-
Notifications
You must be signed in to change notification settings - Fork 0
[codex] PostgreSQL compatibility harness foundation #50
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
45ea7ec
ca78d6b
b797917
d3a132c
91dab09
676d5a5
10a8857
c736fc5
6669125
599ad46
1d127af
6f3e6e3
1c819c7
38ae2a5
f99923c
1d064c5
f9e5890
5ed1427
241a8df
6aeb5ff
6fec5dc
01a2e3a
bcc707b
1f9122e
7663f51
5d1a12d
5fcdd18
e8241f9
7bbe5d1
2dcc0d4
901f666
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,9 +5,12 @@ on: | |
| branches: [main] | ||
| pull_request: | ||
| branches: [main] | ||
| schedule: | ||
| - cron: '17 3 * * 1' | ||
|
|
||
| jobs: | ||
| build-and-test: | ||
| if: github.event_name != 'schedule' | ||
| strategy: | ||
| matrix: | ||
| os: [ubuntu-22.04, ubuntu-24.04] | ||
|
|
@@ -22,6 +25,7 @@ jobs: | |
| run: make -f Makefile clean && make -f Makefile all | ||
|
|
||
| macos: | ||
| if: github.event_name != 'schedule' | ||
| runs-on: macos-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
@@ -38,6 +42,7 @@ jobs: | |
| run: make -f Makefile clean && make -f Makefile all MYSQL_CFLAGS="-I/opt/homebrew/opt/mysql-client/include" | ||
|
|
||
| benchmark: | ||
| if: github.event_name != 'schedule' | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
@@ -58,6 +63,7 @@ jobs: | |
| path: benchmark_results.json | ||
|
|
||
| corpus-test: | ||
| if: github.event_name != 'schedule' | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
@@ -96,3 +102,43 @@ jobs: | |
| grep -ohP '"((?:SELECT|INSERT|UPDATE|DELETE|SET|CREATE|ALTER|DROP|EXPLAIN|WITH)[^"]*)"' \ | ||
| /tmp/sqlparser-rs/tests/sqlparser_postgres.rs 2>/dev/null | \ | ||
| sed 's/^"//' | sed 's/"$//' | sed 's/\\"/"/g' | ./corpus_test pgsql | ||
|
|
||
| pg-compat: | ||
| if: github.event_name != 'schedule' | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 30 | ||
| env: | ||
| PG_COMPAT_CACHE: /tmp/parsersql-pg-compat | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Cache PostgreSQL compatibility sources | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: /tmp/parsersql-pg-compat | ||
| key: pg-compat-${{ runner.os }}-${{ hashFiles('tests/pg_compat/upstream_pins.json') }} | ||
| restore-keys: | | ||
| pg-compat-${{ runner.os }}- | ||
|
|
||
| - name: Test PostgreSQL compatibility gate | ||
| run: make -f Makefile test-pg-compat | ||
|
Comment on lines
+106
to
+124
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consolidation: Restrict job permissions and disable credential persistence in both pg-compat jobs. Both the
Both jobs only need read access to the repository; they do not write artifacts or deploy. 🧰 Tools🪛 zizmor (1.25.2)[warning] 113-113: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 106-124: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [error] 113-113: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 116-116: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 📍 Affects 1 file
🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| pg-compat-full: | ||
| if: github.event_name == 'schedule' | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 45 | ||
| env: | ||
| PG_COMPAT_CACHE: /tmp/parsersql-pg-compat | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Cache PostgreSQL compatibility sources | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: /tmp/parsersql-pg-compat | ||
| key: pg-compat-${{ runner.os }}-${{ hashFiles('tests/pg_compat/upstream_pins.json') }} | ||
| restore-keys: | | ||
| pg-compat-${{ runner.os }}- | ||
|
|
||
| - name: Validate full PostgreSQL compatibility baseline | ||
| run: make -f Makefile pg-compat | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consolidation: Pin all GitHub Actions to commit SHAs.
Four action references use unpinned semantic versions instead of commit SHAs, which violates the repository's security policy and allows unreviewed action mutations.
.github/workflows/ci.yml#L113:actions/checkout@v4→ pin to SHA.github/workflows/ci.yml#L116:actions/cache@v4→ pin to SHA.github/workflows/ci.yml#L133:actions/checkout@v4→ pin to SHA.github/workflows/ci.yml#L136:actions/cache@v4→ pin to SHAExample: replace
actions/checkout@v4withactions/checkout@11bd71901bbe5b1630ceea73d27597364c9af172(or the current latest v4 commit SHA).🧰 Tools
🪛 zizmor (1.25.2)
[warning] 113-113: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 113-113: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Source: Linters/SAST tools