From 0434fbbf657bf011272bd80f8abf1834927d49d8 Mon Sep 17 00:00:00 2001 From: Zaid-edge Date: Mon, 24 Aug 2026 21:05:32 +0500 Subject: [PATCH 1/2] CI: run snowflake regressions against PostgreSQL 19 Add 19 to the regression matrix. PG 19 has not gone GA, so the only tags on the postgres repo are REL_19_BETA1..BETA3, and the previous tag selection filtered them out (its `REL_[0-9]+_[0-9]+` regex only matches numeric minors), leaving LATEST_TAG empty and `git checkout` failing. Rework the tag-selection step to prefer the newest stable minor and fall back to the newest BETA/RC tag when a major has no stable release yet. sort -V orders BETA1 < BETA2 < BETA3 < RC1, so today PG 19 resolves to REL_19_BETA3 and will pick up BETA4/RC1/REL_19_0 automatically as they are tagged. An unresolvable major now fails loudly instead of silently checking out nothing. Also pass the version through the environment instead of interpolating it into a double-quoted docker exec string, which lets the inner script be single-quoted and drop the backslash escaping. Co-Authored-By: Claude Opus 5 (1M context) --- .../workflows/snowflake_regression_tests.yml | 41 ++++++++++++++----- 1 file changed, 31 insertions(+), 10 deletions(-) diff --git a/.github/workflows/snowflake_regression_tests.yml b/.github/workflows/snowflake_regression_tests.yml index 3dcc9fe..c210020 100644 --- a/.github/workflows/snowflake_regression_tests.yml +++ b/.github/workflows/snowflake_regression_tests.yml @@ -14,7 +14,7 @@ jobs: fail-fast: false matrix: os: [ubuntu-22.04] - pgver: [15, 16, 17, 18] + pgver: [15, 16, 17, 18, 19] runs-on: ${{ matrix.os }} @@ -37,7 +37,7 @@ jobs: - name: Run Docker Container with Unique Port run: | - PGPORT=$((5400 + ${{ matrix.pgver }})) # Assign unique ports (5415, 5416, 5417) + PGPORT=$((5400 + ${{ matrix.pgver }})) # Assign unique ports (5415 .. 5419) CONTAINER_NAME=snowflake-${{ matrix.pgver }} # Unique container name echo "Starting PostgreSQL container: $CONTAINER_NAME on port $PGPORT" @@ -112,15 +112,36 @@ jobs: " - name: Checkout the latest PostgreSQL tag that matches matrix.pgver + env: + MATRIX_PGVER: ${{ matrix.pgver }} run: | - docker exec -u postgres snowflake-${{ matrix.pgver }} bash -c " - cd /home/postgres/postgres-source && \ - git fetch --tags && \ - MATRIX_PGVER=${{ matrix.pgver }} && \ - LATEST_TAG=\$(git tag -l \"REL_\${MATRIX_PGVER}*\" | grep -Eo 'REL_[0-9]+_[0-9]+(_[0-9]+)?' | sort -V | tail -n 1) && \ - git checkout \$LATEST_TAG && \ - echo \"Checked out tag: \$LATEST_TAG\" - " + docker exec -u postgres -e MATRIX_PGVER="$MATRIX_PGVER" \ + snowflake-"$MATRIX_PGVER" bash -c ' + set -e + cd /home/postgres/postgres-source + git fetch --tags + + # Released majors: pick the newest stable minor, e.g. REL_18_1. + LATEST_TAG=$(git tag -l "REL_${MATRIX_PGVER}_*" \ + | grep -E "^REL_${MATRIX_PGVER}_[0-9]+$" | sort -V | tail -n 1) + + # Pre-GA majors (PG 19 today) have only REL__BETAn / _RCn + # tags, which the stable pattern above deliberately skips. sort -V + # orders BETA1 < BETA2 < BETA3 < RC1, so the newest pre-release wins. + if [ -z "$LATEST_TAG" ]; then + LATEST_TAG=$(git tag -l "REL_${MATRIX_PGVER}_*" \ + | grep -E "^REL_${MATRIX_PGVER}_(BETA|RC)[0-9]+$" | sort -V | tail -n 1) + echo "No stable tag for PG ${MATRIX_PGVER}; using a pre-release tag." + fi + + if [ -z "$LATEST_TAG" ]; then + echo "Error: no REL_${MATRIX_PGVER}_* tag found" >&2 + exit 1 + fi + + git checkout "$LATEST_TAG" + echo "Checked out tag: $LATEST_TAG" + ' - name: Configure, build, and install PostgreSQL run: | From 76049d498e26af1879fbd550adf85e596911370a Mon Sep 17 00:00:00 2001 From: Zaid-edge Date: Mon, 24 Aug 2026 21:54:50 +0500 Subject: [PATCH 2/2] Don't hand GITHUB_TOKEN to the in-container snowflake clone pgEdge/snowflake is public, so the clone needs no credential. The token was interpolated by the runner shell straight into the docker exec argument list, which put it on the container's command line in a job that builds PR-controlled code. Clone anonymously instead, drop the now-unused GITHUB_TOKEN from the step environment, and pin the workflow to permissions: contents: read so the token actions/checkout does use cannot write to the repo. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/snowflake_regression_tests.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/snowflake_regression_tests.yml b/.github/workflows/snowflake_regression_tests.yml index c210020..959a4af 100644 --- a/.github/workflows/snowflake_regression_tests.yml +++ b/.github/workflows/snowflake_regression_tests.yml @@ -8,6 +8,11 @@ on: pull_request: types: [opened, synchronize, reopened] +# The only thing this workflow needs the token for is actions/checkout and +# the public clones below. Nothing here writes to the repo. +permissions: + contents: read + jobs: run-scripts: strategy: @@ -214,7 +219,7 @@ jobs: # Clone Snowflake extension if it doesn't exist if [ ! -d \"snowflake\" ]; then \ echo 'Cloning Snowflake extension...' && \ - git clone https://x-access-token:${GITHUB_TOKEN}@github.com/pgEdge/snowflake.git snowflake; \ + git clone https://github.com/pgEdge/snowflake.git snowflake; \ fi && \ # Move into the Snowflake extension directory @@ -224,8 +229,6 @@ jobs: echo 'Building Snowflake extension...' && \ USE_PGXS=1 make " - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Make Install Snowflake as Root run: |