Uh oh!
There was an error while loading. Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork 1
[codex] PostgreSQL compatibility harness foundation#50
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Uh oh!
There was an error while loading. Please reload this page.
Changes from all commits
45ea7ecca78d6bb797917d3a132c91dab09676d5a510a8857c736fc56669125599ad461d127af6f3e6e31c819c738ae2a5f99923c1d064c5f9e58905ed1427241a8df6aeb5ff6fec5dc01a2e3abcc707b1f9122e7663f515d1a12d5fcdd18e8241f97bbe5d12dcc0d4901f666e3f494dFile filter
Filter by extension
Conversations
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Uh oh!
There was an error while loading. Please reload this page.
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -5,9 +5,12 @@ on: | ||
| branches: [main] | ||
| pull_request: | ||
| branches: [main] | ||
| schedule: | ||
| - cron: '17 3 * * 1' | ||
| jobs: | ||
| build-and-test: | ||
| if: github.event_name != 'schedule' | ||
| strategy: | ||
| matrix: | ||
| os: [ubuntu-22.04, ubuntu-24.04] | ||
| @@ -22,6 +25,7 @@ jobs: | ||
| run: make -f Makefile clean && make -f Makefile all | ||
| macos: | ||
| if: github.event_name != 'schedule' | ||
| runs-on: macos-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| @@ -38,6 +42,7 @@ jobs: | ||
| run: make -f Makefile clean && make -f Makefile all MYSQL_CFLAGS="-I/opt/homebrew/opt/mysql-client/include" | ||
| benchmark: | ||
| if: github.event_name != 'schedule' | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| @@ -58,6 +63,7 @@ jobs: | ||
| path: benchmark_results.json | ||
| corpus-test: | ||
| if: github.event_name != 'schedule' | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| @@ -96,3 +102,43 @@ jobs: | ||
| grep -ohP '"((?:SELECT|INSERT|UPDATE|DELETE|SET|CREATE|ALTER|DROP|EXPLAIN|WITH)[^"]*)"' \ | ||
| /tmp/sqlparser-rs/tests/sqlparser_postgres.rs 2>/dev/null | \ | ||
| sed 's/^"//' | sed 's/"$//' | sed 's/\\"/"/g' | ./corpus_test pgsql | ||
| pg-compat: | ||
| if: github.event_name != 'schedule' | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 30 | ||
| env: | ||
| PG_COMPAT_CACHE: /tmp/parsersql-pg-compat | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Cache PostgreSQL compatibility sources | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: /tmp/parsersql-pg-compat | ||
| key: pg-compat-${{ runner.os }}-${{ hashFiles('tests/pg_compat/upstream_pins.json') }} | ||
| restore-keys: | | ||
| pg-compat-${{ runner.os }}- | ||
| - name: Test PostgreSQL compatibility gate | ||
| run: make -f Makefile test-pg-compat | ||
Comment on lines
+106
to
+124
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consolidation: Restrict job permissions and disable credential persistence in both pg-compat jobs. Both the
Both jobs only need read access to the repository; they do not write artifacts or deploy. 🧰 Tools🪛 zizmor (1.25.2)[warning] 113-113: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 106-124: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [error] 113-113: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 116-116: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 📍 Affects 1 file
🤖 Prompt for AI AgentsSource: Linters/SAST tools | ||
| pg-compat-full: | ||
| if: github.event_name == 'schedule' | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 45 | ||
| env: | ||
| PG_COMPAT_CACHE: /tmp/parsersql-pg-compat | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Cache PostgreSQL compatibility sources | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: /tmp/parsersql-pg-compat | ||
| key: pg-compat-${{ runner.os }}-${{ hashFiles('tests/pg_compat/upstream_pins.json') }} | ||
| restore-keys: | | ||
| pg-compat-${{ runner.os }}- | ||
| - name: Validate full PostgreSQL compatibility baseline | ||
| run: make -f Makefile pg-compat | ||
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consolidation: Pin all GitHub Actions to commit SHAs.
Four action references use unpinned semantic versions instead of commit SHAs, which violates the repository's security policy and allows unreviewed action mutations.
.github/workflows/ci.yml#L113:actions/checkout@v4→ pin to SHA.github/workflows/ci.yml#L116:actions/cache@v4→ pin to SHA.github/workflows/ci.yml#L133:actions/checkout@v4→ pin to SHA.github/workflows/ci.yml#L136:actions/cache@v4→ pin to SHAExample: replace
actions/checkout@v4withactions/checkout@11bd71901bbe5b1630ceea73d27597364c9af172(or the current latest v4 commit SHA).🧰 Tools
🪛 zizmor (1.25.2)
[warning] 113-113: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 113-113: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Source: Linters/SAST tools