chore: add newly disclosed PostgreSQL CVEs #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Neon Integration (PG15-PG18) | |
| # | |
| # PR-driven validation against long-lived Neon projects (one per PG major | |
| # version). Installs pg_stat_statements, then pgFirstAid.sql and | |
| # view_pgFirstAid_managed.sql, runs the integration + pgTAP suite, and | |
| # finishes with seed_and_validate.py --managed. | |
| # | |
| # Required secrets (one set per PG version): | |
| # PG15_HOST, PG15_PORT, PG15_USER, PG15_PASSWORD, PG15_DATABASE | |
| # PG16_HOST, PG16_PORT, PG16_USER, PG16_PASSWORD, PG16_DATABASE | |
| # PG17_HOST, PG17_PORT, PG17_USER, PG17_PASSWORD, PG17_DATABASE | |
| # PG18_HOST, PG18_PORT, PG18_USER, PG18_PASSWORD, PG18_DATABASE | |
| # | |
| # Note: pull_request from forks gets no repo secrets. Fork PRs fail at | |
| # "Validate required PG env vars". Maintainers can validate by pushing | |
| # the change to a same-repo branch first. | |
| name: Neon Integration (PG15-PG18) | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| types: [opened, synchronize] | |
| paths: | |
| - pgFirstAid.sql | |
| - view_pgFirstAid.sql | |
| - view_pgFirstAid_managed.sql | |
| - testing/integration/** | |
| - testing/pgTAP/** | |
| - .github/workflows/neon-integration-pg-matrix.yml | |
| concurrency: | |
| group: neon-integration-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| integration: | |
| runs-on: [self-hosted, nix, nixos, x86_64-linux] | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| # here too. Without a matching leg, the job fails closed instead of | |
| # silently defaulting to PG18. | |
| matrix: | |
| include: | |
| - postgres_version: "15" | |
| pg_host_secret: PG15_HOST | |
| pg_port_secret: PG15_PORT | |
| pg_user_secret: PG15_USER | |
| pg_password_secret: PG15_PASSWORD | |
| pg_database_secret: PG15_DATABASE | |
| - postgres_version: "16" | |
| pg_host_secret: PG16_HOST | |
| pg_port_secret: PG16_PORT | |
| pg_user_secret: PG16_USER | |
| pg_password_secret: PG16_PASSWORD | |
| pg_database_secret: PG16_DATABASE | |
| - postgres_version: "17" | |
| pg_host_secret: PG17_HOST | |
| pg_port_secret: PG17_PORT | |
| pg_user_secret: PG17_USER | |
| pg_password_secret: PG17_PASSWORD | |
| pg_database_secret: PG17_DATABASE | |
| - postgres_version: "18" | |
| pg_host_secret: PG18_HOST | |
| pg_port_secret: PG18_PORT | |
| pg_user_secret: PG18_USER | |
| pg_password_secret: PG18_PASSWORD | |
| pg_database_secret: PG18_DATABASE | |
| name: PG${{ matrix.postgres_version }} (Neon) | |
| defaults: | |
| run: | |
| shell: bash -l {0} | |
| working-directory: testing/integration | |
| env: | |
| PGHOST: ${{ secrets[matrix.pg_host_secret] }} | |
| PGPORT: ${{ secrets[matrix.pg_port_secret] }} | |
| PGUSER: ${{ secrets[matrix.pg_user_secret] }} | |
| PGPASSWORD: ${{ secrets[matrix.pg_password_secret] }} | |
| PGDATABASE: ${{ secrets[matrix.pg_database_secret] }} | |
| PGSSLMODE: require | |
| PGFA_TEST_VIEW_MODE: managed | |
| PGFA_TEST_ACTIVE_CONN_TARGET: "52" | |
| PGFA_TEST_ACTIVE_CONN_SLEEP_SECONDS: "20" | |
| PGFA_TEST_WAIT_TIMEOUT_SECONDS: "45" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| ref: ${{ github.event.pull_request.head.sha || github.ref }} | |
| - name: Add Nix profile paths | |
| run: | | |
| echo "/run/current-system/sw/bin" >> "$GITHUB_PATH" | |
| echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH" | |
| echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH" | |
| echo "/etc/profiles/per-user/$USER/bin" >> "$GITHUB_PATH" | |
| - name: Validate required PG env vars | |
| run: | | |
| missing=0 | |
| for var in PGHOST PGPORT PGUSER PGPASSWORD PGDATABASE; do | |
| if [ -z "${!var}" ]; then | |
| echo "::error::Missing required secret/env: ${var} for PG${{ matrix.postgres_version }}" | |
| missing=1 | |
| fi | |
| done | |
| if [ "$missing" -ne 0 ]; then | |
| exit 1 | |
| fi | |
| - name: Verify PostgreSQL client is installed | |
| run: | | |
| if ! command -v psql >/dev/null 2>&1; then | |
| echo "::error::psql not found on runner. Install postgresql-client on the self-hosted VM." | |
| exit 1 | |
| fi | |
| psql --version | |
| - name: Verify uv is installed on runner | |
| run: | | |
| if ! command -v uv >/dev/null 2>&1; then | |
| echo "::error::uv not found on runner. Install uv on the self-hosted NixOS runner." | |
| exit 1 | |
| fi | |
| uv --version | |
| - name: Sync dependencies | |
| run: uv sync | |
| - name: Terminate idle connections from previous runs | |
| continue-on-error: true | |
| run: | | |
| psql -c " | |
| SELECT pg_terminate_backend(pid) | |
| FROM pg_stat_activity | |
| WHERE pid <> pg_backend_pid() | |
| AND usename = current_user | |
| AND state IN ('idle', 'idle in transaction', 'idle in transaction (aborted)') | |
| " | |
| - name: Install pg_stat_statements | |
| run: | | |
| psql -v ON_ERROR_STOP=1 -c "CREATE EXTENSION IF NOT EXISTS pg_stat_statements;" | |
| - name: Install pgFirstAid function | |
| run: | | |
| psql -v ON_ERROR_STOP=1 -f ../../pgFirstAid.sql | |
| - name: Recreate managed view only | |
| run: | | |
| psql -v ON_ERROR_STOP=1 \ | |
| -c "SET lock_timeout = '30s'" \ | |
| -c "DROP VIEW IF EXISTS v_pgfirstaid" | |
| psql -v ON_ERROR_STOP=1 \ | |
| -c "SET lock_timeout = '30s'" \ | |
| -f ../../view_pgFirstAid_managed.sql | |
| - name: Run integration tests | |
| run: uv run python -m pytest tests/integration -m integration | |
| - name: Run seed and validate harness | |
| run: uv run python ../seed_and_validate.py --managed |