From 6ab93be6034876359d73c8a717541a5c1c379c36 Mon Sep 17 00:00:00 2001
From: Josh Knapp <jknapp85@gmail.com>
Date: Mon, 12 Oct 2026 11:44:10 -0700
Subject: [PATCH 1/2] CI: add Postgres-backed db-tests job

Builds the pre-migrated test image from testing/dbtest/docker, runs the root
module's DB-backed tests on push/nightly/manual. Skips estimate tests that
also fail on untouched upstream.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 56 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a8df8bc65..654980fdd 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -49,3 +49,59 @@ jobs:
           fi
       - name: osv-scanner
         run: osv-scanner scan source -r .
+
+  # DB-backed Go tests need Postgres 16 with a pre-migrated template database.
+  # The image is built from testing/dbtest/docker (not HashiCorp's Docker Hub
+  # image) and published on 127.0.0.1:55432 because the tests hardcode loopback.
+  # Skipped on pull requests to spare the shared runner pool.
+  db-tests:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      TEST_DB_PORT: "55432"
+      PG_CONTAINER: threshold-sql-tests-${{ github.run_id }}
+    steps:
+      - name: require docker
+        run: |
+          if ! docker info >/dev/null 2>&1; then
+            echo "::error::this runner has no usable docker; db-tests need it"; exit 1
+          fi
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: .go-version
+          cache: false
+      - name: start postgres (pre-migrated template)
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker build -q -t threshold-test-pg:16 -f testing/dbtest/docker/Dockerfile.16-alpine testing/dbtest/docker
+          mkdir -p "$RUNNER_TEMP/benchmark_dumps"
+          docker run -d --name "$PG_CONTAINER" -p "$TEST_DB_PORT:5432" \
+            -e POSTGRES_PASSWORD=boundary -e POSTGRES_USER=boundary -e POSTGRES_DB=boundary \
+            -e PGDATA=/pgdata --mount type=tmpfs,destination=/pgdata \
+            -v "$PWD/internal/db/schema/migrations:/migrations" \
+            -v "$RUNNER_TEMP/benchmark_dumps:/benchmark_dumps" \
+            threshold-test-pg:16 -c config_file=/etc/postgresql/postgresql.conf
+          # init scripts run on a temporary server first; wait for the real one
+          for i in $(seq 1 120); do
+            if docker logs "$PG_CONTAINER" 2>&1 | grep -q "init process complete" \
+               && docker exec "$PG_CONTAINER" pg_isready -U boundary -d boundary >/dev/null 2>&1; then
+              echo "postgres ready"; exit 0
+            fi
+            sleep 3
+          done
+          docker logs "$PG_CONTAINER" | tail -30; echo "::error::postgres did not become ready"; exit 1
+      - name: go test (root module, DB-backed)
+        shell: bash
+        run: |
+          pkgs=$(go list ./... | grep -v -E '/testing/internal/e2e|/enos/|/internal/tests/(cli|api)')
+          # *Estimated*Count / ListDeletedStoreIds depend on pg planner stats and
+          # also fail on untouched upstream Boundary (verified); skipped here.
+          go test $pkgs -count=1 -p 2 -timeout 90m \
+            -skip 'EstimatedCount|EstimatedCredentialCount|ListDeletedStoreIds'  
+      - name: stop postgres
+        if: always()
+        run: docker rm -f -v "$PG_CONTAINER" || true
+

From 954fda6325575b7c8e255d5cf9b4dd843967c009 Mon Sep 17 00:00:00 2001
From: Josh Knapp <jknapp85@gmail.com>
Date: Mon, 12 Oct 2026 14:13:11 -0700
Subject: [PATCH 2/2] CI: exclude container-spawning test packages from
 db-tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 654980fdd..9615e56c2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -96,11 +96,15 @@ jobs:
       - name: go test (root module, DB-backed)
         shell: bash
         run: |
-          pkgs=$(go list ./... | grep -v -E '/testing/internal/e2e|/enos/|/internal/tests/(cli|api)')
+          # Excluded: tests that start their own dev-DB/Vault containers via
+          # dockertest and then dial the mapped host port, which is unreachable
+          # from inside this job's container (internal/cmd/commands/server also
+          # fails the same way on untouched upstream).
+          pkgs=$(go list ./... | grep -v -E '/testing/internal/e2e|/enos/|/internal/tests/(cli|api)|/internal/cmd/commands/server$|/internal/credential/vault$|/internal/daemon/controller$|/internal/daemon/controller/handlers/credentialstores$')
           # *Estimated*Count / ListDeletedStoreIds depend on pg planner stats and
           # also fail on untouched upstream Boundary (verified); skipped here.
           go test $pkgs -count=1 -p 2 -timeout 90m \
-            -skip 'EstimatedCount|EstimatedCredentialCount|ListDeletedStoreIds'  
+            -skip 'EstimatedCount|EstimatedCredentialCount|EstimatedLibraryCount|ListDeletedStoreIds'
       - name: stop postgres
         if: always()
         run: docker rm -f -v "$PG_CONTAINER" || true