CI: add Postgres-backed db-tests job

Builds the pre-migrated test image from testing/dbtest/docker, runs the root
module's DB-backed tests on push/nightly/manual. Skips estimate tests that
also fail on untouched upstream.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -49,3 +49,59 @@ jobs:
           fi
       - name: osv-scanner
         run: osv-scanner scan source -r .
+
+  # DB-backed Go tests need Postgres 16 with a pre-migrated template database.
+  # The image is built from testing/dbtest/docker (not HashiCorp's Docker Hub
+  # image) and published on 127.0.0.1:55432 because the tests hardcode loopback.
+  # Skipped on pull requests to spare the shared runner pool.
+  db-tests:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      TEST_DB_PORT: "55432"
+      PG_CONTAINER: threshold-sql-tests-${{ github.run_id }}
+    steps:
+      - name: require docker
+        run: |
+          if ! docker info >/dev/null 2>&1; then
+            echo "::error::this runner has no usable docker; db-tests need it"; exit 1
+          fi
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: .go-version
+          cache: false
+      - name: start postgres (pre-migrated template)
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker build -q -t threshold-test-pg:16 -f testing/dbtest/docker/Dockerfile.16-alpine testing/dbtest/docker
+          mkdir -p "$RUNNER_TEMP/benchmark_dumps"
+          docker run -d --name "$PG_CONTAINER" -p "$TEST_DB_PORT:5432" \
+            -e POSTGRES_PASSWORD=boundary -e POSTGRES_USER=boundary -e POSTGRES_DB=boundary \
+            -e PGDATA=/pgdata --mount type=tmpfs,destination=/pgdata \
+            -v "$PWD/internal/db/schema/migrations:/migrations" \
+            -v "$RUNNER_TEMP/benchmark_dumps:/benchmark_dumps" \
+            threshold-test-pg:16 -c config_file=/etc/postgresql/postgresql.conf
+          # init scripts run on a temporary server first; wait for the real one
+          for i in $(seq 1 120); do
+            if docker logs "$PG_CONTAINER" 2>&1 | grep -q "init process complete" \
+               && docker exec "$PG_CONTAINER" pg_isready -U boundary -d boundary >/dev/null 2>&1; then
+              echo "postgres ready"; exit 0
+            fi
+            sleep 3
+          done
+          docker logs "$PG_CONTAINER" | tail -30; echo "::error::postgres did not become ready"; exit 1
+      - name: go test (root module, DB-backed)
+        shell: bash
+        run: |
+          pkgs=$(go list ./... | grep -v -E '/testing/internal/e2e|/enos/|/internal/tests/(cli|api)')
+          # *Estimated*Count / ListDeletedStoreIds depend on pg planner stats and
+          # also fail on untouched upstream Boundary (verified); skipped here.
+          go test $pkgs -count=1 -p 2 -timeout 90m \
+            -skip 'EstimatedCount|EstimatedCredentialCount|ListDeletedStoreIds'  
+      - name: stop postgres
+        if: always()
+        run: docker rm -f -v "$PG_CONTAINER" || true
+