Verify research SQL and read-only permissions in isolated PostgreSQL CI

2026-11-07 02:44:55 +08:00
parent 028e453d92
commit 913bf4292b
4 changed files with 226 additions and 2 deletions
@@ -67,12 +67,14 @@ END $$;
 ROLLBACK;
 SQL
 printf 'Migration preserved existing logins and enforced project isolation.\n'
-for package in platform auth; do
+psql < internal/research/testdata/corpus.sql
+for package in platform auth research; do
  CGO_ENABLED=0 go test -mod=readonly -c -o "bin/$package-tests" "./internal/$package"
  docker run --rm --network "container:$container" --user 1000:1000 \
    --read-only --cap-drop ALL --security-opt no-new-privileges \
    --tmpfs /tmp:rw,nosuid,nodev,noexec,size=16m,mode=1777 \
    --mount "type=bind,source=$(pwd)/bin/$package-tests,target=/opt/integration-tests,readonly" \
    -e PLATFORM_TEST_DATABASE_URL=postgres://foundry_fixture@127.0.0.1:5432/postgres?sslmode=disable \
+    -e RESEARCH_TEST_DATABASE_URL=postgres://foundry_research_fixture@127.0.0.1:5432/postgres?sslmode=disable \
    --entrypoint /opt/integration-tests postgres:17-alpine -test.v
 done