[nellshamrell]

Summary

Set the PostgreSQL demo to tls: 'disabled' and PGSSLMODE=disable for disposable, private Kubernetes environments. Preserve password authentication, the password Secret and existing connections.

Add one PostgreSQL CI case that checks recipe identity, plaintext transport, password enforcement and persisted CRUD before running the existing Playwright tests. Make Bicep validation reject unsupported tls diagnostics for this sample, even when the compiler exits successfully with a warning.

Reason for change

The certificate-free demo must explicitly disable TLS before adopting recipes that enforce it by default. The resource default remains required; optional still needs certificates. The guarded Azure PostgreSQL recipe rejects disabled.

Depends on radius-project/resource-types-contrib#394.

Do not merge yet. The public extension tested in CI rejects disabled, and the PostgreSQL job fails at the artifact gate. Compatible schemas and recipes must be published and adopted before maintainers set POSTGRESQL_DISABLED_RECIPE_SOURCE and POSTGRESQL_DISABLED_RECIPE_DIGEST to reviewed values. These variables verify the selected recipe; they do not publish or select it.

This PR targets edge, not v0.61. It does not change the client or image publisher. Merging to edge triggers publication of all six sample images through the existing workflow, so approval must cover that side effect.

How to test

Recorded results for head 41a0b7a:

Command / check	Result
python -m unittest discover -s .github/scripts -p test_validate_bicep.py	Passed all 7 tests in CI.
python ./.github/scripts/validate_bicep.py	Failed on BCP036 for tls: 'disabled'. The validator now correctly treats this unsupported value as a failure.
PostgreSQL sample CI	Failed at the artifact gate. Deployment, runtime checks and Playwright did not run.

After compatible artifacts are adopted, require the PostgreSQL job to pass its runtime checks and Playwright tests. Earlier direct-Docker probes passed, but they do not prove Radius deployment works. Test the published demo image separately with the compatible Radius artifacts; after merge, verify the tutorial against the newly published image.

File change summary

File	Summary of change
samples/demo/app-postgresql.bicep	Disable TLS on server and client; allow CI to override the demo image.
samples/demo/README.md	Document private development use, prerequisites, password input and cleanup.
.github/workflows/test.yaml	Add the PostgreSQL case, artifact checks and protected test credentials.
.github/scripts/check-postgresql-disabled.mjs	Check recipe selection, overrides, runtime namespace and deployed configuration.
.github/scripts/probe-postgresql-disabled.cjs	Verify plaintext transport, password enforcement, forced-TLS rejection and persisted CRUD.
.github/scripts/validate_bicep.py	Reject unsupported tls diagnostics for this sample; leave unrelated warnings unchanged.
.github/scripts/test_validate_bicep.py	Test diagnostic handling and validator exit status.
.github/workflows/validate-bicep.yaml	Run the diagnostic tests before compilation.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[nellshamrell]

Final readiness-fix verification for 41a0b7a0b12c2062a4146bb1c96162e48502387b:

• DCO check 117199096720: success for the repaired, signed history.
• General Bicep validation: all seven fixtures passed; the general validator then correctly failed with exit 1 on the public extension's BCP036 tls: disabled warning. The false-green finding is fixed; compatible public compilation remains blocked.
• PostgreSQL row: completed with failure at Check PostgreSQL policy artifact gate. No runtime or Playwright acceptance is claimed.
• Manifest SHA256 remains 0d815eff59dbeda49e496884c8be2ebc9ccc11aa95532e2100f69f47f4bfdc44. The original-tip recovery ref is retained; the unused uniquely tagged local probe image has now been removed.

No repository variables, merges, workflow dispatches, or public publications were performed. The PR remains draft pending compatible publication/adoption and full acceptance.

[nellshamrell]

Additional verified adoption dependency from the coordinated Radius investigation: Radius currently selects Radius.Data/v0.3.0 (resource-type pin beginning 18142182), and contrib notification / Radius synchronization treat stable namespace releases as authoritative. A contrib main merge and an edge recipe publication alone therefore cannot advance the selected PostgreSQL schema.

The normal adoption path requires a separately approved Radius.Data namespace release containing the fix, followed by the generated Radius update PR, its reviewed merge, and verification of the resulting public Bicep extension and registered runtime schema. No release is authorized by this samples work. The reviewed recipe variables remain unconfigured and the gates remain blocked.

Public compile-time schema, registered runtime schema, and the effective recipe pack are separate acceptance gates. The edge chart's deployment-engine:latest reference does not establish any of those schema/recipe identities. No further samples code change is required for this dependency; no release, variable change, merge, or publication was performed.