Add Phase-2a Postgres-backed indexer-integration CI job (#421) #971

2026-06-30T03:34:57Z

Brouie commented

2026-06-30 03:34:57 +00:00

(Migrated from gitlab.com)

Phase-2a of #421: adds the Postgres-backed indexer-integration job to the GitLab test stage — the full indexer/tests/ suite that test-indexer-lib skips.

What

test-indexer-integration:

postgres:16 service container (no DinD, no LocalTerra). The harness (indexer/tests/common/mod.rs::setup_pool) runs sqlx::migrate!() itself, so the service only has to provision the cl8y_legal role + dex_indexer_test DB.
serial -j1 --test-threads=1 — the suite shares one dex_indexer_test DB and api_hooks false-fails under parallel access (docs/qa-invariants.md).
TCP readiness wait before cargo test (PgPool::connect does not retry, so it can race the service start).
change-gated on indexer/** + .gitlab-ci.yml, no allow_failure. Mirrors make test-indexer-integration.
docs/testing.md CI parity table + Phase wording updated.

Evidence

Dry-run on origin/main (2a06048b): cargo test --tests -j1 -- --test-threads=1 = 542 passed / 0 failed across the full suite (incl. api_limit_lower_bound 16, limit_clamp_guardrail 1, security 35, api_route_solve 24 + api_route_solve_db_hybrid 4).
ci/lint on the merged config: valid, 0 errors / 0 warnings.

Out of scope

The remaining Phase-2 row — the scheduled DinD-LocalTerra Playwright E2E — is heavier (browsers + a live chain) and stays open under #421.

Part of #421 (Phase-2a; the E2E row remains open).

Phase-2a of #421: adds the Postgres-backed indexer-integration job to the GitLab `test` stage — the full `indexer/tests/` suite that `test-indexer-lib` skips. ## What `test-indexer-integration`: - `postgres:16` service container (no DinD, no LocalTerra). The harness (`indexer/tests/common/mod.rs::setup_pool`) runs `sqlx::migrate!()` itself, so the service only has to provision the `cl8y_legal` role + `dex_indexer_test` DB. - serial `-j1 --test-threads=1` — the suite shares one `dex_indexer_test` DB and `api_hooks` false-fails under parallel access (`docs/qa-invariants.md`). - TCP readiness wait before `cargo test` (`PgPool::connect` does not retry, so it can race the service start). - change-gated on `indexer/**` + `.gitlab-ci.yml`, no `allow_failure`. Mirrors `make test-indexer-integration`. - `docs/testing.md` CI parity table + Phase wording updated. ## Evidence - Dry-run on origin/main (2a06048b): `cargo test --tests -j1 -- --test-threads=1` = **542 passed / 0 failed** across the full suite (incl. `api_limit_lower_bound` 16, `limit_clamp_guardrail` 1, `security` 35, `api_route_solve` 24 + `api_route_solve_db_hybrid` 4). - `ci/lint` on the merged config: valid, 0 errors / 0 warnings. ## Out of scope The remaining Phase-2 row — the scheduled DinD-LocalTerra Playwright E2E — is heavier (browsers + a live chain) and stays open under #421. Part of #421 (Phase-2a; the E2E row remains open).

PlasticDigits commented

2026-06-30 03:37:26 +00:00

(Migrated from gitlab.com)

Security review — MR !971

Commit reviewed: e64fc7d1b8a5eead8e128a9702371be819759cbf (base 2a06048b)

Scope: Phase-2a GitLab CI — new test-indexer-integration job (postgres:16 service container, serial cargo test --tests) and docs/testing.md parity table / Phase wording updates.

Method: Diff-only review; traced CI variables and service wiring to the existing indexer integration harness (indexer/tests/common/mod.rs::setup_pool, TEST_DATABASE_URL). No prior security-review threads on this MR.

Outcome: FINDINGS: 0 medium+

Summary

This MR adds hosted CI execution of an integration suite that already runs locally via make test-indexer-integration. Changes are confined to .gitlab-ci.yml and documentation.

Reviewed attack surfaces:

Area	Result
Injection	Job runs fixed `cargo test --tests`; no shell interpolation of attacker input. TCP readiness loop uses a static host/port.
Authn/authz / secrets	`cl8y_legal:cl8y_legal` + `TEST_DATABASE_URL` are the documented local/test Postgres credentials (`skills/AGENTS_LOCAL_POSTGRES_DEV.md`, `scripts/lib/postgres-dev.env`). They provision an ephemeral `postgres:16` service on the runner-internal network only — not production. Job-level `variables:` pins `TEST_DATABASE_URL`, overriding project-level env if present. `indexer/.env` is gitignored and not in cache paths.
Network exposure	Postgres is a GitLab `services:` sidecar reachable only from the job container (`postgres:5432`). Integration harness binds API tests to `127.0.0.1`; no new inbound listener on the runner.
SSRF / request forgery	No new outbound URL sinks introduced; tests use harness defaults (`localhost:9999` LCD mock).
Supply chain	`postgres:16` and `rust:1.96-bookworm` follow the same unpinned-image pattern as the reference `.github/workflows/test.yml` indexer job and existing GitLab test jobs; `gitleaks` remains separately pinned per #380.
Cache	`test-indexer-integration` cache key is job-scoped; paths mirror `test-indexer-lib`. No plausible cross-pipeline credential or artifact exfil path identified on this diff.

Security review: no medium+ findings on this diff.

No inline threads (nothing to anchor).

## Security review — MR !971 **Commit reviewed:** `e64fc7d1b8a5eead8e128a9702371be819759cbf` (base `2a06048b`) **Scope:** Phase-2a GitLab CI — new `test-indexer-integration` job (`postgres:16` service container, serial `cargo test --tests`) and `docs/testing.md` parity table / Phase wording updates. **Method:** Diff-only review; traced CI variables and service wiring to the existing indexer integration harness (`indexer/tests/common/mod.rs::setup_pool`, `TEST_DATABASE_URL`). No prior security-review threads on this MR. **Outcome:** `FINDINGS: 0` medium+ ### Summary This MR adds hosted CI execution of an integration suite that already runs locally via `make test-indexer-integration`. Changes are confined to `.gitlab-ci.yml` and documentation. Reviewed attack surfaces: | Area | Result | |------|--------| | **Injection** | Job runs fixed `cargo test --tests`; no shell interpolation of attacker input. TCP readiness loop uses a static host/port. | | **Authn/authz / secrets** | `cl8y_legal:cl8y_legal` + `TEST_DATABASE_URL` are the documented **local/test** Postgres credentials (`skills/AGENTS_LOCAL_POSTGRES_DEV.md`, `scripts/lib/postgres-dev.env`). They provision an ephemeral `postgres:16` service on the runner-internal network only — not production. Job-level `variables:` pins `TEST_DATABASE_URL`, overriding project-level env if present. `indexer/.env` is gitignored and not in cache paths. | | **Network exposure** | Postgres is a GitLab `services:` sidecar reachable only from the job container (`postgres:5432`). Integration harness binds API tests to `127.0.0.1`; no new inbound listener on the runner. | | **SSRF / request forgery** | No new outbound URL sinks introduced; tests use harness defaults (`localhost:9999` LCD mock). | | **Supply chain** | `postgres:16` and `rust:1.96-bookworm` follow the same unpinned-image pattern as the reference `.github/workflows/test.yml` indexer job and existing GitLab test jobs; `gitleaks` remains separately pinned per #380. | | **Cache** | `test-indexer-integration` cache key is job-scoped; paths mirror `test-indexer-lib`. No plausible cross-pipeline credential or artifact exfil path identified on this diff. | **Security review: no medium+ findings on this diff.** No inline threads (nothing to anchor).