From a6891cc6207d80466b34162da3d7b044e7096e19 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 20 Oct 2026 00:33:03 +0000
Subject: [PATCH] ci: run the @cipherstash/migrate database suites in CI

The migrate integration suites (forward and reverse backfill: resume,
the force obligation, the concurrent dual-write guard) skip unless
PG_TEST_URL is set, and nothing set it, so they ran nowhere and a
skipped suite read as a passing one. The run-tests job now creates a
separate migrate_test database on its existing Postgres service and
passes PG_TEST_URL through turbo. A separate database because each
suite drops the cipherstash schema, which would race the CLI live
suites running in parallel in the shared one. A guard test fails if the
variable, its database or the step that creates it goes missing.

Refs #1294

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018TacM4u97tr5yPAFynxYXW
---
 .github/workflows/tests.yml                   | 11 ++++++++
 .../__tests__/cli-live-postgres-ci.test.mjs   | 26 +++++++++++++++++++
 turbo.json                                    |  2 +-
 3 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b596f07b9..ba7affc68 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -373,10 +373,21 @@ jobs:
       # races destructively under the other suites in parallel forks).
       # (`supabase-push.live.test.ts` gates on different env vars and still
       # skips here — it needs the Supabase CLI binary.)
+      #
+      # PG_TEST_URL runs `@cipherstash/migrate`'s integration suites (forward
+      # and reverse backfill: resume, force obligation, concurrent dual-writes).
+      # They self-skip without it. They need no credentials, but each opens
+      # with DROP SCHEMA cipherstash CASCADE, so they get a database of their
+      # own: turbo runs packages in parallel, and in the shared one that drop
+      # would race the CLI's live suites.
+      - name: Create the migrate integration database
+        run: psql "postgres://cipherstash:password@localhost:5432/cipherstash" -c 'CREATE DATABASE migrate_test'
+
       - name: Run tests
         run: pnpm run test
         env:
           STASH_TEST_DATABASE_URL: postgres://cipherstash:password@localhost:5432/cipherstash
+          PG_TEST_URL: postgres://cipherstash:password@localhost:5432/migrate_test
 
       # CLI E2E tests drive the built `dist/bin/stash.js` through a real
       # pseudo-terminal via node-pty. Run via turbo so the `^build` + `build`
diff --git a/scripts/__tests__/cli-live-postgres-ci.test.mjs b/scripts/__tests__/cli-live-postgres-ci.test.mjs
index 5819eaee8..01abae581 100644
--- a/scripts/__tests__/cli-live-postgres-ci.test.mjs
+++ b/scripts/__tests__/cli-live-postgres-ci.test.mjs
@@ -22,6 +22,32 @@ describe('CLI live-Postgres CI contract', () => {
     )
   })
 
+  // `@cipherstash/migrate`'s integration suites self-skip without PG_TEST_URL,
+  // so a dropped variable reads as a green run. They DROP the `cipherstash`
+  // schema, so they must not share the CLI live suites' database.
+  it('forwards and supplies the migrate integration database URL', () => {
+    const turbo = readJsonc(join(REPO_ROOT, 'turbo.json'))
+    expect(turbo.tasks.test.env).toContain('PG_TEST_URL')
+
+    const workflow = readWorkflow('.github/workflows/tests.yml')
+    const runTests = workflow.jobs['run-tests'].steps.find(
+      (step) => step.name === 'Run tests',
+    )
+    const url = runTests.env.PG_TEST_URL
+    expect(url).toMatch(/^postgres:\/\/[^/]+\/\w+$/)
+    const database = url.split('/').at(-1)
+    expect(database).not.toBe(
+      runTests.env.STASH_TEST_DATABASE_URL.split('/').at(-1),
+    )
+
+    const steps = workflow.jobs['run-tests'].steps
+    const create = steps.findIndex((step) =>
+      String(step.run ?? '').includes(`CREATE DATABASE ${database}`),
+    )
+    expect(create).toBeGreaterThan(-1)
+    expect(create).toBeLessThan(steps.indexOf(runTests))
+  })
+
   it('runs the live reinstall suite against both pre-17 and current Postgres catalogs', () => {
     const workflow = readWorkflow('.github/workflows/tests.yml')
     const runTests = workflow.jobs['run-tests']
diff --git a/turbo.json b/turbo.json
index da8c14fdb..3ca98935a 100644
--- a/turbo.json
+++ b/turbo.json
@@ -18,7 +18,7 @@
     "test": {
       "dependsOn": ["^build"],
       "inputs": ["$TURBO_DEFAULT$", ".env*"],
-      "env": ["STASH_TEST_DATABASE_URL"],
+      "env": ["STASH_TEST_DATABASE_URL", "PG_TEST_URL"],
       "cache": false
     },
     // `languages/typescript/packages/bench`'s "build" is `tsc --noEmit` — a typecheck, not a bundle —