mode 100755 index 0000000000..992c681550 --- /dev/null +++ b/.github/actions/nix-install-ephemeral/setup-github-access.sh @@ -0,0 +1,5 @@ +#!/usr/bin/env bash + +echo "access-tokens = github.com=${GITHUB_TOKEN:?}" >"$NIXCONFDIR/github.nix.conf" +chmod 400 "$NIXCONFDIR/github.nix.conf" +echo "!include $NIXCONFDIR/github.nix.conf" diff --git a/.github/actions/nix-install-ephemeral/setup-nix.sh b/.github/actions/nix-install-ephemeral/setup-nix.sh new file mode 100755 index 0000000000..6d3b8f5090 --- /dev/null +++ b/.github/actions/nix-install-ephemeral/setup-nix.sh @@ -0,0 +1,52 @@ +#!/usr/bin/env bash + +set -euo pipefail + +if systemctl whoami &>/dev/null; then + # systemd is running so we can install in multi-user mode + daemon=--daemon + nixconfdir=/etc/nix + path=/nix/var/nix/profiles/default/bin + + tmpdir=$(mktemp -d) + trap 'cd; rm -rf $tmpdir' EXIT + + function maybesudo { sudo -E env "$@"; } +else + # systemd is *not* running so we must install in single-user mode + daemon=--no-daemon + nixconfdir=$HOME/.config/nix + path=$HOME/.nix-profile/bin + + tmpdir=$nixconfdir + + function maybesudo { env "$@"; } +fi + +maybesudo mkdir -p "$nixconfdir" +cat >"$tmpdir/nix.conf" <<-EOF + always-allow-substitutes = true + extra-experimental-features = flakes nix-command + extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com + extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI= + max-jobs = 5 +EOF + +if [[ -e /dev/kvm ]]; then + sudo chown runner /dev/kvm + sudo chmod 666 /dev/kvm + echo 'extra-system-features = kvm' >>"$tmpdir/nix.conf" +fi + +if [[ ${PUSH_TO_CACHE:?} == true ]]; then + set -x + maybesudo NIXCONFDIR="$nixconfdir" NIXBINDIR="$path" ./setup-push.sh >>"$tmpdir/nix.conf" +fi + +maybesudo NIXCONFDIR="$nixconfdir" ./setup-github-access.sh >>"$tmpdir/nix.conf" + +curl -L https://releases.nixos.org/nix/nix-2.34.6/install | sh -s -- $daemon --yes --nix-extra-conf-file "$tmpdir/nix.conf" +cat "$nixconfdir/nix.conf" + +# Add nix to PATH for subsequent steps +echo "$path" >>"${GITHUB_PATH:?}" diff --git a/.github/actions/nix-install-ephemeral/setup-push.sh b/.github/actions/nix-install-ephemeral/setup-push.sh new file mode 100755 index 0000000000..89ae40fb06 --- /dev/null +++ b/.github/actions/nix-install-ephemeral/setup-push.sh @@ -0,0 +1,35 @@ +#!/usr/bin/env bash + +set -euo pipefail + +mkdir -p ~/.aws +cat >~/.aws/config <<-EOF + [default] + region = ${AWS_REGION:?} +EOF +cat >~/.aws/credentials <<-EOF + [default] + aws_access_key_id = ${AWS_ACCESS_KEY_ID:?} + aws_secret_access_key = ${AWS_SECRET_ACCESS_KEY:?} + aws_session_token = ${AWS_SESSION_TOKEN:?} +EOF + +printenv NIX_SIGN_SECRET_KEY >"${NIXCONFDIR:?}/nix-secret-key" +chmod 400 "$NIXCONFDIR/nix-secret-key" + +cat >"$NIXCONFDIR/upload-to-cache.sh" <<-EOF + #!/usr/bin/env bash + set -euo pipefail + set -f + + if [[ ! -e ${NIXBINDIR:?}/nix ]]; then + # called during nix install, but nix isn't available yet + exit + fi + + export IFS=' ' + echo $NIXBINDIR/nix copy --max-jobs 5 --to 's3://nix-postgres-artifacts?secret-key=$NIXCONFDIR/nix-secret-key' \$OUT_PATHS +EOF +chmod +x "$NIXCONFDIR/upload-to-cache.sh" + +echo "post-build-hook = $NIXCONFDIR/upload-to-cache.sh" diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index 23466caf1e..7f8e61d4ff 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -19,217 +19,21 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: - nix-eval: - uses: ./.github/workflows/nix-eval.yml - secrets: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - nix-build-packages-aarch64-linux: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (aarch64-linux) - needs: nix-eval - runs-on: ${{ matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_linux != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_linux }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - nix-build-checks-aarch64-linux: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (aarch64-linux) - needs: - - nix-eval - - nix-build-packages-aarch64-linux - runs-on: ${{ matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_linux != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_linux }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - - nix-build-packages-aarch64-darwin: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (aarch64-darwin) - needs: nix-eval - runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_darwin != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).aarch64_darwin }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix (ephemeral) - if: ${{ matrix.attr != '' && matrix.runs_on.group != 'self-hosted-runners-nix' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: Install nix (self-hosted) - if: ${{ matrix.attr != '' && matrix.runs_on.group == 'self-hosted-runners-nix' }} - uses: ./.github/actions/nix-install-self-hosted - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - - nix-build-checks-aarch64-darwin: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (aarch64-darwin) - needs: - - nix-eval - - nix-build-packages-aarch64-darwin - runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_darwin != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).aarch64_darwin }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - - nix-build-packages-x86_64-linux: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (x86_64-linux) - needs: nix-eval - runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).x86_64_linux != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.packages_matrix).x86_64_linux }} + name: vm-test-run-pg_hashids (aarch64-linux) + runs-on: blacksmith-4vcpu-ubuntu-2404-arm steps: - name: Checkout Repo - if: ${{ matrix.attr != '' }} uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Install nix - if: ${{ matrix.attr != '' }} uses: ./.github/actions/nix-install-ephemeral with: push-to-cache: 'true' env: DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} + NIX_SIGN_SECRET_KEY: myfakenixsignsecret + GITHUB_TOKEN: ${{github.token}} - name: nix build - if: ${{ matrix.attr != '' }} uses: ./.github/actions/nix-build-retry with: - attr: .#${{ matrix.attr }} - - nix-build-checks-x86_64-linux: - name: >- - ${{ matrix.name }}${{ matrix.postgresql_version && format(' - Postgres {0}', matrix.postgresql_version) || '' }} - (x86_64-linux) - needs: - - nix-eval - - nix-build-packages-x86_64-linux - runs-on: ${{ matrix.attr != '' && matrix.runs_on.group && matrix.runs_on || matrix.runs_on.labels }} - if: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).x86_64_linux != null }} - strategy: - fail-fast: false - max-parallel: 25 - matrix: ${{ fromJSON(needs.nix-eval.outputs.checks_matrix).x86_64_linux }} - steps: - - name: Checkout Repo - if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - - name: Install nix - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-install-ephemeral - with: - push-to-cache: 'true' - env: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - name: nix build - if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry - with: - attr: .#${{ matrix.attr }} - - run-testinfra: - needs: - - nix-eval - - nix-build-packages-aarch64-linux - - nix-build-packages-aarch64-darwin - - nix-build-packages-x86_64-linux - uses: ./.github/workflows/testinfra-ami-build.yml - secrets: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} - - run-tests: - needs: - - nix-eval - - nix-build-packages-aarch64-linux - - nix-build-packages-aarch64-darwin - - nix-build-packages-x86_64-linux - uses: ./.github/workflows/test.yml - - docker-image-test: - needs: nix-build-packages-aarch64-linux - uses: ./.github/workflows/docker-image-test.yml - secrets: - DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} - NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} + attr: .#vm-test-run-pg_hashids diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index 4210ba65ab..8accaa378c 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -66,9 +66,6 @@ jobs: - name: Install Nix uses: ./.github/actions/nix-install-ephemeral - with: - force-clean: "true" - multi-user: "false" - name: Build QEMU artifact run: BUILD_QEMU_IMAGE_HW_VIRT_ONLY=1 nix run .#build-qemu-image "${{ matrix.postgres_version }}" arm64 diff --git a/ansible/files/postgresql_config/supautils.conf.j2 b/ansible/files/postgresql_config/supautils.conf.j2 index 58739905eb..16ce476d6e 100644 --- a/ansible/files/postgresql_config/supautils.conf.j2 +++ b/ansible/files/postgresql_config/supautils.conf.j2 @@ -9,6 +9,7 @@ supautils.drop_trigger_grants = '{"postgres":["auth.audit_log_entries","auth.flo # NOTE: keep nix/tests/prime-superuser.sql in sync with the "may be unsafe" + "deprecated" lists above. supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intarray, isn, ltree, moddatetime, orioledb, pg_buffercache, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers' supautils.extension_custom_scripts_path = '/etc/postgresql-custom/extension-custom-scripts' +supautils.restrict_extension_versions = 'warn' supautils.privileged_extensions_superuser = 'supabase_admin' supautils.privileged_role = 'supabase_privileged_role' supautils.privileged_role_allowed_configs = 'auto_explain.*, deadlock_timeout, log_duration, log_lock_waits, log_min_duration_statement, log_min_error_statement, log_min_messages, log_parameter_max_length, log_replication_commands, log_statement, log_temp_files, pg_net.batch_size, pg_net.ttl, pg_stat_statements.*, pgaudit.log, pgaudit.log_catalog, pgaudit.log_client, pgaudit.log_level, pgaudit.log_relation, pgaudit.log_rows, pgaudit.log_statement, pgaudit.log_statement_once, pgaudit.role, pgrst.*, plan_filter.*, safeupdate.enabled, session_replication_role, track_functions, track_io_timing, wal_compression' diff --git a/nix/checks.nix b/nix/checks.nix index 776491bc80..d56a33306b 100644 --- a/nix/checks.nix +++ b/nix/checks.nix @@ -253,6 +253,7 @@ "extensions_schema" # tests extension loading "roles" # includes roles/schemas from extensions not in CLI (pgtle, pgmq, repack, topology) "pg_net_worker_privileges" # needs the authenticated/postgres roles from the full migrations, not present in the CLI prime file + "supautils_restrict_versions" # needs the postgres role + primed hstore from the full migrations/prime, not present in the CLI variant # Version-specific extension tests "z_17_ext_interface" "z_17_pg_stat_monitor" diff --git a/nix/packages/github-matrix/github_matrix.py b/nix/packages/github-matrix/github_matrix.py index ec4f618d1d..3053cfcc79 100755 --- a/nix/packages/github-matrix/github_matrix.py +++ b/nix/packages/github-matrix/github_matrix.py @@ -258,7 +258,7 @@ class Specs(NamedTuple): case (True, _, "darwin", "aarch64"): return {"group": "self-hosted-runners-nix", "labels": ["aarch64-darwin"]} case (True, _, "linux", "aarch64"): - specs = Specs(16, "ubuntu-2404-arm") + return {"labels": ["arm-native-runner"]} case (True, _, "linux", "x86_64"): specs = Specs(16, "ubuntu-2404") diff --git a/nix/packages/github-matrix/tests/test_github_matrix.py b/nix/packages/github-matrix/tests/test_github_matrix.py index f2a6b14dd8..a4192826fd 100644 --- a/nix/packages/github-matrix/tests/test_github_matrix.py +++ b/nix/packages/github-matrix/tests/test_github_matrix.py @@ -132,7 +132,7 @@ class TestGetRunnerForPackage: ( "aarch64-linux", "kvm", - {"labels": ["blacksmith-16vcpu-ubuntu-2404-arm"]}, + {"labels": ["arm-native-runner"]}, ), ( "aarch64-linux", diff --git a/nix/tests/expected/supautils_restrict_versions.out b/nix/tests/expected/supautils_restrict_versions.out new file mode 100644 index 0000000000..514016f1e2 --- /dev/null +++ b/nix/tests/expected/supautils_restrict_versions.out @@ -0,0 +1,52 @@ +-- supautils.conf.j2 sets supautils.restrict_extension_versions = 'warn': +-- CREATE/ALTER EXTENSION version clauses from non-exempt roles are ignored +-- with a WARNING and the extension's default_version is used instead. +-- +-- This suite runs against the rendered supautils.conf.j2 with the real +-- migrations applied (see nix/tools/run-server.sh.in), so the restriction +-- can be asserted as the actual platform roles. The supautils regress suite +-- covers the GUC logic (all modes, ALTER, duplicate clauses); this test +-- covers the platform wiring. See PSQL-1159. +-- the platform config sets warn mode +show supautils.restrict_extension_versions; + supautils.restrict_extension_versions +--------------------------------------- + warn +(1 row) + +-- precondition: postgres is not a superuser, else it would be exempt +select rolsuper from pg_roles where rolname = 'postgres'; + rolsuper +---------- + f +(1 row) + +-- drop the hstore created by prime.sql so the creates below are observable +drop extension hstore; +-- non-exempt role: the version clause is ignored with a warning and the +-- default version is installed +set role postgres; +create extension hstore version '1.4'; +WARNING: only superusers can specify extension versions, ignoring version "1.4" and installing the default version +select extversion = default_version as installed_default + from pg_extension, pg_available_extensions + where extname = name and extname = 'hstore'; + installed_default +------------------- + t +(1 row) + +reset role; +drop extension hstore; +-- exempt role (supabase_admin, via supautils.privileged_extensions_superuser): +-- the version clause is honored, with no warning +create extension hstore version '1.4'; +select extversion from pg_extension where extname = 'hstore'; + extversion +------------ + 1.4 +(1 row) + +-- restore the state prime.sql created (hstore at default version) +drop extension hstore; +create extension hstore; diff --git a/nix/tests/sql/supautils_restrict_versions.sql b/nix/tests/sql/supautils_restrict_versions.sql new file mode 100644 index 0000000000..9f5d6f3a55 --- /dev/null +++ b/nix/tests/sql/supautils_restrict_versions.sql @@ -0,0 +1,38 @@ +-- supautils.conf.j2 sets supautils.restrict_extension_versions = 'warn': +-- CREATE/ALTER EXTENSION version clauses from non-exempt roles are ignored +-- with a WARNING and the extension's default_version is used instead. +-- +-- This suite runs against the rendered supautils.conf.j2 with the real +-- migrations applied (see nix/tools/run-server.sh.in), so the restriction +-- can be asserted as the actual platform roles. The supautils regress suite +-- covers the GUC logic (all modes, ALTER, duplicate clauses); this test +-- covers the platform wiring. See PSQL-1159. + +-- the platform config sets warn mode +show supautils.restrict_extension_versions; + +-- precondition: postgres is not a superuser, else it would be exempt +select rolsuper from pg_roles where rolname = 'postgres'; + +-- drop the hstore created by prime.sql so the creates below are observable +drop extension hstore; + +-- non-exempt role: the version clause is ignored with a warning and the +-- default version is installed +set role postgres; +create extension hstore version '1.4'; +select extversion = default_version as installed_default + from pg_extension, pg_available_extensions + where extname = name and extname = 'hstore'; +reset role; + +drop extension hstore; + +-- exempt role (supabase_admin, via supautils.privileged_extensions_superuser): +-- the version clause is honored, with no warning +create extension hstore version '1.4'; +select extversion from pg_extension where extname = 'hstore'; + +-- restore the state prime.sql created (hstore at default version) +drop extension hstore; +create extension hstore;