From dc445db3e8cb53744337da5674c746895180ea21 Mon Sep 17 00:00:00 2001 From: Lindsay Holmwood Date: Wed, 7 Oct 2026 09:14:59 +1100 Subject: [PATCH] fix(eql): test the built bundle in test:encryption:postgres, and refuse an empty --ignored selection The task installed crates/eql-bindings/sql/cipherstash-encrypt.sql, the released bundle that only the lockstep version bump rewrites. A SQL edit in a pull request never reached the PostgreSQL encryption test, which went on passing against the bytes of the previous release. It now depends on `build` and installs release/cipherstash-encrypt.sql, the bundle the tree produces, as test:sqlx:prep already does. `cargo test -- --ignored` exits 0 when the filter selects nothing, so a renamed or un-ignored test would leave the task green on zero tests. The task lists the selection first and fails when it is empty, the pattern the snapshot tasks in this file already use. Both were found by cipherstash-bot in review of #971 and left for a follow-up. --- packages/eql/mise.toml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/packages/eql/mise.toml b/packages/eql/mise.toml index 8f50e8bde..8ec42876c 100644 --- a/packages/eql/mise.toml +++ b/packages/eql/mise.toml @@ -296,7 +296,12 @@ cargo clippy --locked -p eql-bindings -p eql-encryption-tests --all-features --a """ [tasks."test:encryption:postgres"] -description = "Install the EQL bundle into the database EQL_TEST_DATABASE_URL names and run the stack-encrypt PostgreSQL test against it (fresh encryption, fake KMS)" +description = "Install the EQL bundle built from the tree into the database EQL_TEST_DATABASE_URL names and run the stack-encrypt PostgreSQL test against it (fresh encryption, fake KMS)" +# `build` writes release/cipherstash-encrypt.sql from the SQL in the tree. The +# copy under crates/eql-bindings/sql is the RELEASED bundle, rewritten only by +# the lockstep version bump, so a test that installs it cannot see a SQL edit +# made in the same pull request. +depends = ["build"] dir = "{{config_root}}" run = """ #!/usr/bin/env bash @@ -304,7 +309,12 @@ run = """ # different databases. psql accepts a libpq conninfo string as its dbname. set -euo pipefail : "${EQL_TEST_DATABASE_URL:?set EQL_TEST_DATABASE_URL to a libpq connection string for a disposable PostgreSQL}" -psql "$EQL_TEST_DATABASE_URL" -v ON_ERROR_STOP=1 -f crates/eql-bindings/sql/cipherstash-encrypt.sql +psql "$EQL_TEST_DATABASE_URL" -v ON_ERROR_STOP=1 -f release/cipherstash-encrypt.sql +# `--ignored` selects by attribute, and cargo exits 0 on an empty selection, so +# a test that loses its `#[ignore]` or is renamed would leave this task passing +# on nothing. List what the filter selects before running it. +listing=$(cargo test --locked -p eql-encryption-tests --test text_eq -- --ignored --list | sed -n 's/: test$//p') +[ -n "$listing" ] || { echo "error: '--ignored' selects no test in text_eq; the PostgreSQL test has gone missing." >&2; exit 1; } cargo test --locked -p eql-encryption-tests --test text_eq -- --ignored """